Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I can't remove www.searching.com from my computer


  • This topic is locked This topic is locked
90 replies to this topic

#1 SnickerSmom

SnickerSmom

  • Members
  • 56 posts
  • OFFLINE
  •  
  • Local time:12:50 PM

Posted 08 January 2016 - 11:11 PM

www.searching.com, has hijacked my browsers. I have tried removing the program through the control panel, have run rkill, malwarebytes, adwcleaner and spybot and it is still there. I have reset my browsers and and now I can't set chrome as my default browser. I get a message when I try to open certain files that says, "This app can't open using the Built in Administrator account. Sign in with a different account and try again". How do I fix this? I have run the Farbar Recovery Scan Tool and am including those files. Any help would be appreciated.

Attached Files

  • Attached File  FRST.txt   103.13KB   20 downloads

Edited by Queen-Evie, 09 January 2016 - 12:24 AM.
moved from Windows 10 Support to Malware Removal Logs. FRST logs are allowed only in MRL forum.


BC AdBot (Login to Remove)

 


#2 loki2007

loki2007

  • Members
  • 551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Hampshire
  • Local time:02:50 PM

Posted 11 January 2016 - 11:20 AM

Hi SnickerSmom,

I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.

 

Thanks,

 

loki


 
Member of the Bleeping Computer A.I.I. early response team!

#3 SnickerSmom

SnickerSmom
  • Topic Starter

  • Members
  • 56 posts
  • OFFLINE
  •  
  • Local time:12:50 PM

Posted 11 January 2016 - 12:46 PM

Ok. Thank you,loki.



#4 loki2007

loki2007

  • Members
  • 551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Hampshire
  • Local time:02:50 PM

Posted 11 January 2016 - 02:45 PM

Hi again SnickerSmom,

 

I am currently still reviewing your logs. I noticed you ran the FRST program from your downloads directory. If possible could you please move the program to your desktop? This will make running our fixes easier. We need to run FRST again to produce the addition.txt file, please follow the steps below and report back with any issues.

 

Step 1:

 

  • Please move the FRST program from your downloads folder to your desktop.
  • Right-click FRST then click "Run as administrator" (XP users: click run after receipt of Windows Security Warning - Open File).
  • When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • When finished, it will produce a log called FRST.txt in the same directory the tool was run from.
  • Please copy and paste the log in your next reply.

Note 2: The first time the tool is run it generates another log (Addition.txt - also located in the same directory the tool was run from). Please also paste that, along with the FRST.txt into your next reply.

 

Please copy and paste the results from both FRST.txt and Addition.txt in your next reply. Thanks,

 

loki


 
Member of the Bleeping Computer A.I.I. early response team!

#5 SnickerSmom

SnickerSmom
  • Topic Starter

  • Members
  • 56 posts
  • OFFLINE
  •  
  • Local time:12:50 PM

Posted 11 January 2016 - 06:09 PM

 Hi loki,

 Here are the results from the FRST scan:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-01-2015
Ran by SnickerSmom (administrator) on SNICKERSMOM-PC (11-01-2016 15:53:48)
Running from C:\Users\SnickerSmom\Downloads
Loaded Profiles: SnickerSmom (Available Profiles: SnickerSmom & Snick & DefaultAppPool)
Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(CYREN Inc.) C:\Program Files\Common Files\Commtouch\AntiVirus5\vsedsps.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(CYREN Inc.) C:\Program Files\Common Files\Commtouch\AntiVirus5\vseamps.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\System Mechanic Professional\System Shield\ioloSSTray.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\System Mechanic Professional\ioloGovernor64.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Spotify Ltd) C:\Users\SnickerSmom\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Flux Software LLC) C:\Users\SnickerSmom\AppData\Local\FluxSoftware\Flux\flux.exe
(Amazon.com Inc.) C:\Users\SnickerSmom\AppData\Local\Amazon Cloud Drive\AmazonCloudDrive.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\System Mechanic Professional\LiveBoost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe
 
Here is the Addition.txt:
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version:07-01-2015
Ran by SnickerSmom (2016-01-08 20:49:22)
Running from C:\Users\SnickerSmom\Downloads
Windows 10 Home (X64) (2016-01-01 11:49:11)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-1673558610-3607175664-3325060128-500 - Administrator - Disabled)
ASPNET (S-1-5-21-1673558610-3607175664-3325060128-1005 - Limited - Enabled)
DefaultAccount (S-1-5-21-1673558610-3607175664-3325060128-503 - Limited - Disabled)
Guest (S-1-5-21-1673558610-3607175664-3325060128-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1673558610-3607175664-3325060128-1002 - Limited - Enabled)
Snick (S-1-5-21-1673558610-3607175664-3325060128-1009 - Limited - Enabled) => C:\Users\Snick
SnickerSmom (S-1-5-21-1673558610-3607175664-3325060128-1000 - Administrator - Enabled) => C:\Users\SnickerSmom
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: System Shield (Enabled - Up to date) {3030810C-E2AC-B12D-8BB1-B1B8C0193798}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: System Shield (Enabled - Up to date) {8B5160E8-C496-BEA3-B101-8ACABB9E7D25}
AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
3M Printscape™ Software V2 (HKLM-x32\...\{37A6EFC2-FE90-47BF-B84F-DD652E698D04}) (Version:  - )
4500_G510af_Help (x32 Version: 000.0.439.000 - Hewlett-Packard) Hidden
4500G510af (x32 Version: 000.0.423.000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.267 - Adobe Systems Incorporated)
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.13) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.1.171 - Adobe Systems, Inc.)
Amazon Cloud Drive (HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Amazon Cloud Drive) (Version: 3.1.2.21 - Amazon.com, Inc.)
Amazon Kindle (HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Amazon Kindle) (Version:  - Amazon)
AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
AMD Catalyst Install Manager (HKLM\...\{66AFB595-BC05-2913-7696-6D58F9B733E1}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 4.0.0.0 - AppEx Networks)
American Greetings CreataCard Select 6 (HKLM-x32\...\{9770A25C-45A7-478E-AF50-4FDE53EED270}) (Version:  - )
Apple Application Support (32-bit) (HKLM-x32\...\{7FA9ECCF-A2DE-4DA1-BFF3-81260DBDA68F}) (Version: 4.1.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{691F30EB-9009-475A-B8A9-E1BF39598FD5}) (Version: 4.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
AVSDK5 (Version: 5.4.11 - CYREN Inc.) Hidden
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Belkin USB Wireless Adapter (HKLM-x32\...\InstallShield_{549CE1BD-88E4-4C5E-BF75-B155624714CC}) (Version: 1.0.0.13 - Belkin)
Belkin USB Wireless Adapter (x32 Version: 1.0.0.13 - Belkin) Hidden
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Canon MG3100 series On-screen Manual (HKLM-x32\...\Canon MG3100 series On-screen Manual) (Version:  - )
Citrix Online Launcher (HKLM-x32\...\{DB014C85-A264-4BCA-A66F-6DD1FCF8EC36}) (Version: 1.0.335 - Citrix)
Coupons at Checkout (HKLM-x32\...\{FA8DA51F-9DF3-4555-AA3C-788C70E4460F}) (Version: 1.3 - CouponFollow, LLC) <==== ATTENTION
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DocMgr (x32 Version: 130.0.000.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
f.lux (HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Flux) (Version:  - )
Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Earth Pro (HKLM-x32\...\{44FC61F0-2F8A-11E3-8CAE-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
GoToMeeting 7.8.1.4190 (HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\GoToMeeting) (Version: 7.8.1.4190 - CitrixOnline)
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hallmark Card Studio 2008 Deluxe (HKLM-x32\...\{747A6A10-DA58-48C2-A1F0-C15514419C8A}) (Version: 9.0.0.9 - Creative Home)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Document Manager 2.0 (HKLM\...\HP Document Manager) (Version: 2.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Officejet 4500 G510a-f (HKLM\...\{C98517B6-DCE9-49B7-B19E-E384178D3986}) (Version: 13.0 - HP)
HP Print Projects 1.0 (HKLM\...\HP Print Projects) (Version: 1.0 - HP)
HP Smart Web Printing 4.5 (HKLM\...\HP Smart Web Printing) (Version: 4.5 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Support Solutions Framework (HKLM-x32\...\{F6A11738-3EE4-4573-AEA5-6CD5D491C167}) (Version: 12.0.30.219 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
hpPrintProjects (x32 Version: 130.0.303.000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
hpWLPGInstaller (x32 Version: 130.0.303.000 - Hewlett-Packard) Hidden
iolo technologies' System Mechanic Professional (HKLM-x32\...\{BBD3F66B-1180-4785-B679-3F91572CD3B4}_is1) (Version: 14.5.2 - iolo technologies, LLC)
Itibiti RTC (x32 Version: 0.0.1 - Itibiti Inc) Hidden
iTunes (HKLM\...\{FBEB98F8-64E4-4FA3-A15E-4A9F42FF962E}) (Version: 12.3.2.35 - Apple Inc.)
Java 8 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218065F0}) (Version: 8.0.650.17 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1230 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 7.0.1230 - CyberLink Corp.) Hidden
LimeWire 4.18.8 (HKLM-x32\...\LimeWire) (Version: 4.18.8 - Lime Wire, LLC)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft .NET Framework 1.1 (HKLM-x32\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41105.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 43.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 43.0.1 (x86 en-US)) (Version: 43.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 43.0.1.5828 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
OpenOffice.org 3.2 (HKLM-x32\...\{981C4721-3715-4F4C-A6A4-CB89EE6D5C60}) (Version: 3.2.9505 - OpenOffice.org)
Perfect Scrapbook Maker Express (HKLM-x32\...\{4BDAD330-094B-440D-8563-64AD47F214C9}) (Version: 8.00.0000 - Cosmi Corporation)
Pricepirates 7 (HKLM-x32\...\{D746E113-378A-45A2-8EB0-DF00BD2454DE}) (Version: 7.0.0.0 - metaspinner net GmbH)
PrintMaster 12 (HKLM-x32\...\{2A304FDE-F4E3-446D-AA0D-31425C897B71}) (Version:  - Broderbund LLC)
PrintMaster Platinum 18 (HKLM-x32\...\{EBD9A954-6C1A-4E9F-A098-C98653035381}) (Version: 18.00.0000 - Broderbund Software)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Raptr (HKLM-x32\...\Raptr) (Version:  - )
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 1.12.0007 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7601.30131 - Realtek Semiconductor Corp.)
Reimage Express (HKLM\...\Reimage Express) (Version: 1.0.3.4 - Reimage)
Secunia PSI (3.0.0.11003) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.11003 - Secunia)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
SmartWebPrinting (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Speccy (HKLM\...\Speccy) (Version: 1.25 - Piriform)
Spotify (HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Spotify) (Version: 1.0.13.108.gcd94e7db - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Mechanic 12 Professional (x32 Version: 14.5.2 - ) Hidden
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.376.000 - Hewlett-Packard) Hidden
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-1673558610-3607175664-3325060128-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\SnickerSmom\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1673558610-3607175664-3325060128-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\SnickerSmom\AppData\Local\Citrix\GoToMeeting\3880\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {07B165CE-7667-4E82-B8EC-3D731B4E6501} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {08D30A33-6458-4144-BB37-2F62B0D11825} - System32\Tasks\{1D345937-C5D3-469B-A393-948D2BE9454E} => pcalua.exe -a C:\Users\SnickerSmom\AppData\Local\uninstall.exe
Task: {0A3A2FC8-8FC4-4380-B8D2-8AE5A420699A} - System32\Tasks\{EA62422D-F242-42EA-9D13-263C5EB74D5F} => pcalua.exe -a E:\chromeinstall-8u25.exe -d E:\
Task: {0CFE2E40-6A97-48C5-9F38-DE82315CF1B0} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {11E6720F-2A88-4187-97DE-51C47B443225} - System32\Tasks\ReimageUpdater => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [2015-08-19] (Reimage®) <==== ATTENTION
Task: {127311E4-F913-46F6-8032-B87F8D2B68F3} - System32\Tasks\{B614DC81-01A7-438F-A140-D5EA63BA7A9E} => Chrome.exe 
Task: {1B9D6070-79BD-4A05-B426-3BEFE4205550} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-11-23] (Microsoft Corporation)
Task: {23C45DD6-E926-4A21-BEBC-6FD40A2521C5} - System32\Tasks\LLEBFPLVGYGCIYPS => C:\ProgramData\Service0082\Service0082.exe <==== ATTENTION
Task: {278AC42D-32BD-4952-8E4D-A7D4A0D322F9} - \IBUpd2 -> No File <==== ATTENTION
Task: {2B597885-026E-44A1-8A0D-E7232676B8BF} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {2D619309-5741-4C93-9ED4-B9494830A693} - System32\Tasks\G2MUpdateTask-S-1-5-21-1673558610-3607175664-3325060128-1000 => C:\Users\SnickerSmom\AppData\Local\Citrix\GoToMeeting\4190\g2mupdate.exe [2015-12-30] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {2E60D4E5-69CF-41AA-8BAB-E4DCCDFB47CD} - System32\Tasks\iolo Process Governor => C:\Program Files (x86)\iolo\System Mechanic Professional\iologovernor64.exe [2015-04-28] (iolo technologies, LLC)
Task: {32A484FF-AD9C-4BAC-BAEA-05E70DA92BF2} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {336324E1-5127-49B9-807E-0084B89BA51B} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {366172E6-7755-4D64-9911-07E52C8669A8} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {38600BEA-1584-4C5D-9F3F-3D88A0AA4C03} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {3A0D5B14-C06B-4D06-9820-4BC4399D5100} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {3A624ECA-661A-4E4C-8F39-D690E9EE9BD7} - \RegClean Pro -> No File <==== ATTENTION
Task: {3EC31131-BD2A-4D7A-9F14-73F401955A0F} - \Seventh -> No File <==== ATTENTION
Task: {3F179529-82B8-4EDF-885C-2DFB8185BB44} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2015-11-04] (Hewlett-Packard)
Task: {42925DA3-E5A2-4B4B-A485-A3EDA2C94657} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {4D75B54E-0C3E-4A9A-AE06-1792CC69A98A} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {4F6CD5DB-99A5-48D8-AC0A-830D4BDF7C47} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe
Task: {4F9E7B1B-6EE9-4163-A7C2-361799C374D0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2015-09-28] (Hewlett-Packard)
Task: {5190010A-B076-4B16-B310-A46C6828CF14} - System32\Tasks\Ruvrei => C:\PROGRA~1\GROOVE~1\Tiunja.bat
Task: {53082A4E-2707-4D04-B6EB-C79ADF286FCB} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {549F94FB-1F06-4102-8662-58395D8563C2} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {5C94DC5C-A672-4647-9285-A7C13288D27A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {61091039-4A22-4855-B9A9-EF6F3E82F08C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {64E0CDA6-A6E5-4FED-8E96-F0E1F500E9F1} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {6A9E3564-1806-4413-9D23-E90C1B2707C1} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {6B404DBC-2C1E-495B-ABC5-B58CF0CF0389} - \SushiLeads -> No File <==== ATTENTION
Task: {6BEA0B1C-0D8D-4F4E-8876-A46913216569} - System32\Tasks\Uuuufkurlal => C:\ProgramData\Uuuufkurlal\1.0.7.1\aovsioua.exe
Task: {7194020D-0F80-4CFB-A466-8D30FFF72D53} - \WebDnsio2-daily -> No File <==== ATTENTION
Task: {71CEA010-4AF7-49FF-8FA2-5EF990428E3D} - \WebDnsio2 -> No File <==== ATTENTION
Task: {78E0D9FA-67A9-4F4E-B1E3-E2A5E9B4FAE5} - System32\Tasks\DriverNavigator Scheduled Scan => C:\Program Files\Easeware\DriverNavigator\DriverNavigator.exe
Task: {7D5A7930-CCF9-46A4-9D00-2A3789C8B42E} - System32\Tasks\{834E7941-53C1-4CA1-870B-097A60573E11} => Chrome.exe 
Task: {7DDDF413-69F8-44E1-BFB4-9FAAA19618E5} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2015-11-04] (Hewlett-Packard)
Task: {7F57B939-74A9-4A76-BC09-388CFB9583B0} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {806F6B99-21C4-4519-94D3-4946071130A3} - \SmartWeb Upgrade Trigger Task -> No File <==== ATTENTION
Task: {80CDD246-FCB4-4273-8BD7-1666A9976D54} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {81257C69-B61C-4D3D-8302-DD297DCA785E} - System32\Tasks\HPCeeScheduleForSnickerSmom => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
Task: {8147172C-C6EF-4FA2-8797-7A951A04DC79} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {82C554EB-D8C3-4E82-A162-F4E5B8F3D533} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {82D3E1B8-FB34-439E-8DE1-4A9C47802B4B} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {87388666-602F-45D9-B658-D6BC3BB621AB} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {87B2CFF4-9F95-4FAA-8008-A4FF72ADD5E3} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {896F3216-EE2E-45DD-A823-493651030D11} - System32\Tasks\LaunchApp => C:\Program Files (x86)\JustCloud\JustCloud.exe
Task: {89F2F6A9-0B75-4F11-ACB9-561C26069E67} - System32\Tasks\{07A71F26-C973-41B9-ACBA-CD5C2F1B3404} => Chrome.exe 
Task: {8AE95769-4FDC-4859-A23D-9F4E250D555C} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {8C65D826-7E3B-433B-B9C9-3A58A924CD9E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2015-09-28] (Hewlett-Packard Company)
Task: {8EEC2356-ECEB-457B-B8D2-C5C50E24AB18} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {8F3A4615-4BE1-4CD8-BD75-24AD6D052D07} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {92D97B5A-0472-46BB-B0AA-266E969A4A28} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {932A7674-43B7-4C1C-ACAF-91790415ABF8} - System32\Tasks\Xmas2 => Rundll32.exe "C:\Users\SnickerSmom\AppData\Local\Xmas\{69C3D92C-DD79-C68C-6EBD-AEB59FAC3E3B}\ygargu.dll",#1 <==== ATTENTION
Task: {93AC23FC-3282-433C-8769-631B1CA77437} - System32\Tasks\{360E44B8-1BE6-4A6E-8920-4B5BB57DD263} => D:\PopCDRun.exe
Task: {95A41215-D25B-4C92-BD07-FA02136889E7} - System32\Tasks\Genius_Interval => C:\Users\SnickerSmom\AppData\Roaming\Genius\Genius.exe
Task: {98F64DB2-6B5D-420F-BE5C-F612212A6D9B} - System32\Tasks\ParetoLogic Update Version3 Startup Task => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2014-11-20] ()
Task: {9D6E8FB5-5BEC-4F1E-B8A4-73D9CC2FE40A} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {A444BE2E-7110-4EBC-A272-2E0C10617EBF} - \Xmas -> No File <==== ATTENTION
Task: {A49BDC62-C1D3-4CD4-A3F5-1345D267B447} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {B1331262-D4BE-4DE5-AF8A-0D534C4E5C08} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {B1CB4BB2-B42B-43FA-AA56-B674DE7F1B83} - \Easy Driver Pro Schedule -> No File <==== ATTENTION
Task: {B627DF80-7BE8-4EF7-98AE-DF49A432A232} - System32\Tasks\{66D277A3-226C-43CC-84B4-5836929EF8B4} => pcalua.exe -a C:\Drivers\ID4ETN15WW5.exe -d C:\Drivers
Task: {B82401F9-18C9-42C0-BDFB-5FE85FCC586F} - System32\Tasks\{8E1DE555-30B0-4A89-901F-B56D67EAE9DE} => Chrome.exe 
Task: {B9638FC1-2C5A-4C61-8B6D-7CDBAFC503DE} - System32\Tasks\{2C3BC256-B9A6-4BCC-AED2-072EC894F8E5} => Chrome.exe 
Task: {BB127772-5214-40CE-A5C1-238898AB49F7} - System32\Tasks\iolo DelOnReboot => /c IF EXIST C:\ProgramData\iolo\ops\smrr.dll del /f C:\ProgramData\iolo\ops\smrr.dll
Task: {BC5DD265-BB0D-44E0-B331-878398060CE3} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {BF65627E-970A-4020-958D-E937F8DAFCF5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-12-28] (Adobe Systems Incorporated)
Task: {C21465DF-7081-4DAB-AA3C-02B4E93AEFCD} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {C342FE79-A55E-484B-A6F8-0B7B99C84FB3} - System32\Tasks\G2MUploadTask-S-1-5-21-1673558610-3607175664-3325060128-1000 => C:\Users\SnickerSmom\AppData\Local\Citrix\GoToMeeting\4190\g2mupload.exe [2015-12-30] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {C3D378AC-CF71-424E-9651-9F54C1304C11} - System32\Tasks\ParetoLogic Registration3 => Rundll32.exe "C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll" RunUns
Task: {C3DAA717-1D8B-44DD-9DF3-0484304EE1F1} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {CC6BC9B8-0F7F-4BF6-847C-1410D7E7F4E3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {D34AEF9D-FE16-483B-BE41-8D038790EDA5} - System32\Tasks\{2B7D6153-B3F2-48E9-87B4-30096CE1503E} => Chrome.exe 
Task: {D43144BC-721A-4186-8F33-519754E2B9C9} - System32\Tasks\ParetoLogic Update Version3 => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2014-11-20] ()
Task: {D8B1DC6C-7A0D-45A5-9F16-120EB7CF3404} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {DCFF155B-5845-4DCD-9793-8DF478BB54C7} - System32\Tasks\DRCGENIZ1 => C:\ProgramData\LolyKey\LolyKey.exe <==== ATTENTION
Task: {DD7A1A04-97C1-4602-8C2F-06CEB87F855E} - \CCleanerSkipUAC -> No File <==== ATTENTION
Task: {DEF5D657-0F78-4C2D-A649-7AA5CD74C5DE} - System32\Tasks\{F008FC30-5CB9-42F5-A751-6CAD5C8B651B} => pcalua.exe -a C:\Users\SnickerSmom\Downloads\IN1OKR06WW1.exe -d C:\Users\SnickerSmom\Downloads
Task: {E35196DD-F101-4BC7-BC42-48CA40503107} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {E3FDAD9D-9124-4245-8B39-C5D95E2CEB37} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {E4637E45-8EF2-4073-8D4B-8C6B097B6865} - System32\Tasks\Genius => C:\Users\SnickerSmom\AppData\Roaming\Genius\Genius.exe <==== ATTENTION
Task: {E69F70F5-6D1E-4D43-AD83-AE5E7069D5CB} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {E76AE5F0-5B67-4114-B9A7-0736A87611BD} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {E81402C7-394C-4CA0-805E-AA082CE3A857} - \Sixth -> No File <==== ATTENTION
Task: {E8479942-B5D6-41BF-926E-79B0A2819801} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {EF9B6C40-BDDC-4340-B8F4-31C3B026CD15} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {F81E5D7D-EAD2-417D-85D4-39AA53C1DBA3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2015-09-28] (Hewlett-Packard Company)
Task: {FAF7193E-9B13-48C1-8328-38A1E21BCC0A} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DRCGENIZ1.job => C:\ProgramData\LolyKey\LolyKey.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\DriverNavigator Scheduled Scan.job => C:\Program Files\Easeware\DriverNavigator\DriverNavigator.exe
Task: C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-1673558610-3607175664-3325060128-1000.job => C:\Users\SnickerSmom\AppData\Local\Citrix\GoToMeeting\4190\g2mupdate.exe
Task: C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-1673558610-3607175664-3325060128-1000.job => C:\Users\SnickerSmom\AppData\Local\Citrix\GoToMeeting\4190\g2mupload.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForSnickerSmom.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\WINDOWS\Tasks\LLEBFPLVGYGCIYPS.job => C:\ProgramData\Service0082\Service0082.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\ParetoLogic Registration3.job => C:\WINDOWS\system32\rundll32.exeGC:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll
Task: C:\WINDOWS\Tasks\ParetoLogic Update Version3 Startup Task.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe
Task: C:\WINDOWS\Tasks\ParetoLogic Update Version3.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
ShortcutWithArgument: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www%2dsearching.com/?prd=set_epc&s=G11ztutbl10,8e21de1e-6e8f-437b-89e5-253d36a26491,
ShortcutWithArgument: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> "microsoft-edge:hxxp://www%2dsearching.com/?prd=set_epc&s=G11ztutbl10,8e21de1e-6e8f-437b-89e5-253d36a26491,"
ShortcutWithArgument: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www-searching.com/?prd=set_epc&s=G11ztutbl10,8e21de1e-6e8f-437b-89e5-253d36a26491,
ShortcutWithArgument: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www%2dsearching.com/?prd=set_epc&s=G11ztutbl10,8e21de1e-6e8f-437b-89e5-253d36a26491,
ShortcutWithArgument: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www%2dsearching.com/?prd=set_epc&s=G11ztutbl10,8e21de1e-6e8f-437b-89e5-253d36a26491,
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www-searching.com/?prd=set_epc&s=G11ztutbl10,8e21de1e-6e8f-437b-89e5-253d36a26491,
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www%2dsearching.com/?prd=set_epc&s=G11ztutbl10,8e21de1e-6e8f-437b-89e5-253d36a26491,
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-10-30 00:18 - 2015-10-30 00:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2015-08-21 22:09 - 2015-08-21 22:09 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 00817152 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 03650560 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2015-08-21 22:09 - 2015-08-21 22:09 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2015-02-13 03:20 - 2015-02-13 03:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-08-19 01:56 - 2015-08-19 01:56 - 06908904 _____ () C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 02653816 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02653816 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-10-30 00:17 - 2015-10-30 00:17 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2015-10-30 00:17 - 2015-10-30 00:17 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 08005632 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00936448 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-08-21 22:09 - 2015-08-21 22:09 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2016-01-03 13:01 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-01-03 13:01 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-01-03 13:01 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-11-18 17:57 - 2015-11-18 17:57 - 00676672 _____ () C:\Users\SnickerSmom\AppData\Local\Amazon Cloud Drive\sqlite3.dll
2015-12-16 12:16 - 2015-12-10 20:54 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libglesv2.dll
2015-12-16 12:16 - 2015-12-10 20:54 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libegl.dll
2010-11-22 15:56 - 2010-11-22 15:56 - 00087040 _____ () C:\Program Files (x86)\Raptr\_ctypes.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00043008 _____ () C:\Program Files (x86)\Raptr\_socket.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00805376 _____ () C:\Program Files (x86)\Raptr\_ssl.pyd
2014-05-13 16:26 - 2014-05-13 16:26 - 05812736 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtGui.pyd
2014-05-13 16:26 - 2014-05-13 16:26 - 00067584 _____ () C:\Program Files (x86)\Raptr\sip.pyd
2014-05-13 16:26 - 2014-05-13 16:26 - 01662464 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtCore.pyd
2014-05-13 16:26 - 2014-05-13 16:26 - 00494592 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtNetwork.pyd
2010-11-22 15:57 - 2010-11-22 15:57 - 00096256 _____ () C:\Program Files (x86)\Raptr\win32api.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00110592 _____ () C:\Program Files (x86)\Raptr\pywintypes26.dll
2010-11-22 15:56 - 2010-11-22 15:56 - 00010240 _____ () C:\Program Files (x86)\Raptr\select.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00356864 _____ () C:\Program Files (x86)\Raptr\_hashlib.pyd
2010-11-22 15:57 - 2010-11-22 15:57 - 00036352 _____ () C:\Program Files (x86)\Raptr\win32process.pyd
2010-11-22 15:57 - 2010-11-22 15:57 - 00111104 _____ () C:\Program Files (x86)\Raptr\win32file.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00044544 _____ () C:\Program Files (x86)\Raptr\_sqlite3.pyd
2011-02-15 11:17 - 2011-02-15 11:17 - 00417501 _____ () C:\Program Files (x86)\Raptr\sqlite3.dll
2010-11-22 15:57 - 2010-11-22 15:57 - 00167936 _____ () C:\Program Files (x86)\Raptr\win32gui.pyd
2014-05-13 16:26 - 2014-05-13 16:26 - 00313856 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtWebKit.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00127488 _____ () C:\Program Files (x86)\Raptr\pyexpat.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00009216 _____ () C:\Program Files (x86)\Raptr\winsound.pyd
2015-10-21 13:29 - 2015-10-21 13:29 - 00113171 _____ () C:\Program Files (x86)\Raptr\libvlc.dll
2015-10-21 13:29 - 2015-10-21 13:29 - 02396691 _____ () C:\Program Files (x86)\Raptr\libvlccore.dll
2010-11-22 15:56 - 2010-11-22 15:56 - 00583680 _____ () C:\Program Files (x86)\Raptr\unicodedata.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00354304 _____ () C:\Program Files (x86)\Raptr\pythoncom26.dll
2010-11-22 15:57 - 2010-11-22 15:57 - 00263168 _____ () C:\Program Files (x86)\Raptr\win32com.shell.shell.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00324608 _____ () C:\Program Files (x86)\Raptr\PIL._imaging.pyd
2015-06-26 16:09 - 2015-06-26 16:09 - 00271872 _____ () C:\Program Files (x86)\Raptr\amd_ags.dll
2010-11-22 15:57 - 2010-11-22 15:57 - 00024064 _____ () C:\Program Files (x86)\Raptr\win32pipe.pyd
2010-11-22 15:57 - 2010-11-22 15:57 - 00141312 _____ () C:\Program Files (x86)\Raptr\gobject._gobject.pyd
2014-06-17 17:56 - 2014-06-17 17:56 - 02717595 _____ () C:\Program Files (x86)\Raptr\heliotrope._purple.pyd
2011-02-15 11:17 - 2011-02-15 11:17 - 01213633 _____ () C:\Program Files (x86)\Raptr\libxml2-2.dll
2010-11-22 16:06 - 2010-11-22 16:06 - 00055808 _____ () C:\Program Files (x86)\Raptr\zlib1.dll
2013-05-09 16:52 - 2013-05-09 16:52 - 00495680 _____ () C:\Program Files (x86)\Raptr\plugins\libaim.dll
2013-05-09 16:52 - 2013-05-09 16:52 - 01183699 _____ () C:\Program Files (x86)\Raptr\liboscar.dll
2013-05-09 16:52 - 2013-05-09 16:52 - 00483306 _____ () C:\Program Files (x86)\Raptr\plugins\libicq.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 00655356 _____ () C:\Program Files (x86)\Raptr\plugins\libirc.dll
2013-05-03 11:56 - 2013-05-03 11:56 - 01306387 _____ () C:\Program Files (x86)\Raptr\plugins\libmsn.dll
2013-05-03 11:56 - 2013-05-03 11:56 - 00565461 _____ () C:\Program Files (x86)\Raptr\plugins\libxmpp.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 01640221 _____ () C:\Program Files (x86)\Raptr\libjabber.dll
2013-05-03 11:56 - 2013-05-03 11:56 - 00506276 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoo.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 01053730 _____ () C:\Program Files (x86)\Raptr\libymsg.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 00497782 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoojp.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 00603326 _____ () C:\Program Files (x86)\Raptr\plugins\ssl-nss.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 00474199 _____ () C:\Program Files (x86)\Raptr\plugins\ssl.dll
2015-12-24 11:56 - 2015-12-24 07:46 - 16792256 _____ () C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\PepperFlash\20.0.0.267\pepflashplayer.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdfhgdf.sys:{328cea35-afe0-11e5-9bcf-8c89a575c07d}
AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdfhgdf.sys:{328cea36-afe0-11e5-9bcf-8c89a575c07d}
AlternateDataStreams: C:\ProgramData\Temp:B34A7CD6
AlternateDataStreams: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Windows\Start Menu\MSN.com.website:TASKICON_0favicon1129903636
AlternateDataStreams: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Windows\Start Menu\MSN.com.website:TASKICON_1favicon-298702541
AlternateDataStreams: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Windows\Start Menu\MSN.com.website:TASKICON_2favicon-1464078272
AlternateDataStreams: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Windows\Start Menu\MSN.com.website:TASKICON_3favicon-860043155
AlternateDataStreams: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Windows\Start Menu\MSN.com.website:TASKICON_4favicon640180837
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\webcompanion.com -> hxxp://webcompanion.com
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 19:34 - 2015-12-31 19:11 - 00000728 ____N C:\WINDOWS\system32\Drivers\etc\hosts
 
127.0.0.1       localhost127.0.0.1       down.baidu2016.com
127.0.0.1       123.sogou.com
127.0.0.1       www.czzsyzgm.com
127.0.0.1       www.czzsyzxl.com
127.0.0.1       down.baidu2016.com
127.0.0.1       123.sogou.com
127.0.0.1       www.czzsyzgm.com
127.0.0.1       www.czzsyzxl.com
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\SnickerSmom\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\sam_0722.jpg
DNS Servers: 69.144.127.53 - 71.10.216.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Planner Reminder 2008.lnk => C:\Windows\pss\Event Planner Reminder 2008.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Forget Me Not.lnk => C:\Windows\pss\Forget Me Not.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^SnickerSmom^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Webshots Wallpaper & Screensaver.lnk => C:\Windows\pss\Webshots Wallpaper & Screensaver.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Raptr => C:\PROGRA~2\Raptr\RAPTRS~1.EXE --startup
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKLM\...\StartupApproved\StartupFolder: => "AllPCoptimizer.exe.lnk"
HKLM\...\StartupApproved\Run: => "SpaceSoundPro"
HKLM\...\StartupApproved\Run32: => "gmsd_us_005010193"
HKLM\...\StartupApproved\Run32: => "msrtn32"
HKLM\...\StartupApproved\Run32: => "SmartWeb"
HKLM\...\StartupApproved\Run32: => "Update Pro"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\StartupFolder: => "SmartWeb.lnk"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "ezwfea"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "SushiLeadsApplication"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "PCSpeedUp"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "ssn"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "Windi"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "Update Pro"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{59B56D79-CD04-49A4-BE47-DB9B59D3BC8F}] => (Allow) C:\WINDOWS\system32\rundll32.exe
FirewallRules: [{BF999CBE-AE8E-4640-B997-00507EE92CA5}] => (Allow) 㩃啜敳獲卜楮正牥浓浯䅜灰慄慴剜慯業杮獜湳獜癡略⹰硥e
FirewallRules: [{8223EE8E-C6B2-41F9-B609-07C072147660}] => (Allow) 㩃啜敳獲卜楮正牥浓浯䅜灰慄慴剜慯業杮獜湳獜湳攮數
FirewallRules: [{82242D99-2EDF-474F-9875-4D6A41C6A9AF}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩潨瑳獵履楷桮獯畴敳⹟硥e
FirewallRules: [{AEEED65E-DED2-46F8-9F96-11FAE5BD6DF8}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩潨瑳獵履楷桮獯畴敳攮數
FirewallRules: [UDP Query User{ECF3313D-2573-4DA4-AD28-88D63B3523CA}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [TCP Query User{BE8DD4B2-4E85-4F30-9A26-9536AF337132}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [{ABC0C26C-6C89-4469-9A4D-E36A1A3F1009}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{1B9961BD-A982-4C00-BE52-B480506BA38F}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{0FF89689-BFA2-42C8-92C0-69AB176D8BE2}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{3E0AEE84-CE46-4071-8627-97647CEAAA66}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{4B769071-827D-47BA-AB57-26336811825A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{66A5BA51-6FF7-4B54-9983-D883C19BAA59}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{C9C1A9AD-176E-4004-9383-52DF216D0E48}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{24D58498-79EA-48FE-AE67-A50B755AAE60}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{24E42D0F-5FF1-4335-BFED-84CB926F46E2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E3DBE7B3-E668-43B5-94BC-BEE1A979DF95}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{B9E8F23F-BDF0-4E5F-BC26-29EA36739CC5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{782D9A82-996D-4FBA-9575-FA9640ED9127}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EA301A53-6E60-4C9C-A7D6-2F573EEAE496}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A474D4E3-56AB-4EA1-B0E3-7AFD9B55F935}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{43304378-87ED-4601-8C9E-E715006D70A0}] => (Allow) C:\Program Files (x86)\iolo\System Mechanic Professional\SysMech.exe
FirewallRules: [{08628AFF-EBF0-4BBA-BA4D-62D489E15AC6}] => (Allow) C:\Program Files (x86)\iolo\System Mechanic Professional\SysMech.exe
FirewallRules: [TCP Query User{6C421354-E8A4-41C7-A49C-79C9E58F1383}C:\users\snickersmom\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\snickersmom\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{8F176C89-73E4-4D01-9B0C-A411543D911F}C:\users\snickersmom\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\snickersmom\appdata\roaming\spotify\spotify.exe
FirewallRules: [{018B1779-4AC4-47DB-B5ED-4251BD564053}] => (Allow) C:\Users\SnickerSmom\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{B1FA5D57-A4ED-4651-9F59-063E0EF57143}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{AE9CF740-C537-4265-BD20-C4FC3555817D}] => (Allow) LPort=2869
FirewallRules: [{790BD8FE-6615-49BD-8E04-AD27CEDB164C}] => (Allow) LPort=1900
FirewallRules: [{FBB9E6C6-7519-4782-9312-19735AA08E1B}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{4F3BB0BA-CD6A-43D3-A4E0-B7E3F54D1E24}] => (Allow) C:\Program Files (x86)\LimeWire\LimeWire.exe
FirewallRules: [{9CF61B4A-2F94-4C43-B903-02B4C317131D}] => (Allow) C:\Program Files (x86)\LimeWire\LimeWire.exe
FirewallRules: [{E6040A49-0153-46AB-981E-D97A09793CDE}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
FirewallRules: [{6B449717-0096-4FFE-8965-1C15E202CDA4}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
FirewallRules: [{CA4E2C31-5A14-40A6-9266-7C93C3CF2100}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxm08.exe
FirewallRules: [{08CE735E-6C6B-48C1-997C-EAA307CF825B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposfx08.exe
FirewallRules: [{97D5060D-3764-42F4-BA8F-B4F85F823B8E}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
FirewallRules: [{6C8B2940-FA39-4E5A-864E-447E8210A2CE}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{3E0043B6-A014-4304-9BCC-C394329F648A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{321A6FF2-923C-447F-A7D4-4EE184E09C34}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpzwiz01.exe
FirewallRules: [{69D15292-D88E-4541-8DB6-38D543EEC49D}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
FirewallRules: [{318259B5-95C5-4452-8527-98DAC2230E82}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{930CD880-96CC-4077-89B9-07F133337E6B}] => (Allow) C:\Program Files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{2718D40D-315A-4DA5-B016-FC848BF93855}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxs08.exe
FirewallRules: [{8A17D646-F3FD-4745-A260-DD1A43D3D1D0}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqfxt08.exe
FirewallRules: [{12CC753B-9E26-4D02-942C-F031C8F3ABC4}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{48B806D1-249D-43AD-9B48-EC56F5CA1921}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{2BD28BD6-BA63-46C5-B73B-E8D9D201C27B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe
FirewallRules: [{43DB0EB0-B7B5-496A-9855-2769D2A28C14}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe
FirewallRules: [{B9BAAC3F-39BE-47CE-9875-630927065E43}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{94D96EB3-BE19-43BE-9FEE-D5C9B6BA9C92}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe
FirewallRules: [TCP Query User{56D004BD-DEE0-41AD-92EF-A9913B30E691}C:\users\snickersmom\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\snickersmom\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{7D1B1C3D-7799-4EA8-B8B5-897217FDF5CE}C:\users\snickersmom\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\snickersmom\appdata\roaming\spotify\spotify.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
 
==================== Restore Points =========================
 
05-01-2016 18:19:34 Windows Update
06-01-2016 15:56:07 Reimage Express Restore Point
08-01-2016 04:48:55 Windows Modules Installer
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (01/08/2016 08:44:58 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/08/2016 08:44:54 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/08/2016 08:44:00 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/08/2016 08:37:37 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/08/2016 08:31:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/08/2016 08:29:54 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/08/2016 08:24:19 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/08/2016 08:23:00 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/08/2016 08:22:37 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/08/2016 08:14:54 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
 
System errors:
=============
Error: (01/08/2016 06:29:10 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/07/2016 06:58:41 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/06/2016 04:59:59 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/06/2016 04:57:59 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/06/2016 04:55:59 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/06/2016 04:54:00 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/06/2016 04:53:59 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/06/2016 04:53:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The SDScannerService service failed to start due to the following error: 
%%1053
 
Error: (01/06/2016 04:53:21 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the SDScannerService service to connect.
 
Error: (01/06/2016 04:53:06 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error: 
%%1058
 
 
CodeIntegrity:
===================================
  Date: 2016-01-08 16:49:30.905
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-05 23:22:49.197
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-05 22:46:45.593
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-01 04:30:05.168
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-01 04:26:31.616
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-01 03:59:56.320
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: AMD A6-3600 APU with Radeon™ HD Graphics
Percentage of memory in use: 62%
Total physical RAM: 5625.98 MB
Available physical RAM: 2105.61 MB
Total Virtual: 11257.98 MB
Available Virtual: 5168.39 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:440.15 GB) (Free:359.66 GB) NTFS
Drive e: () (Removable) (Total:14.9 GB) (Free:14.48 GB) FAT32
Drive f: () (Removable) (Total:3.76 GB) (Free:3.66 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 6F471639)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=440.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
Partition 4: (Not Active) - (Size=25.1 GB) - (Type=12)
 
========================================================
Disk: 1 (Size: 3.8 GB) (Disk ID: 04DD5721)
Partition 1: (Not Active) - (Size=3.8 GB) - (Type=0C)
 
========================================================
Disk: 2 (Size: 14.9 GB) (Disk ID: 6F20736B)
No partition Table on disk 2.
Disk 2 is a removable device.
 
==================== End of Addition.txt ============================


#6 loki2007

loki2007

  • Members
  • 551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Hampshire
  • Local time:02:50 PM

Posted 13 January 2016 - 07:32 PM

Hi again SnickerSmom! Sorry for the delay. I am still here with you. Your FRST logs have a lot going on. I want to make sure I address everything for you. Also I am still in training so all my fixes need approval. I should have a plan soon, probably by tomorrow. Just a few ground rules before we start to keep in mind:

 

  • Please do not run any other scans or tools or install any new programs while I am helping you, as doing so might confuse me and slow down the cleaning process while I'm trying to help fix your computer.
  • Please backup all important files that cannot be replaced if possible. Fixes sometimes do not go as planned and losing important files can be a painful experience.
  • If I do not respond to your post within 48 hours please send me a PM.

Before we start I was wondering if you were familar with these things:
 
Did you set/want www.goodsearch.com as your homepage on your browsers?

 

Are you familiar with Pricepirates7?

 

Also are you familiar or do you use CouponFollow?

 

Finally I see you are running so called PCBooster/Tune-up software such as System Mechanic and Reimage among other programs. Please see the post below on why BleepingComputer does not recommend such programs.

 

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/?hl=+tune#8208up=

 

Did you pay for System Mechanic?

 

Again thanks for your patience,

 

loki


 
Member of the Bleeping Computer A.I.I. early response team!

#7 SnickerSmom

SnickerSmom
  • Topic Starter

  • Members
  • 56 posts
  • OFFLINE
  •  
  • Local time:12:50 PM

Posted 13 January 2016 - 09:48 PM

Hi loki,

Yes there is a lot of stuff on this computer. I didn't realize there was so much until I was looking at the scan. I have has this computer for a couple of years and just upgraded to windows 10 this summer. 

I have not run any scans but Malwarebytes keeps popping up frequenly which is a little annoying, but I just close it. It didn't do that until I updated it when I ran it when this first happened. I have used Malwarebytes for years. The Reimage is on there is because I read that might help before I came to bleeping computer. The only things I had on here before this happened was System Mechanic (yes, I paid for it) and Malwarebytes. When the subscription for it runs out, I was planning on going back to one of the free ones. 

I did set goodsearch as my homepage and no, I am not familiar with Pricepirates7. I noticed it was there though when I first went in the control panel to remove www.searching.com, Then I updated and ran Malwarebytes, Rkill, and ran System Mechanic. Then I tried running a couple of other malware removal tools but nothing worked. Then I went to this website and followed the tutorial for removing it that was under virus removal. When that didn't work I posted in the forum to try to find someone who could help me, and here we are. You probably didn't need that much information, but maybe it will help. 

Thanks, 

SnickerSmom



#8 loki2007

loki2007

  • Members
  • 551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Hampshire
  • Local time:02:50 PM

Posted 14 January 2016 - 10:45 AM

Hi there, thanks for the info :thumbup2:  It all helps! I wanted to inform you that your version of Chrome has been modified and needs to be removed but we will reinstall a clean version later in our fix. Please follow my instructions below in order and report back with any questions or issues if you have any.
 
Step 1:
 
Uninstalling a Program using Add/Remove Program

--------------------

I would recommend that you uninstall the program(s) listed below.

  • Press the Windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type appwiz.cpl and press Enter
  • A list of installed programs will be displayed
  • Uninstall the following by clicking on the program(s) below (and any other similar names) and selecting Remove or Uninstall

  • Coupons at Checkout

    Google Chrome

    Limewire

    Pricepirates 7
    Reimage Express

    Spybot
     

  • Reboot your computer

Please report back if any of these programs would not uninstall.
 
 
Step 2:
 
zcMPezJ.pngAdwCleaner

 

Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator
  • The tool will start to update the database, please wait a bit.
  • Click on I agree button.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished...
  • Click on the Cleaning button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[C#].txt) will open automatically (where the largest value of # represents the most recent report).
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.

 

 

Step 3:

 

I need you to go to https://www.virustotal.com/ and click Choose File and navigate to the directory of the file(s) below, once the file has been selected please click on the Scan it! button, if a new window opens and informs you the file has already been analysed click reanalyse otherwise the file will be automatically uploaded to check if the file is malicious, please copy and paste the URL for each file scan result into your next reply:

 

C:\WINDOWS\Update Pro\Update Pro\Update Pro.exe

 

 

Step 4:

 

Please do another scan with FRST (be sure to select the Addition box under Optional Scan) and copy and paste both FRST.txt and Addition.txt to your next reply.

 

 

So just so you know, this is the start of our fix and there will be plenty for us to do after you finish these first steps. Please don't forgot to copy and paste the results from each scan. As always if you have any issues or questions please don't hesitate to reply back to this thread. Finally, how is your computer running after performing the steps above? Are you still having the same issues or has anything changed? Thanks,

 

loki


 
Member of the Bleeping Computer A.I.I. early response team!

#9 SnickerSmom

SnickerSmom
  • Topic Starter

  • Members
  • 56 posts
  • OFFLINE
  •  
  • Local time:12:50 PM

Posted 15 January 2016 - 12:54 AM

Hi Loki,

Everything is uninstalled except chrome. A window keeps popping up that says. "Please close all google chrome windows and try again". There weren't any chrome windows open. I rebooted and it still says the same thing. Also when I rebooted, spybot wanted to reinstall, but I closed it and did not let it reinstall.

I have AdwCleaner already so do I need to download a new copy?

SnickerSmom



#10 loki2007

loki2007

  • Members
  • 551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Hampshire
  • Local time:02:50 PM

Posted 15 January 2016 - 12:39 PM

Hi there,

 

Just to be safe, please download AdwCleaner again from the link provided. We will work on the removal of Chrome and the Spybot issue with a script after you complete the steps in order in this post.

 

Step 1:
 
zcMPezJ.pngAdwCleaner

 

Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8/10 users right-click and select Run As Administrator
  • The tool will start to update the database, please wait a bit.
  • Click on I agree button.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished...
  • Click on the Cleaning button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[C#].txt) will open automatically (where the largest value of # represents the most recent report).
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.

 

 

Step 2:

 

I need you to go to https://www.virustotal.com/ and click Choose File and navigate to the directory of the file(s) below, once the file has been selected please click on the Scan it! button, if a new window opens and informs you the file has already been analysed click reanalyse otherwise the file will be automatically uploaded to check if the file is malicious, please copy and paste the URL for each file scan result into your next reply:

 

C:\WINDOWS\Update Pro\Update Pro\Update Pro.exe

 

 

Step 3:

 

Please do another scan with FRST (be sure to select the Addition box under Optional Scan) and copy and paste both FRST.txt and Addition.txt to your next reply.

 

 

Please don't forgot to copy and paste the results from each scan. As always if you have any issues or questions please don't hesitate to reply back to this thread. Finally, how is your computer running after performing the steps above? Are you still having the same issues or has anything changed? Thanks,

 

loki


 
Member of the Bleeping Computer A.I.I. early response team!

#11 SnickerSmom

SnickerSmom
  • Topic Starter

  • Members
  • 56 posts
  • OFFLINE
  •  
  • Local time:12:50 PM

Posted 15 January 2016 - 04:40 PM

Here is the result from the AdwCleaner scan:

 

# AdwCleaner v5.029 - Logfile created 15/01/2016 at 11:23:53
# Updated 11/01/2016 by Xplode
# Database : 2016-01-14.1 [Server]
# Operating system : Windows 10 Home  (x64)
# Username : SnickerSmom - SNICKERSMOM-PC
# Running from : C:\Users\SnickerSmom\Downloads\AdwCleaner.exe
# Option : Cleaning
 
***** [ Services ] *****
 
[-] Service Deleted : ReimageRealTimeProtector
 
***** [ Folders ] *****
 
[-] Folder Deleted : C:\Program Files (x86)\ExploreTech
[#] Folder Deleted : C:\WINDOWS\SysNative\Tasks\Genius
 
***** [ Files ] *****
 
[-] File Deleted : C:\WINDOWS\SysNative\drivers\sdfhgdf.sys
 
***** [ DLLs ] *****
 
 
***** [ Shortcuts ] *****
 
[-] Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
[-] Shortcut Disinfected : C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
[-] Shortcut Disinfected : C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk
[-] Shortcut Disinfected : C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
[-] Shortcut Disinfected : C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk
[-] Shortcut Disinfected : C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Google Chrome.lnk
 
***** [ Scheduled tasks ] *****
 
[-] Task Deleted : LaunchApp
[-] Task Deleted : paretologic registration3
[-] Task Deleted : paretologic update version3
[-] Task Deleted : ReimageUpdater
[-] Task Deleted : ParetoLogic Update Version3 Startup Task
[-] Task Deleted : Genius
[-] Task Deleted : Genius_Interval
[-] Task Deleted : DriverNavigator Scheduled Scan
[-] Task Deleted : LLEBFPLVGYGCIYPS
 
***** [ Registry ] *****
 
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
[-] Key Deleted : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine
[-] Key Deleted : HKLM\SOFTWARE\Classes\uus3url-pl
[-] Value Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Update Pro]
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{F8A4FC32-DDA3-4DD9-8C62-49F778FF630B}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{79F768ED-0B12-42EF-8257-36751A0ECF3A}]
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{09CFDB88-F9F0-40BA-885E-F47A957D12E6}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{2B1B440F-A9DB-46E3-ADCF-AA6E08143FB8}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
[-] Key Deleted : HKCU\Software\Bitberry Software
[-] Key Deleted : HKCU\Software\eSupport.com
[-] Key Deleted : HKCU\Software\NpApp
[-] Key Deleted : HKCU\Software\ParetoLogic
[-] Key Deleted : HKCU\Software\Reimage
[-] Key Deleted : HKCU\Software\MyTurboPC.com
[-] Key Deleted : HKCU\Software\SlimWare Utilities Inc
[-] Key Deleted : HKCU\Software\DAILYPCCLEAN
[-] Key Deleted : HKCU\Software\WEBAPP
[-] Key Deleted : HKCU\Software\tstamptoken
[-] Key Deleted : HKCU\Software\Microsoft\Tinstalls
[-] Key Deleted : HKLM\SOFTWARE\ParetoLogic
[-] Key Deleted : HKLM\SOFTWARE\Tarma Installer
[-] Key Deleted : HKLM\SOFTWARE\Trymedia Systems
[-] Key Deleted : HKLM\SOFTWARE\MyTurboPC.com
[-] Key Deleted : HKLM\SOFTWARE\SlimWare Utilities Inc
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JustCloud
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SU
[-] Key Deleted : [x64] HKLM\SOFTWARE\Reimage
[-] Key Deleted : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\us.yhs4.search.yahoo.com
[-] Key Deleted : HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\us.yhs4.search.yahoo.com
 
***** [ Web browsers ] *****
 
[-] [C:\Users\SnickerSmom\AppData\Local\Comodo\Chromodo\User Data\Default\Secure Preferences] [Extension] Deleted : aaaaahlfahldnilidgnlikdckbfehhca
[-] [C:\Users\SnickerSmom\AppData\Local\Comodo\Chromodo\User Data\Default\Secure Preferences] [Extension] Deleted : edfhabmbbhdcdpnoilchepfojmdeannd
 
*************************
 
:: "Tracing" keys removed
:: Winsock settings cleared
 
*************************
 
When I go to VirusTotal and search for  C:\WINDOWS\Update Pro\Update Pro\Update Pro.exethere is no file like that. It says it does not exist.


#12 loki2007

loki2007

  • Members
  • 551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Hampshire
  • Local time:02:50 PM

Posted 16 January 2016 - 08:31 AM

Looks like AdwCleaner cleaned some bad stuff! :thumbup2:
 
We can try to upload that file another way. Please follow the steps below in order and report back with any questions or issues.
 
Step 1:
 
======Zoek.exe======
 
Take action to disable your antivirus and antispyware programs, as they may conflict with Zoek.exe 
 
>> Info on how to disable your security applications > http://www.bleepingcomputer.com/forums/topic114351.html
 
Download 51a612a8b27e2-Zoek.pngzoek.exe to your desktop

  • If Internet Explorer, any other browser, or a security program issues a warning indicating the file is unsafe, please ignore, since it is a false warning.

Using Zoek.exe

  • On the Desktop, double-click Zoek.exe to start the tool.
    Windows 10 users right-click the file and select: Run as Administrator.
    Give the program a few seconds to appear.
  • Copy and paste the following script in the code box:
  • Note: This script is written for usage on this system only, do not use it on any other computer even if the problems are similar.
    C:\WINDOWS\Update Pro\Update Pro\Update Pro.exe;virustotal;
    C:\Users\SnickerSmom\Desktop\3-Week-Diet-And-53-Smoothies-BT1215 (1).zip;virustotal;
    C:\Users\SnickerSmom\Desktop\Top-10-Foods-For-A-Bright-Brain-TFBBME99UQ (1).pdf;virustotal;
    C:\Users\SnickerSmom\Healthy-To-100-TTAC-holiday-gift.pdf;virustotal;
    
  • Click the "Run script" button and wait patiently.
  • When finished the logfile will be opened in notepad.
  • If a reboot is needed the logfile will be opened after reboot.
  • The zoek-results.log can also be found on your systemdrive.
  • Please copy and paste the results from the logfile for further review in your next comment.

Step 2:
 
Please do another scan with FRST (be sure to select the Addition box under Optional Scan) and copy and paste both FRST.txt and Addition.txt to your next reply.
 
 
I would like to see the results from both scans in your next reply. As always if you have any issues or questions please don't hesitate to reply back to this thread. Finally, how is your computer running after performing the steps above? Are you still having the same issues or has anything changed? Thanks,
 
loki


Edited by loki2007, 16 January 2016 - 08:36 AM.

 
Member of the Bleeping Computer A.I.I. early response team!

#13 SnickerSmom

SnickerSmom
  • Topic Starter

  • Members
  • 56 posts
  • OFFLINE
  •  
  • Local time:12:50 PM

Posted 16 January 2016 - 06:00 PM

Zoek.exe results:

 

Zoek.exe v5.0.0.1 Updated 31-December-2015

Tool run by SnickerSmom on Sat 01/16/2016 at 15:44:01.77.
Microsoft Windows 10 Home 10.0.10586  x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\SnickerSmom\Desktop\zoek.exe [Scan all users] [Script inserted] 
 
==== System Restore Info ======================
 
1/16/2016 3:46:12 PM Zoek.exe System Restore Point Created Successfully.
 
==== VirusTotal Scan ======================
 
C:\WINDOWS\Update Pro\Update Pro\Update Pro.exe not found
 
==== C:\zoek_backup content ======================
 
C:\zoek_backup (files=0 folders=0 0 bytes)
 
==== EOF on Sat 01/16/2016 at 15:47:12.72 ======================
 

 

FRST Results

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-01-2015
Ran by SnickerSmom (administrator) on SNICKERSMOM-PC (16-01-2016 15:55:18)
Running from C:\Users\SnickerSmom\Downloads
Loaded Profiles: SnickerSmom (Available Profiles: SnickerSmom & Snick & DefaultAppPool)
Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(CYREN Inc.) C:\Program Files\Common Files\Commtouch\AntiVirus5\vsedsps.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(CYREN Inc.) C:\Program Files\Common Files\Commtouch\AntiVirus5\vseamps.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\System Mechanic Professional\System Shield\ioloSSTray.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\System Mechanic Professional\ioloGovernor64.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Spotify Ltd) C:\Users\SnickerSmom\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Flux Software LLC) C:\Users\SnickerSmom\AppData\Local\FluxSoftware\Flux\flux.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Amazon.com Inc.) C:\Users\SnickerSmom\AppData\Local\Amazon Cloud Drive\AmazonCloudDrive.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\System Mechanic Professional\LiveBoost.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Tweaking.com) C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
() C:\Users\SnickerSmom\Desktop\zoek.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13885696 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1402624 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1402624 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-12-17] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [iolo Startup] => C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe [4521272 2015-04-28] (iolo technologies, LLC)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [56080 2015-12-11] (Raptr, Inc)
HKLM\...\Policies\Explorer: [MemCheckBoxInRunDlg] 1
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Run: [Spotify Web Helper] => C:\Users\SnickerSmom\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2018360 2015-09-09] (Spotify Ltd)
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Run: [f.lux] => C:\Users\SnickerSmom\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AMDQuickStream.exe [488640 2015-04-06] (AppEx Networks Corporation)
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Run: [Amazon Cloud Drive] => C:\Users\SnickerSmom\AppData\Local\Amazon Cloud Drive\AmazonCloudDrive.exe [1939264 2015-12-10] (Amazon.com Inc.)
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Run: [GoogleChromeAutoLaunch_975F7208AA9F7013C4B6F326849D727B] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [748360 2016-01-12] (Google Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\SnickerSmom\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64\FileSyncShell64.dll [2016-01-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\SnickerSmom\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64\FileSyncShell64.dll [2016-01-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\SnickerSmom\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64\FileSyncShell64.dll [2016-01-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\SnickerSmom\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\FileSyncShell.dll [2016-01-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\SnickerSmom\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\FileSyncShell.dll [2016-01-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\SnickerSmom\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\FileSyncShell.dll [2016-01-01] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Event Reminder.lnk [2014-08-04]
ShortcutTarget: Event Reminder.lnk -> C:\Program Files (x86)\PrintMaster Platinum 18\Remind.exe (Broderbund Properties LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2015-08-25]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 69.144.127.53 71.10.216.1 71.10.216.2
Tcpip\..\Interfaces\{647063de-286b-4a89-833b-e2a7c5d47a26}: [DhcpNameServer] 69.144.127.53 71.10.216.1 71.10.216.2
Tcpip\..\Interfaces\{de876832-927f-477c-8cbf-24b7cfaf9689}: [DhcpNameServer] 69.144.127.53 71.10.216.1 71.10.216.2
 
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.goodsearch.com/
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO-x32: No Name -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> No File
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\ssv.dll [2016-01-05] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\jp2ssv.dll [2016-01-05] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-1673558610-3607175664-3325060128-1000 -> No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} -  No File
DPF: HKLM-x32 {0E5F0222-96B9-11D3-8997-00104BD12D94} hxxp://pcpitstop.com/nirvana/controls/pcmatic.cab
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
 
FireFox:
========
FF ProfilePath: C:\Users\SnickerSmom\AppData\Roaming\Mozilla\Firefox\Profiles\peudrcm5.default-1452060580953
FF DefaultSearchEngine.US: GoodSearch
FF Homepage: hxxp://www.goodsearch.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_20_0_0_267.dll [2015-12-28] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_267.dll [2015-12-28] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1221171.dll [2015-10-19] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-14] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2016-01-05] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2016-01-05] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @oberon-media.com/ONCAdapter -> C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.14\npapicomadapter.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-26] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1673558610-3607175664-3325060128-1000: @citrixonline.com/appdetectorplugin -> C:\Users\SnickerSmom\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-11-18] (Citrix Online)
FF SearchPlugin: C:\Users\SnickerSmom\AppData\Roaming\Mozilla\Firefox\Profiles\peudrcm5.default-1452060580953\searchplugins\goodsearch.xml [2016-01-06]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2015-08-25] [not signed]
FF HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\86DB3CB82ADD1AB8EC0B4728ECB45A1A86DB [2015-12-31] <==== ATTENTION
 
Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HomePage: Profile 1 -> search.ask.com/?gct=hp
CHR StartupUrls: Profile 1 -> "hxxps://blu181.mail.live.com/default.aspx?id=64855&owa=1&owasuffix=owa%2f","hxxps://mail.google.com/mail/u/0/#inbox"
CHR DefaultSearchURL: Profile 1 -> hxxp://www.goodsearch.com/search.aspx?keywords={searchTerms}
CHR DefaultSearchKeyword: Profile 1 -> goodsearch.com_
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.7.796\_platform_specific\win_x86\widevinecdmadapter.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\PepperFlash\pepflashplayer.dll ()
CHR Profile: C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Slides) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-04]
CHR Extension: (Google Docs) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (Google Drive) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-13]
CHR Extension: (YouTube) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-29]
CHR Extension: (Google Search) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-13]
CHR Extension: (Google Sheets) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-04]
CHR Extension: (Google Docs Offline) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-07]
CHR Extension: (AdBlock) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-01-09]
CHR Extension: (Pin It Button) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2015-09-29]
CHR Extension: (Goodshop app) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\jbdlijfdcdmaialphhbcbmhpbhhicehk [2014-10-31]
CHR Extension: (Adblock for Facebook™) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\jbfjodonncabnangfknilmabjfofdikc [2015-11-13]
CHR Extension: (Coupons at Checkout) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\kegphgaihkjoophpabchkmpaknehfamb [2015-12-22]
CHR Extension: (ShareThis) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lplpcpijdokpnbjcklakgabohjgneidi [2015-07-21]
CHR Extension: (Chrome Web Store Payments) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-11]
CHR Extension: (Amazon Assistant for Chrome) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam [2015-12-31]
CHR Extension: (Gmail) - C:\Users\SnickerSmom\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-16]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-05-31] (Adobe Systems) [File not signed]
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-21] (Advanced Micro Devices, Inc.) [File not signed]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [25800 2015-09-28] (Hewlett-Packard Company)
R2 ioloSystemService; C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe [4675896 2015-04-28] (iolo technologies, LLC)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S4 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1572056 2015-12-01] (Secunia)
S4 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [839384 2015-12-01] (Secunia)
R2 vseamps; C:\Program Files\Common Files\Commtouch\AntiVirus5\vseamps.exe [122120 2014-03-25] (CYREN Inc.)
R2 vsedsps; C:\Program Files\Common Files\Commtouch\AntiVirus5\vsedsps.exe [119560 2014-03-25] (CYREN Inc.)
S3 vseqrts; C:\Program Files\Common Files\Commtouch\AntiVirus5\vseqrts.exe [181512 2014-03-25] (CYREN Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [31992 2015-06-03] (Advanced Micro Devices, Inc.)
R2 AMP; C:\Windows\system32\Drivers\amp.sys [174856 2014-03-25] (CYREN Inc.)
R2 AMPSE; C:\Windows\system32\Drivers\ampse.sys [1728776 2014-03-25] (CYREN Inc.)
R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [229056 2015-04-03] (AppEx Networks Corporation)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-07-21] (Advanced Micro Devices)
R3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2015-09-09] (Windows ® Win 7 DDK provider)
R3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2015-09-09] (Windows ® Win 7 DDK provider)
R1 ElRawDisk; C:\Windows\system32\drivers\ElRawDsk.sys [30752 2013-09-18] (EldoS Corporation)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-01-01] ()
S3 hitmanpro37; C:\WINDOWS\system32\drivers\hitmanpro37.sys [41080 2016-01-03] ()
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2015-12-01] (Secunia)
R1 RawDisk3; C:\Windows\system32\drivers\rawdsk3.sys [32912 2014-07-16] (EldoS Corporation)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek                                            )
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
S3 cpuz134; \??\C:\Users\SNICKE~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
U3 idsvc; no ImagePath
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-01-16 15:44 - 2016-01-16 15:47 - 00000576 _____ C:\runcheck.txt
2016-01-16 14:28 - 2016-01-16 14:28 - 01309184 _____ C:\Users\SnickerSmom\Desktop\zoek.exe
2016-01-16 14:28 - 2016-01-16 14:28 - 00000000 ____D C:\zoek_backup
2016-01-14 23:00 - 2016-01-14 23:00 - 00001118 _____ C:\Users\SnickerSmom\Desktop\AdwCleaner - Shortcut.lnk
2016-01-14 22:59 - 2016-01-14 23:00 - 01754112 _____ C:\Users\SnickerSmom\Downloads\AdwCleaner.exe
2016-01-14 22:41 - 2016-01-14 22:41 - 00000000 ___HD C:\OneDriveTemp
2016-01-14 22:14 - 2016-01-14 22:14 - 00001178 _____ C:\Users\SnickerSmom\Desktop\apk-downloader-1.4.3 - Shortcut.lnk
2016-01-14 21:53 - 2016-01-14 21:53 - 00040198 _____ C:\Users\SnickerSmom\Desktop\Bookmark Manager.html
2016-01-13 03:07 - 2016-01-04 19:51 - 07477600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-01-13 03:07 - 2016-01-04 19:45 - 02587696 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2016-01-13 03:07 - 2016-01-04 19:42 - 02026736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2016-01-13 03:07 - 2016-01-04 19:37 - 02544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2016-01-13 03:07 - 2016-01-04 19:37 - 01299504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
2016-01-13 03:07 - 2016-01-04 19:37 - 00858952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2016-01-13 03:07 - 2016-01-04 19:36 - 00808800 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2016-01-13 03:07 - 2016-01-04 19:33 - 02180128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2016-01-13 03:07 - 2016-01-04 19:33 - 01118208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2016-01-13 03:07 - 2016-01-04 19:33 - 00701384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2016-01-13 03:07 - 2016-01-04 19:31 - 00703840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2016-01-13 03:07 - 2016-01-04 19:24 - 00796352 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-01-13 03:07 - 2016-01-04 19:23 - 00786696 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMADMOD.DLL
2016-01-13 03:07 - 2016-01-04 18:59 - 22393856 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-01-13 03:07 - 2016-01-04 18:57 - 16986112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-01-13 03:07 - 2016-01-04 18:50 - 00638464 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2016-01-13 03:07 - 2016-01-04 18:49 - 13018624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-01-13 03:07 - 2016-01-04 18:48 - 01009152 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMSPDMOD.DLL
2016-01-13 03:07 - 2016-01-04 18:43 - 00912384 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2016-01-13 03:07 - 2016-01-04 18:41 - 18677760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-01-13 03:07 - 2016-01-04 18:39 - 03428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2016-01-13 03:07 - 2016-01-04 18:30 - 02280448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-01-13 03:07 - 2016-01-04 18:28 - 07826432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-01-13 03:07 - 2016-01-04 18:28 - 04894720 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-01-13 03:07 - 2016-01-04 18:25 - 05660160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-01-13 03:07 - 2015-12-06 21:57 - 00973664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2016-01-13 03:07 - 2015-12-06 21:55 - 01281376 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 01155944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 01092456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 01065080 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 01020096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 00983464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 00884256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 00823264 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 00794888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 00696160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 00670928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 00526856 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfreadwrite.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 00502112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 00498448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 00462760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfreadwrite.dll
2016-01-13 03:07 - 2015-12-06 21:48 - 00450904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2016-01-13 03:07 - 2015-12-06 21:47 - 00925064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2016-01-13 03:07 - 2015-12-06 21:47 - 00898184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2016-01-13 03:07 - 2015-12-06 21:47 - 00716928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2016-01-13 03:07 - 2015-12-06 21:46 - 03671888 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-01-13 03:07 - 2015-12-06 21:46 - 02919320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-01-13 03:07 - 2015-12-06 21:15 - 01035776 _____ (Microsoft Corporation) C:\WINDOWS\system32\XboxNetApiSvc.dll
2016-01-13 03:07 - 2015-12-06 21:10 - 00824320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2016-01-13 03:07 - 2015-12-06 21:06 - 00572928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2016-01-13 03:07 - 2015-12-06 20:58 - 24601600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-01-13 03:07 - 2015-12-06 20:53 - 19339264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-01-13 03:07 - 2015-12-06 20:51 - 01318912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2016-01-13 03:07 - 2015-12-06 20:50 - 01131520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Audio.dll
2016-01-13 03:07 - 2015-12-06 20:49 - 01105920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll
2016-01-13 03:07 - 2015-12-06 20:45 - 02582016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2016-01-13 03:07 - 2015-12-06 20:45 - 00900608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2016-01-13 03:07 - 2015-12-06 20:45 - 00683008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2016-01-13 03:07 - 2015-12-06 20:43 - 02598400 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2016-01-13 03:07 - 2015-12-06 20:41 - 02061824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2016-01-13 03:07 - 2015-12-06 20:40 - 01995776 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2016-01-13 03:07 - 2015-12-06 20:40 - 01706496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2016-01-13 03:06 - 2016-01-04 19:51 - 01317640 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-01-13 03:06 - 2016-01-04 19:51 - 01141496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-01-13 03:06 - 2016-01-04 19:50 - 01173344 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-01-13 03:06 - 2016-01-04 19:50 - 00713568 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-01-13 03:06 - 2016-01-04 19:50 - 00671472 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll
2016-01-13 03:06 - 2016-01-04 19:49 - 00513888 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-01-13 03:06 - 2016-01-04 19:48 - 00499432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll
2016-01-13 03:06 - 2016-01-04 19:37 - 00848160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2016-01-13 03:06 - 2016-01-04 19:37 - 00785088 _____ (Microsoft Corporation) C:\WINDOWS\system32\evr.dll
2016-01-13 03:06 - 2016-01-04 19:37 - 00245840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2016-01-13 03:06 - 2016-01-04 19:37 - 00234504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mftranscode.dll
2016-01-13 03:06 - 2016-01-04 19:33 - 00709688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2016-01-13 03:06 - 2016-01-04 19:33 - 00652312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\evr.dll
2016-01-13 03:06 - 2016-01-04 19:33 - 00208176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mftranscode.dll
2016-01-13 03:06 - 2016-01-04 19:33 - 00116728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2016-01-13 03:06 - 2016-01-04 19:27 - 01594408 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2016-01-13 03:06 - 2016-01-04 19:23 - 01804664 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMALFXGFXDSP.dll
2016-01-13 03:06 - 2016-01-04 19:23 - 01309376 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-01-13 03:06 - 2016-01-04 19:23 - 00119320 _____ (Microsoft Corporation) C:\WINDOWS\system32\MP3DMOD.DLL
2016-01-13 03:06 - 2016-01-04 19:21 - 01371792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2016-01-13 03:06 - 2016-01-04 19:17 - 00695752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMADMOD.DLL
2016-01-13 03:06 - 2016-01-04 19:16 - 00100160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MP3DMOD.DLL
2016-01-13 03:06 - 2016-01-04 18:57 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\RMSRoamingSecurity.dll
2016-01-13 03:06 - 2016-01-04 18:57 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgrcli.dll
2016-01-13 03:06 - 2016-01-04 18:56 - 00145920 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmclient.exe
2016-01-13 03:06 - 2016-01-04 18:54 - 00162816 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2016-01-13 03:06 - 2016-01-04 18:53 - 00148992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshom.ocx
2016-01-13 03:06 - 2016-01-04 18:52 - 00210432 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2016-01-13 03:06 - 2016-01-04 18:51 - 00472576 _____ (Microsoft Corporation) C:\WINDOWS\system32\DscCore.dll
2016-01-13 03:06 - 2016-01-04 18:51 - 00248832 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll
2016-01-13 03:06 - 2016-01-04 18:50 - 00644096 _____ (Microsoft Corporation) C:\WINDOWS\system32\uReFS.dll
2016-01-13 03:06 - 2016-01-04 18:50 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2016-01-13 03:06 - 2016-01-04 18:49 - 01582080 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2016-01-13 03:06 - 2016-01-04 18:49 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMSPDMOE.DLL
2016-01-13 03:06 - 2016-01-04 18:49 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2016-01-13 03:06 - 2016-01-04 18:49 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll
2016-01-13 03:06 - 2016-01-04 18:49 - 00167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProximityCommon.dll
2016-01-13 03:06 - 2016-01-04 18:48 - 00387072 _____ (Microsoft Corporation) C:\WINDOWS\system32\qdvd.dll
2016-01-13 03:06 - 2016-01-04 18:48 - 00034816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usermgrcli.dll
2016-01-13 03:06 - 2016-01-04 18:47 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll
2016-01-13 03:06 - 2016-01-04 18:47 - 00479232 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-01-13 03:06 - 2016-01-04 18:47 - 00305664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ksproxy.ax
2016-01-13 03:06 - 2016-01-04 18:45 - 00678912 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll
2016-01-13 03:06 - 2016-01-04 18:45 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\facecredentialprovider.dll
2016-01-13 03:06 - 2016-01-04 18:44 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wshom.ocx
2016-01-13 03:06 - 2016-01-04 18:43 - 00604672 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-01-13 03:06 - 2016-01-04 18:43 - 00584704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2016-01-13 03:06 - 2016-01-04 18:42 - 00166912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll
2016-01-13 03:06 - 2016-01-04 18:41 - 01070080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMSPDMOE.DLL
2016-01-13 03:06 - 2016-01-04 18:41 - 00558592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uReFS.dll
2016-01-13 03:06 - 2016-01-04 18:40 - 00890880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMSPDMOD.DLL
2016-01-13 03:06 - 2016-01-04 18:40 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ProximityCommon.dll
2016-01-13 03:06 - 2016-01-04 18:39 - 00569856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qdvd.dll
2016-01-13 03:06 - 2016-01-04 18:39 - 00498176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll
2016-01-13 03:06 - 2016-01-04 18:39 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ksproxy.ax
2016-01-13 03:06 - 2016-01-04 18:38 - 00389120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-01-13 03:06 - 2016-01-04 18:36 - 00573440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll
2016-01-13 03:06 - 2016-01-04 18:36 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-01-13 03:06 - 2016-01-04 18:33 - 01674240 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll
2016-01-13 03:06 - 2016-01-04 18:30 - 02796032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2016-01-13 03:06 - 2016-01-04 18:29 - 03667456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-01-13 03:06 - 2016-01-04 18:28 - 01542656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll
2016-01-13 03:06 - 2015-12-06 21:49 - 00412512 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2016-01-13 03:06 - 2015-12-06 21:48 - 00337840 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFPlay.dll
2016-01-13 03:06 - 2015-12-06 21:48 - 00289248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll
2016-01-13 03:06 - 2015-12-06 21:48 - 00115040 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-01-13 03:06 - 2015-12-06 21:48 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-01-13 03:06 - 2015-12-06 21:45 - 00264544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2016-01-13 03:06 - 2015-12-06 21:15 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.XboxLive.ProxyStub.dll
2016-01-13 03:06 - 2015-12-06 21:09 - 00133120 _____ (Microsoft Corporation) C:\WINDOWS\system32\flvprophandler.dll
2016-01-13 03:06 - 2015-12-06 21:09 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanagerprecheck.dll
2016-01-13 03:06 - 2015-12-06 21:09 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageUsage.dll
2016-01-13 03:06 - 2015-12-06 21:07 - 00134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
2016-01-13 03:06 - 2015-12-06 21:07 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2016-01-13 03:06 - 2015-12-06 21:06 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2016-01-13 03:06 - 2015-12-06 21:06 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2016-01-13 03:06 - 2015-12-06 21:05 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2016-01-13 03:06 - 2015-12-06 21:05 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\BackgroundTransferHost.exe
2016-01-13 03:06 - 2015-12-06 21:04 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshost.dll
2016-01-13 03:06 - 2015-12-06 21:04 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2016-01-13 03:06 - 2015-12-06 21:02 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2016-01-13 03:06 - 2015-12-06 21:02 - 00161280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2016-01-13 03:06 - 2015-12-06 21:01 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2016-01-13 03:06 - 2015-12-06 21:01 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BackgroundTransferHost.exe
2016-01-13 03:06 - 2015-12-06 21:00 - 00618496 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2016-01-13 03:06 - 2015-12-06 21:00 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSFlacDecoder.dll
2016-01-13 03:06 - 2015-12-06 21:00 - 00210432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2016-01-13 03:06 - 2015-12-06 21:00 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-01-13 03:06 - 2015-12-06 20:59 - 00558080 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll
2016-01-13 03:06 - 2015-12-06 20:59 - 00292352 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2016-01-13 03:06 - 2015-12-06 20:59 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2016-01-13 03:06 - 2015-12-06 20:59 - 00165376 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2016-01-13 03:06 - 2015-12-06 20:58 - 00459776 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2016-01-13 03:06 - 2015-12-06 20:57 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2016-01-13 03:06 - 2015-12-06 20:57 - 00270848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSFlacDecoder.dll
2016-01-13 03:06 - 2015-12-06 20:56 - 00607232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2016-01-13 03:06 - 2015-12-06 20:56 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll
2016-01-13 03:06 - 2015-12-06 20:55 - 07979008 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2016-01-13 03:06 - 2015-12-06 20:55 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2016-01-13 03:06 - 2015-12-06 20:54 - 00850432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2016-01-13 03:06 - 2015-12-06 20:53 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll
2016-01-13 03:06 - 2015-12-06 20:51 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll
2016-01-13 03:06 - 2015-12-06 20:48 - 06297088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2016-01-13 03:06 - 2015-12-06 20:43 - 00931328 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSMPEG2ENC.DLL
2016-01-13 03:06 - 2015-12-06 20:40 - 03593216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-01-13 03:06 - 2015-12-06 20:39 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2016-01-13 03:06 - 2015-12-06 20:38 - 00871936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSMPEG2ENC.DLL
2016-01-13 03:06 - 2015-12-06 20:33 - 00375296 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDEServer.exe
2016-01-13 03:06 - 2015-12-06 20:32 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\dialserver.dll
2016-01-12 12:12 - 2016-01-12 12:12 - 00506954 _____ C:\Users\SnickerSmom\Documents\10_AntiAging_Recipes (1).pdf
2016-01-11 15:58 - 2016-01-11 15:58 - 00105970 _____ C:\Users\SnickerSmom\Desktop\FRST.txt
2016-01-11 15:51 - 2016-01-11 15:53 - 00001080 _____ C:\Users\SnickerSmom\Desktop\FRST64 - Shortcut.lnk
2016-01-10 00:05 - 2016-01-10 00:05 - 00000000 ___DL C:\Users\HomeGroupUser$\Documents\My Videos
2016-01-10 00:05 - 2016-01-10 00:05 - 00000000 ___DL C:\Users\HomeGroupUser$\Documents\My Pictures
2016-01-10 00:05 - 2016-01-10 00:05 - 00000000 ___DL C:\Users\HomeGroupUser$\Documents\My Music
2016-01-10 00:05 - 2016-01-10 00:05 - 00000000 ___DL C:\Users\Guest\Documents\My Videos
2016-01-10 00:05 - 2016-01-10 00:05 - 00000000 ___DL C:\Users\Guest\Documents\My Pictures
2016-01-10 00:05 - 2016-01-10 00:05 - 00000000 ___DL C:\Users\Guest\Documents\My Music
2016-01-10 00:05 - 2016-01-10 00:05 - 00000000 ___DL C:\Users\Administrator\Documents\My Videos
2016-01-10 00:05 - 2016-01-10 00:05 - 00000000 ___DL C:\Users\Administrator\Documents\My Pictures
2016-01-10 00:05 - 2016-01-10 00:05 - 00000000 ___DL C:\Users\Administrator\Documents\My Music
2016-01-10 00:03 - 2016-01-10 00:03 - 00000000 ___DL C:\Users\HomeGroupUser$\My Documents
2016-01-10 00:02 - 2016-01-10 00:02 - 00000000 ___DL C:\Users\Guest\My Documents
2016-01-10 00:02 - 2016-01-10 00:02 - 00000000 ___DL C:\Users\Administrator\My Documents
2016-01-09 22:44 - 2016-01-09 22:45 - 00001888 _____ C:\Users\SnickerSmom\Desktop\Rkill.txt
2016-01-09 11:29 - 2016-01-09 11:29 - 01012081 _____ C:\Users\SnickerSmom\Downloads\Bounce+Back+BIG+in+2016+by+Sonia+Ricotti.pdf
2016-01-08 23:33 - 2016-01-08 23:33 - 00003792 _____ C:\WINDOWS\System32\Tasks\Tweaking.com - Windows Repair Tray Icon
2016-01-08 23:33 - 2016-01-08 23:33 - 00002236 _____ C:\Users\SnickerSmom\Desktop\Tweaking.com - Windows Repair.lnk
2016-01-08 23:32 - 2016-01-08 23:33 - 00182749 _____ C:\WINDOWS\Tweaking.com - Windows Repair Setup Log.txt
2016-01-08 23:32 - 2016-01-08 23:32 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2016-01-08 23:31 - 2016-01-08 23:32 - 21102632 _____ (Tweaking.com) C:\Users\SnickerSmom\Downloads\tweaking.com_windows_repair_aio_setup (1).exe
2016-01-08 20:49 - 2016-01-08 20:52 - 00060028 _____ C:\Users\SnickerSmom\Downloads\Addition.txt
2016-01-08 20:46 - 2016-01-16 15:55 - 00000746 _____ C:\Users\SnickerSmom\Downloads\FRST.txt
2016-01-08 20:46 - 2016-01-16 15:55 - 00000000 ____D C:\FRST
2016-01-08 20:46 - 2016-01-08 20:46 - 02370560 _____ (Farbar) C:\Users\SnickerSmom\Downloads\FRST64.exe
2016-01-08 15:59 - 2016-01-08 15:59 - 00001723 _____ C:\WINDOWS\system32\ScanResults.xml
2016-01-08 15:53 - 2016-01-08 15:53 - 00000464 _____ C:\WINDOWS\system32\ScannerSettings
2016-01-07 00:36 - 2016-01-11 00:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-01-06 15:52 - 2016-01-06 15:52 - 00001940 _____ C:\Users\Public\Desktop\Reimage Express.lnk
2016-01-06 15:50 - 2016-01-06 15:51 - 00597384 _____ (Reimage®) C:\Users\SnickerSmom\Downloads\ReimageExpress.exe
2016-01-06 12:45 - 2016-01-06 12:47 - 00772016 _____ (Reimage®) C:\Users\SnickerSmom\Downloads\ReimageRepair.exe
2016-01-05 23:37 - 2016-01-05 23:37 - 00097888 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2016-01-05 23:37 - 2016-01-05 23:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-01-05 23:36 - 2016-01-05 23:36 - 00000000 ____D C:\Users\Default\AppData\Roaming\Sun
2016-01-05 23:36 - 2016-01-05 23:36 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Sun
2016-01-05 23:21 - 2016-01-05 23:21 - 00001146 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2016-01-05 23:21 - 2016-01-05 23:21 - 00000000 ____D C:\Program Files (x86)\Secunia
2016-01-05 23:18 - 2016-01-05 23:18 - 00001358 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2016-01-05 23:18 - 2016-01-05 23:18 - 00000000 ____D C:\Program Files\Windows Live
2016-01-05 23:18 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_7.dll
2016-01-05 23:18 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_7.dll
2016-01-05 23:18 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_5.dll
2016-01-05 23:18 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_5.dll
2016-01-05 23:18 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_43.dll
2016-01-05 23:18 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_43.dll
2016-01-05 23:18 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx11_43.dll
2016-01-05 23:18 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx11_43.dll
2016-01-05 23:18 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_42.dll
2016-01-05 23:18 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_42.dll
2016-01-05 23:18 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_32.dll
2016-01-05 23:18 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_32.dll
2016-01-05 23:15 - 2016-01-05 23:15 - 00000837 _____ C:\Users\Public\Desktop\Speccy.lnk
2016-01-05 23:15 - 2016-01-05 23:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speccy
2016-01-05 23:15 - 2016-01-05 23:15 - 00000000 ____D C:\Program Files\Speccy
2016-01-05 23:09 - 2016-01-05 23:09 - 00000000 ____D C:\Users\SnickerSmom\Desktop\Old Firefox Data
2016-01-05 20:14 - 2016-01-05 20:14 - 01057016 _____ (Bleeping Computer, LLC) C:\Users\SnickerSmom\Downloads\rkill64-25671.exe
2016-01-05 20:11 - 2016-01-05 20:11 - 02032072 _____ (Bleeping Computer, LLC) C:\Users\SnickerSmom\Downloads\rkill.com
2016-01-05 20:07 - 2016-01-05 23:19 - 04010016 _____ (Secunia) C:\Users\SnickerSmom\Downloads\PSISetup.exe
2016-01-05 14:27 - 2016-01-05 14:27 - 14710444 _____ C:\Users\SnickerSmom\Documents\7-Swaps-7-Foods-7-Days_Widescreen_Digital (1).pdf
2016-01-05 02:47 - 2016-01-05 02:47 - 00000000 ____D C:\WINDOWS\system32\config\SM Registry Backup
2016-01-05 02:47 - 2016-01-05 02:47 - 00000000 ____D C:\WINDOWS\system32\config\Original
2016-01-05 02:47 - 2016-01-05 02:47 - 00000000 ____D C:\WINDOWS\system32\config\Before Compact
2016-01-05 00:13 - 2016-01-16 01:04 - 00003302 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForSnickerSmom
2016-01-05 00:13 - 2016-01-16 01:04 - 00000386 _____ C:\WINDOWS\Tasks\HPCeeScheduleForSnickerSmom.job
2016-01-03 16:52 - 2016-01-03 16:56 - 50584792 _____ (Microsoft Corporation) C:\Users\SnickerSmom\Downloads\Windows-KB890830-x64-V5.31.exe
2016-01-03 14:38 - 2016-01-14 21:41 - 00008246 _____ C:\WINDOWS\wininit.ini
2016-01-03 13:05 - 2016-01-03 13:05 - 00000000 ____D C:\Program Files\Common Files\AV
2016-01-03 13:05 - 2015-07-28 17:52 - 00821920 _____ (Safer-Networking Ltd. ) C:\Users\Public\Desktop\Post Win10 Spybot-install.exe
2016-01-03 13:01 - 2016-01-14 22:02 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-01-03 13:01 - 2016-01-14 21:41 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-01-03 13:01 - 2016-01-03 13:01 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2016-01-03 12:58 - 2016-01-03 12:58 - 01057016 _____ (Bleeping Computer, LLC) C:\Users\SnickerSmom\Downloads\rkill64.exe
2016-01-03 02:09 - 2016-01-03 02:09 - 00019680 _____ C:\WINDOWS\system32\.crusader
2016-01-03 01:58 - 2016-01-03 02:11 - 00041080 _____ C:\WINDOWS\system32\Drivers\hitmanpro37.sys
2016-01-03 01:56 - 2016-01-03 02:09 - 00000000 ____D C:\ProgramData\HitmanPro
2016-01-03 01:55 - 2016-01-03 01:56 - 11323704 _____ (SurfRight B.V.) C:\HitmanPro_x64.exe
2016-01-03 01:41 - 2016-01-03 01:41 - 00002171 _____ C:\Users\SnickerSmom\Desktop\Internet Explorer.lnk
2016-01-03 01:39 - 2016-01-03 01:39 - 00001601 _____ C:\Users\SnickerSmom\Desktop\Microsoft Edge.lnk
2016-01-03 00:47 - 2016-01-15 11:23 - 00000000 ____D C:\AdwCleaner
2016-01-03 00:16 - 2016-01-03 00:46 - 01745920 _____ C:\adwcleaner_5.027.exe
2016-01-02 17:26 - 2016-01-02 17:26 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2016-01-02 13:21 - 2016-01-02 13:21 - 00003266 _____ C:\WINDOWS\System32\Tasks\{1D345937-C5D3-469B-A393-948D2BE9454E}
2016-01-02 13:09 - 2016-01-02 13:10 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\com.shopswell.desktop
2016-01-02 13:08 - 2016-01-02 13:08 - 00000013 _____ C:\Users\SnickerSmom\.pluto.tv
2016-01-02 13:07 - 2016-01-02 13:16 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\PlutoTV
2016-01-02 13:07 - 2016-01-02 13:16 - 00000000 ____D C:\Program Files (x86)\Pluto TV
2016-01-01 23:28 - 2016-01-01 23:31 - 167583000 _____ (Apple Inc.) C:\iTunes6464Setup (1).exe
2016-01-01 17:09 - 2016-01-01 17:09 - 00000000 _____ C:\autoexec.bat
2016-01-01 17:08 - 2016-01-01 17:08 - 00022704 _____ C:\WINDOWS\system32\Drivers\EsgScanner.sys
2016-01-01 13:08 - 2016-01-01 13:08 - 00000000 ____D C:\Users\Public\Documents\Baidu
2016-01-01 10:58 - 2016-01-01 10:58 - 00000051 _____ C:\Prefs.js
2016-01-01 10:41 - 2016-01-01 10:41 - 00002429 _____ C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-01-01 10:31 - 2016-01-01 10:31 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\ActiveSync
2016-01-01 10:29 - 2016-01-01 10:29 - 00000020 ___SH C:\Users\SnickerSmom\ntuser.ini
2016-01-01 04:57 - 2016-01-01 07:54 - 00000000 ___DC C:\WINDOWS\Panther
2016-01-01 04:54 - 2016-01-01 04:54 - 00000000 ____D C:\Windows.old
2016-01-01 04:53 - 2016-01-01 04:53 - 22572632 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 21125408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 13381120 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 12125184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 11545088 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 09918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 07199232 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 05202944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 03993600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 03355136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02843136 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02772584 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2016-01-01 04:53 - 2016-01-01 04:53 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2016-01-01 04:53 - 2016-01-01 04:53 - 02680320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02653816 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02647552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02624512 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02444288 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02185840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02155008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02152800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2016-01-01 04:53 - 2016-01-01 04:53 - 02126848 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-01-01 04:53 - 2016-01-01 04:53 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02049024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-01-01 04:53 - 2016-01-01 04:53 - 02001408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01944576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01860096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01859448 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01817160 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01814528 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01734656 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01717248 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01713664 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01648640 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01540768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01505280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01467392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01443328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRHInproc.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01399224 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-01-01 04:53 - 2016-01-01 04:53 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01337240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01328128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01223168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01212928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01139200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 01042432 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00988160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00969728 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00957440 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00948224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00948224 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManager.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00938496 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00911648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00803840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00793600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00791552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00784896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00783360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00709120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00704000 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00698208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00697856 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00686592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00675064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00674816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00647168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00630632 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00623616 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00604928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-01-01 04:53 - 2016-01-01 04:53 - 00589312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00586208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00586080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00578912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2016-01-01 04:53 - 2016-01-01 04:53 - 00540752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00538632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00536768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\catsrvut.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00523616 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2016-01-01 04:53 - 2016-01-01 04:53 - 00516544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00515584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00511320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00470528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00454056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00440160 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00416768 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\catsrvut.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00408128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00405048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00400896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2016-01-01 04:53 - 2016-01-01 04:53 - 00382464 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00369912 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00366224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00365568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToDevice.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00334848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00334736 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00296488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00286720 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceaccess.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00264192 _____ (Nokia) C:\WINDOWS\system32\NmaDirect.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00241664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00227840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceaccess.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00220672 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00205824 _____ (Nokia) C:\WINDOWS\SysWOW64\NmaDirect.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-AppModelExecEvents.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00161632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-01-01 04:53 - 2016-01-01 04:53 - 00160768 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00157184 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rmcast.sys
2016-01-01 04:53 - 2016-01-01 04:53 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ETWCoreUIComponentsResources.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ETWCoreUIComponentsResources.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvc.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00118624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2016-01-01 04:53 - 2016-01-01 04:53 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\capimg.sys
2016-01-01 04:53 - 2016-01-01 04:53 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-01-01 04:53 - 2016-01-01 04:53 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinelsa.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MapControls.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MapControls.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00110032 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00100864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinelsa.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00095072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdstor.sys
2016-01-01 04:53 - 2016-01-01 04:53 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00092352 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.V2.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00089600 _____ (Microsoft Corporation) C:\WINDOWS\system32\NFCProvisioningPlugin.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsCSP.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00088392 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzautoupdate.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapsBtSvc.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputLocaleManager.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00080600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwapi.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\system32\BarcodeProvisioningPlugin.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanprotdim.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditBufferTestHook.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssign32.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwancfg.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00073360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosStorage.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManagerProxy.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosHostClient.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ihvrilproxy.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00063528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wwapi.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssign32.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthTokenBrokerExt.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditBufferTestHook.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00058408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosStorage.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosResource.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosResource.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\rilproxy.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringclient.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemovableMediaProvisioningPlugin.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanpref.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00051680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsUtilsV2.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosHostClient.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00045568 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsplib.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.proxy.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00042496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapstoasttask.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthManagerProxy.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCoreRes.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCoreRes.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00035680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wimmount.sys
2016-01-01 04:53 - 2016-01-01 04:53 - 00035656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfpmp.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00032040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfpmp.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringconfigsp.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WordBreakers.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapsupdatetask.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00028160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00028160 _____ (Microsoft Corporation) C:\WINDOWS\system32\nativemap.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.proxy.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WordBreakers.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshrm.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\IcsEntitlementHost.exe
2016-01-01 04:53 - 2016-01-01 04:53 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvcProxy.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MosTrace.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MosTrace.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00009728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MosHost.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00009728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MosHost.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00007680 _____ (Microsoft Corporation) C:\WINDOWS\system32\readingviewresources.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlStringsRes.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlStringsRes.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll
2016-01-01 04:49 - 2016-01-01 04:49 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2016-01-01 04:48 - 2016-01-01 04:48 - 00000000 _SHDL C:\Users\Default\My Documents
2016-01-01 04:48 - 2016-01-01 04:48 - 00000000 _SHDL C:\Users\Default\Documents\My Videos
2016-01-01 04:48 - 2016-01-01 04:48 - 00000000 _SHDL C:\Users\Default\Documents\My Pictures
2016-01-01 04:48 - 2016-01-01 04:48 - 00000000 _SHDL C:\Users\Default\Documents\My Music
2016-01-01 04:48 - 2016-01-01 04:48 - 00000000 _SHDL C:\Users\Default User\Documents\My Videos
2016-01-01 04:48 - 2016-01-01 04:48 - 00000000 _SHDL C:\Users\Default User\Documents\My Pictures
2016-01-01 04:48 - 2016-01-01 04:48 - 00000000 _SHDL C:\Users\Default User\Documents\My Music
2016-01-01 04:46 - 2016-01-01 04:46 - 00000000 ____D C:\WINDOWS\SysWOW64\BestPractices
2016-01-01 04:46 - 2016-01-01 04:46 - 00000000 ____D C:\WINDOWS\system32\msmq
2016-01-01 04:46 - 2016-01-01 04:46 - 00000000 ____D C:\WINDOWS\system32\BestPractices
2016-01-01 04:46 - 2016-01-01 04:46 - 00000000 ____D C:\Program Files\Reference Assemblies
2016-01-01 04:46 - 2016-01-01 04:46 - 00000000 ____D C:\Program Files\MSBuild
2016-01-01 04:46 - 2016-01-01 04:46 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2016-01-01 04:46 - 2016-01-01 04:46 - 00000000 ____D C:\Program Files (x86)\MSBuild
2016-01-01 04:46 - 2016-01-01 04:46 - 00000000 ____D C:\inetpub
2016-01-01 04:45 - 2015-10-23 18:47 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2016-01-01 04:45 - 2015-10-23 18:47 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2016-01-01 04:45 - 2015-10-23 18:47 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2016-01-01 04:45 - 2015-10-23 18:46 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2016-01-01 04:45 - 2015-10-23 18:46 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2016-01-01 04:45 - 2015-10-23 18:45 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2016-01-01 04:30 - 2016-01-15 11:25 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-01-01 04:16 - 2016-01-01 04:16 - 00001519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-01-01 04:16 - 2016-01-01 04:16 - 00000000 ____D C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2016-01-01 04:16 - 2016-01-01 04:16 - 00000000 ____D C:\Users\Default\AppData\Roaming\Media Center Programs
2016-01-01 04:16 - 2016-01-01 04:16 - 00000000 ____D C:\Users\Default\AppData\Roaming\ATI
2016-01-01 04:16 - 2016-01-01 04:16 - 00000000 ____D C:\Users\Default\AppData\Local\ATI
2016-01-01 04:16 - 2016-01-01 04:16 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2016-01-01 04:16 - 2016-01-01 04:16 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Media Center Programs
2016-01-01 04:16 - 2016-01-01 04:16 - 00000000 ____D C:\Users\Default User\AppData\Roaming\ATI
2016-01-01 04:16 - 2016-01-01 04:16 - 00000000 ____D C:\Users\Default User\AppData\Local\ATI
2016-01-01 04:10 - 2016-01-01 04:17 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2016-01-01 04:10 - 2016-01-01 04:10 - 00000000 ____D C:\Program Files\Common Files\SpeechEngines
2016-01-01 04:08 - 2016-01-15 11:24 - 00000000 ____D C:\Users\SnickerSmom
2016-01-01 04:08 - 2016-01-01 04:24 - 00000000 ____D C:\Users\Snick
2016-01-01 04:08 - 2016-01-01 04:23 - 00000000 ____D C:\Users\DefaultAppPool
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\SnickerSmom\My Documents
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\SnickerSmom\Documents\My Videos
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\SnickerSmom\Documents\My Pictures
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\SnickerSmom\Documents\My Music
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\Snick\My Documents
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\Snick\Documents\My Videos
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\Snick\Documents\My Pictures
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\Snick\Documents\My Music
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\DefaultAppPool\My Documents
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\DefaultAppPool\Documents\My Videos
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\DefaultAppPool\Documents\My Pictures
2016-01-01 04:08 - 2016-01-01 04:08 - 00000000 _SHDL C:\Users\DefaultAppPool\Documents\My Music
2016-01-01 04:07 - 2016-01-15 11:29 - 01022244 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-01-01 04:07 - 2016-01-01 04:07 - 00965390 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2016-01-01 04:04 - 2016-01-13 13:34 - 00000000 ____D C:\ProgramData\Package Cache
2016-01-01 04:04 - 2016-01-01 04:10 - 00000000 ____D C:\ProgramData\HP
2016-01-01 04:04 - 2016-01-01 04:10 - 00000000 ____D C:\ProgramData\AMD
2016-01-01 04:04 - 2016-01-01 04:04 - 00000000 ____H C:\ProgramData\DP45977C.lfl
2016-01-01 04:04 - 2016-01-01 04:04 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2016-01-01 04:04 - 2016-01-01 04:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2016-01-01 04:04 - 2016-01-01 04:04 - 00000000 ____D C:\Program Files\Realtek
2016-01-01 04:04 - 2016-01-01 04:04 - 00000000 ____D C:\Program Files\ATI Technologies
2016-01-01 04:04 - 2016-01-01 04:04 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2016-01-01 04:03 - 2016-01-01 04:17 - 00000000 ____D C:\Program Files\AMD
2016-01-01 04:03 - 2016-01-01 04:03 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2016-01-01 04:03 - 2016-01-01 04:03 - 00000000 _____ C:\WINDOWS\ativpsrm.bin
2016-01-01 04:02 - 2015-10-30 00:17 - 02718208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2016-01-01 03:58 - 2016-01-01 04:18 - 01056640 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-01-01 03:32 - 2016-01-01 04:12 - 00000000 ____D C:\WINDOWS\system32\fij
2016-01-01 00:38 - 2016-01-01 04:19 - 00002808 _____ C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini
2016-01-01 00:38 - 2016-01-01 04:19 - 00002808 _____ C:\WINDOWS\system32\LavasoftTcpServiceOff.ini
2016-01-01 00:38 - 2016-01-01 00:38 - 00425744 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll
2015-12-31 22:09 - 2015-12-31 22:09 - 00000000 ____D C:\Program Files (x86)\taskvmx
2015-12-31 21:48 - 2015-12-31 21:48 - 00000000 ____D C:\$SysReset
2015-12-31 21:45 - 2015-12-31 21:45 - 00079064 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\peqwi.sys
2015-12-31 20:45 - 2015-12-31 20:45 - 00000000 ____D C:\Users\SnickerSmom\AppData\Roaming\TuneUp Software
2015-12-31 20:45 - 2015-12-31 20:45 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\TuneUp Software
2015-12-31 20:44 - 2015-12-31 20:46 - 00000000 ____D C:\ProgramData\TuneUp Software
2015-12-31 20:19 - 2015-12-31 20:19 - 00001843 _____ C:\ProgramData\tempimage.bmp
2015-12-31 19:34 - 2015-12-31 19:34 - 00004760 _____ C:\WINDOWS\SysWOW64\Topkikduia.ini
2015-12-31 19:34 - 2015-12-31 19:34 - 00002480 _____ C:\WINDOWS\SysWOW64\TopkikduiaOff.ini
2015-12-31 19:34 - 2015-12-31 19:34 - 00002480 _____ C:\WINDOWS\system32\TopkikduiaOff.ini
2015-12-31 19:34 - 2015-12-31 19:34 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\Tempfolder
2015-12-31 19:34 - 2015-12-31 19:32 - 00768368 _____ C:\WINDOWS\system32\Topkikduia64.dll
2015-12-31 19:32 - 2016-01-09 23:46 - 00000000 ____D C:\Users\SnickerSmom\AppData\Roaming\Common
2015-12-31 19:32 - 2016-01-01 04:30 - 00002306 _____ C:\WINDOWS\System32\Tasks\Ruvrei
2015-12-31 19:32 - 2015-12-31 21:44 - 00000000 ____D C:\Users\SnickerSmom\AppData\LocalLow\Company
2015-12-31 19:29 - 2016-01-15 14:17 - 00000360 _____ C:\WINDOWS\Tasks\DRCGENIZ1.job
2015-12-31 19:29 - 2016-01-01 04:30 - 00002484 _____ C:\WINDOWS\System32\Tasks\Xmas2
2015-12-31 19:29 - 2016-01-01 04:30 - 00002390 _____ C:\WINDOWS\System32\Tasks\DRCGENIZ1
2015-12-31 19:29 - 2015-12-31 19:29 - 00000000 ____D C:\ProgramData\2acd4cb5c435461892520f3241ad43b9
2015-12-31 19:26 - 2016-01-01 04:30 - 00002600 _____ C:\WINDOWS\System32\Tasks\Uuuufkurlal
2015-12-31 19:18 - 2015-12-31 20:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
2015-12-31 19:11 - 2015-12-31 19:11 - 00000728 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
2015-12-31 19:08 - 2015-12-31 21:42 - 00000000 ____D C:\Program Files (x86)\S5
2015-12-31 19:08 - 2015-12-31 19:08 - 00000000 ____D C:\Users\SnickerSmom\AppData\Roaming\c
2015-12-31 19:07 - 2015-12-31 19:54 - 00187904 _____ C:\WINDOWS\rsrcs.dll
2015-12-31 19:06 - 2015-12-31 19:06 - 00002560 _____ C:\Users\SnickerSmom\AppData\Local\uninstall.exe
2015-12-31 19:06 - 2015-12-31 19:06 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\Geckofx
2015-12-27 22:42 - 2015-12-27 22:42 - 01044453 _____ C:\Users\SnickerSmom\Desktop\3-Week-Diet-And-53-Smoothies-BT1215 (1).zip
2015-12-27 00:43 - 2015-12-27 00:43 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\Blizzard
2015-12-26 00:44 - 2015-12-26 00:44 - 75402025 _____ C:\Users\SnickerSmom\Healthy-To-100-TTAC-holiday-gift.pdf
2015-12-25 19:55 - 2016-01-01 04:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2015-12-25 19:55 - 2015-12-25 19:55 - 00001254 _____ C:\Users\Public\Desktop\Hearthstone.lnk
2015-12-25 19:48 - 2015-12-27 00:44 - 00000000 ____D C:\Program Files (x86)\Hearthstone
2015-12-25 19:48 - 2015-12-25 19:48 - 00000000 ____D C:\Data
2015-12-25 19:45 - 2016-01-01 04:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2015-12-25 19:45 - 2015-12-31 19:05 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\Battle.net
2015-12-25 19:45 - 2015-12-25 19:45 - 00001217 _____ C:\Users\Public\Desktop\Battle.net.lnk
2015-12-25 19:45 - 2015-12-25 19:45 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\Blizzard Entertainment
2015-12-25 19:45 - 2015-12-25 19:45 - 00000000 ____D C:\ProgramData\Blizzard Entertainment
2015-12-25 19:44 - 2015-12-25 19:46 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-12-25 18:46 - 2016-01-01 23:35 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-12-25 18:46 - 2016-01-01 23:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-12-25 18:45 - 2015-12-25 18:46 - 00000000 ____D C:\Program Files\iTunes
2015-12-25 18:45 - 2015-12-25 18:45 - 00000000 ____D C:\Program Files\iPod
2015-12-25 18:45 - 2015-12-25 18:45 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-12-25 18:42 - 2015-12-25 19:46 - 00000000 ____D C:\Users\SnickerSmom\AppData\Roaming\Battle.net
2015-12-25 18:41 - 2015-12-25 18:42 - 00000000 ____D C:\ProgramData\Battle.net
2015-12-25 18:41 - 2015-12-25 18:41 - 02950200 _____ (Blizzard Entertainment) C:\Users\SnickerSmom\Battle.net-Setup.exe
2015-12-21 21:46 - 2015-12-21 21:46 - 00971903 _____ C:\Users\SnickerSmom\Downloads\WWA-M3-Cheat-Sheet.pdf
2015-12-21 21:46 - 2015-12-21 21:46 - 00320521 _____ C:\Users\SnickerSmom\Downloads\Calendar-September-2015.pdf
2015-12-21 21:46 - 2015-12-21 21:46 - 00293041 _____ C:\Users\SnickerSmom\Downloads\ITN-Welcome+Packet+and+Intake+Forms.pdf
2015-12-21 21:44 - 2015-12-21 21:47 - 00000000 ____D C:\Users\SnickerSmom\ITN Stuff
2015-12-19 12:30 - 2016-01-10 09:17 - 00000000 ____D C:\Users\SnickerSmom\AppData\Roaming\Amazon Cloud Drive
2015-12-19 12:30 - 2015-12-19 12:30 - 00001335 _____ C:\Users\SnickerSmom\Desktop\Amazon Cloud Drive.lnk
2015-12-19 12:30 - 2015-12-19 12:30 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\Amazon Cloud Drive
2015-12-19 12:21 - 2015-12-19 12:29 - 00867648 _____ (Amazon) C:\Users\SnickerSmom\Desktop\AmazonCloudDriveSetup.exe
2015-12-17 00:13 - 2015-12-17 00:13 - 00512970 _____ C:\Users\SnickerSmom\Desktop\Top-10-Foods-For-A-Bright-Brain-TFBBME99UQ (1).pdf
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-01-16 15:50 - 2014-04-08 23:00 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-01-16 15:48 - 2014-07-10 19:05 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-01-16 15:25 - 2014-11-18 18:13 - 00000628 _____ C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-1673558610-3607175664-3325060128-1000.job
2016-01-16 15:15 - 2014-04-08 22:12 - 00000936 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-16 14:38 - 2015-05-30 15:23 - 00000724 _____ C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-1673558610-3607175664-3325060128-1000.job
2016-01-16 14:27 - 2015-08-23 14:56 - 00000408 _____ C:\WINDOWS\SysWOW64\iolo.ini
2016-01-16 14:27 - 2015-08-23 14:56 - 00000408 _____ C:\WINDOWS\system32\iolo.ini
2016-01-16 14:27 - 2014-04-08 15:49 - 00000392 _____ C:\WINDOWS\SysWOW64\iolo.ini.txt
2016-01-16 14:18 - 2014-12-28 12:44 - 00000000 ____D C:\Users\SnickerSmom\AppData\Roaming\Raptr
2016-01-16 14:15 - 2014-09-02 13:26 - 00004178 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{D9D4A39E-A92D-405A-BDB5-CD6FBBCD99EB}
2016-01-16 11:14 - 2015-01-17 00:55 - 00000000 ____D C:\Users\SnickerSmom\Documents\Detox Recipies
2016-01-16 06:15 - 2014-04-08 22:12 - 00000932 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-15 14:18 - 2014-06-14 23:52 - 00000000 ___RD C:\Users\SnickerSmom\OneDrive
2016-01-15 11:29 - 2015-10-30 00:21 - 00000000 ____D C:\WINDOWS\INF
2016-01-15 11:24 - 2015-10-29 23:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-01-15 11:23 - 2014-04-08 22:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2016-01-14 22:02 - 2015-09-15 21:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-01-14 22:02 - 2015-05-13 02:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-01-14 22:02 - 2015-05-13 02:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-01-14 22:00 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-01-14 21:59 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\Provisioning
2016-01-14 21:59 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-01-14 21:43 - 2015-01-18 21:04 - 00000000 ____D C:\Program Files (x86)\Pricepirates7
2016-01-14 21:42 - 2015-01-18 21:04 - 00000000 ____D C:\Users\SnickerSmom\AppData\Roaming\metaspinner net GmbH
2016-01-14 16:17 - 2014-04-08 22:13 - 00002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-01-14 12:50 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-01-13 13:55 - 2015-05-13 02:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-01-13 13:53 - 2015-10-30 00:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-01-13 13:50 - 2014-04-14 10:43 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-01-13 13:35 - 2014-04-14 10:43 - 143671360 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-01-13 10:59 - 2015-06-23 12:31 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-01-13 03:54 - 2015-10-30 00:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-01-12 23:57 - 2014-04-11 13:37 - 00000000 ____D C:\Users\SnickerSmom\Documents\Recipies
2016-01-11 19:12 - 2014-05-07 00:36 - 00000000 ____D C:\ProgramData\ioloGovernor
2016-01-10 00:34 - 2014-04-08 14:03 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\ElevatedDiagnostics
2016-01-10 00:03 - 2014-07-03 01:16 - 00000000 ____D C:\Users\HomeGroupUser$
2016-01-10 00:03 - 2014-07-03 01:16 - 00000000 ____D C:\Users\Guest
2016-01-10 00:02 - 2014-07-03 01:16 - 00000000 ____D C:\Users\Administrator
2016-01-09 23:46 - 2015-10-29 23:28 - 00000000 ____D C:\Windows
2016-01-09 23:46 - 2015-09-15 21:57 - 00001134 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-01-09 22:02 - 2015-05-23 10:40 - 00001428 _____ C:\Users\SnickerSmom\Desktop\gator4075.hostgator.com Secure WebDisk.lnk
2016-01-06 15:58 - 2014-03-06 02:54 - 00000000 ____D C:\temp
2016-01-06 13:04 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\SystemApps
2016-01-05 23:36 - 2014-04-08 23:37 - 00000000 ____D C:\Program Files (x86)\Java
2016-01-05 23:18 - 2014-06-14 23:56 - 00000000 ____D C:\Program Files (x86)\Windows Live
2016-01-05 23:16 - 2014-06-14 23:49 - 01239752 _____ (Microsoft Corporation) C:\Users\SnickerSmom\Downloads\wlsetup-web.exe
2016-01-05 22:33 - 2014-04-11 23:38 - 00000000 ____D C:\WINDOWS\BBSTORE
2016-01-05 20:20 - 2014-07-10 19:05 - 00001175 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-01-05 20:20 - 2014-07-10 19:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-01-05 20:20 - 2014-07-10 19:05 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-01-05 20:16 - 2014-07-10 19:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\SnickerSmom\Downloads\mbam-setup-2.0.2.1012.exe
2016-01-05 02:36 - 2014-04-08 15:25 - 00000000 ____D C:\ProgramData\iolo
2016-01-03 20:27 - 2015-10-05 11:17 - 00000000 ____D C:\Users\SnickerSmom\Gluten Free Recipes
2016-01-03 12:58 - 2014-04-26 09:22 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\SnickerSmom\Downloads\rkill.exe
2016-01-03 12:43 - 2014-04-21 21:09 - 00000000 ____D C:\Users\SnickerSmom\Documents\Homemade Cleaners, etc
2016-01-03 12:22 - 2015-10-30 00:24 - 00000000 ___RD C:\WINDOWS\Offline Web Pages
2016-01-03 09:22 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\Registration
2016-01-03 01:35 - 2015-09-15 21:57 - 00001220 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-01-02 18:40 - 2015-10-30 00:26 - 00826872 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-01-02 18:40 - 2015-10-30 00:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2016-01-02 13:43 - 2015-10-30 00:24 - 00000000 ___SD C:\WINDOWS\Downloaded Program Files
2016-01-02 13:19 - 2015-10-30 00:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-01-02 04:55 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\appcompat
2016-01-01 16:17 - 2014-04-08 20:32 - 00000000 ___HD C:\WINDOWS\msdownld.tmp
2016-01-01 16:03 - 2015-09-16 02:34 - 00000000 ___RD C:\Users\SnickerSmom\3D Objects
2016-01-01 10:49 - 2014-07-03 01:17 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\Packages
2016-01-01 10:47 - 2015-10-30 00:24 - 00000000 ___RD C:\WINDOWS\DevicesFlow
2016-01-01 10:30 - 2015-10-30 00:24 - 00000000 ___RD C:\WINDOWS\PrintDialog
2016-01-01 10:30 - 2015-10-30 00:24 - 00000000 ___RD C:\WINDOWS\MiracastView
2016-01-01 10:29 - 2015-09-09 14:58 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-01-01 07:53 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\rescache
2016-01-01 04:57 - 2015-10-30 00:24 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2016-01-01 04:53 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2016-01-01 04:53 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-01-01 04:53 - 2015-10-29 23:28 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism
2016-01-01 04:53 - 2015-10-29 23:28 - 00000000 ____D C:\WINDOWS\system32\Dism
2016-01-01 04:47 - 2015-09-09 11:05 - 00027594 _____ C:\WINDOWS\diagerr.xml
2016-01-01 04:47 - 2015-09-09 11:05 - 00026673 _____ C:\WINDOWS\diagwrn.xml
2016-01-01 04:46 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2016-01-01 04:46 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\system32\inetsrv
2016-01-01 04:46 - 2015-10-30 00:19 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqsnap.dll
2016-01-01 04:46 - 2015-10-30 00:19 - 00562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqutil.dll
2016-01-01 04:46 - 2015-10-30 00:19 - 00266240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.dll
2016-01-01 04:46 - 2015-10-30 00:19 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisRtl.dll
2016-01-01 04:46 - 2015-10-30 00:19 - 00161792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqrt.dll
2016-01-01 04:46 - 2015-10-30 00:19 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.tlb
2016-01-01 04:46 - 2015-10-30 00:19 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa30.tlb
2016-01-01 04:46 - 2015-10-30 00:19 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa20.tlb
2016-01-01 04:46 - 2015-10-30 00:19 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\admwprox.dll
2016-01-01 04:46 - 2015-10-30 00:19 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa10.tlb
2016-01-01 04:46 - 2015-10-30 00:19 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ahadmin.dll
2016-01-01 04:46 - 2015-10-30 00:19 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisreset.exe
2016-01-01 04:46 - 2015-10-30 00:19 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqcertui.dll
2016-01-01 04:46 - 2015-10-30 00:19 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wamregps.dll
2016-01-01 04:46 - 2015-10-30 00:19 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisrstap.dll
2016-01-01 04:46 - 2015-10-30 00:19 - 00009096 _____ C:\WINDOWS\SysWOW64\msmqtrc.mof
2016-01-01 04:46 - 2015-10-30 00:18 - 01417728 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqqm.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00813056 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsnap.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqutil.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00317440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqrt.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisRtl.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mqac.sys
2016-01-01 04:46 - 2015-10-30 00:18 - 00130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqlogmgr.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.tlb
2016-01-01 04:46 - 2015-10-30 00:18 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa30.tlb
2016-01-01 04:46 - 2015-10-30 00:18 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\admwprox.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa20.tlb
2016-01-01 04:46 - 2015-10-30 00:18 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ahadmin.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqbkup.exe
2016-01-01 04:46 - 2015-10-30 00:18 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa10.tlb
2016-01-01 04:46 - 2015-10-30 00:18 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsvc.exe
2016-01-01 04:46 - 2015-10-30 00:18 - 00019456 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisreset.exe
2016-01-01 04:46 - 2015-10-30 00:18 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqcertui.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wamregps.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisrstap.dll
2016-01-01 04:46 - 2015-10-30 00:18 - 00009096 _____ C:\WINDOWS\system32\msmqtrc.mof
2016-01-01 04:41 - 2015-10-30 00:24 - 00000000 __RSD C:\WINDOWS\Media
2016-01-01 04:41 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2016-01-01 04:30 - 2015-09-14 16:09 - 00003308 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{4F3EDE39-E638-4BF5-B8CD-41BE60BD4F8E}
2016-01-01 04:30 - 2015-09-09 14:51 - 00022840 _____ C:\WINDOWS\system32\emptyregdb.dat
2016-01-01 04:30 - 2015-07-22 01:59 - 00002462 _____ C:\WINDOWS\System32\Tasks\iolo DelOnReboot
2016-01-01 04:30 - 2015-05-30 15:23 - 00003322 _____ C:\WINDOWS\System32\Tasks\G2MUploadTask-S-1-5-21-1673558610-3607175664-3325060128-1000
2016-01-01 04:30 - 2015-01-05 12:57 - 00002134 _____ C:\WINDOWS\System32\Tasks\{B614DC81-01A7-438F-A140-D5EA63BA7A9E}
2016-01-01 04:30 - 2015-01-05 12:57 - 00002134 _____ C:\WINDOWS\System32\Tasks\{2B7D6153-B3F2-48E9-87B4-30096CE1503E}
2016-01-01 04:30 - 2015-01-05 12:57 - 00002134 _____ C:\WINDOWS\System32\Tasks\{07A71F26-C973-41B9-ACBA-CD5C2F1B3404}
2016-01-01 04:30 - 2015-01-05 12:56 - 00002134 _____ C:\WINDOWS\System32\Tasks\{834E7941-53C1-4CA1-870B-097A60573E11}
2016-01-01 04:30 - 2015-01-05 12:56 - 00002134 _____ C:\WINDOWS\System32\Tasks\{2C3BC256-B9A6-4BCC-AED2-072EC894F8E5}
2016-01-01 04:30 - 2015-01-05 12:54 - 00002134 _____ C:\WINDOWS\System32\Tasks\{8E1DE555-30B0-4A89-901F-B56D67EAE9DE}
2016-01-01 04:30 - 2015-01-01 14:16 - 00002224 _____ C:\WINDOWS\System32\Tasks\{66D277A3-226C-43CC-84B4-5836929EF8B4}
2016-01-01 04:30 - 2014-11-18 18:13 - 00003226 _____ C:\WINDOWS\System32\Tasks\G2MUpdateTask-S-1-5-21-1673558610-3607175664-3325060128-1000
2016-01-01 04:30 - 2014-10-22 11:00 - 00002208 _____ C:\WINDOWS\System32\Tasks\{EA62422D-F242-42EA-9D13-263C5EB74D5F}
2016-01-01 04:30 - 2014-10-21 16:02 - 00002046 _____ C:\WINDOWS\System32\Tasks\{360E44B8-1BE6-4A6E-8920-4B5BB57DD263}
2016-01-01 04:30 - 2014-05-07 00:36 - 00002534 _____ C:\WINDOWS\System32\Tasks\iolo Process Governor
2016-01-01 04:30 - 2014-04-14 15:09 - 00002304 _____ C:\WINDOWS\System32\Tasks\{F008FC30-5CB9-42F5-A751-6CAD5C8B651B}
2016-01-01 04:30 - 2014-04-08 23:00 - 00003088 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-01-01 04:30 - 2014-04-08 22:12 - 00003448 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-01-01 04:30 - 2014-04-08 22:12 - 00003224 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-01-01 04:30 - 2014-04-08 15:32 - 00002164 _____ C:\WINDOWS\System32\Tasks\SidebarExecute
2016-01-01 04:29 - 2015-10-30 00:24 - 00000000 __RHD C:\Users\Public\Libraries
2016-01-01 04:17 - 2015-10-29 23:28 - 00008192 ___SH C:\WINDOWS\system32\config\ELAM
2016-01-01 04:17 - 2015-09-14 15:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Quick Stream
2016-01-01 04:17 - 2015-08-27 15:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support
2016-01-01 04:17 - 2015-08-27 15:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3100 series Manual
2016-01-01 04:17 - 2015-08-25 19:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2016-01-01 04:17 - 2015-08-12 18:00 - 00000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.2
2016-01-01 04:17 - 2015-02-28 12:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth Pro
2016-01-01 04:17 - 2014-12-30 12:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Belkin USB Wireless Adapter Utility
2016-01-01 04:17 - 2014-12-28 12:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2016-01-01 04:17 - 2014-12-26 13:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2016-01-01 04:17 - 2014-08-15 15:20 - 00000000 ____D C:\WINDOWS\system32\STRING
2016-01-01 04:17 - 2014-08-04 09:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PrintMaster Platinum 18
2016-01-01 04:17 - 2014-06-29 23:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LimeWire
2016-01-01 04:17 - 2014-06-14 23:57 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2016-01-01 04:17 - 2014-06-14 23:57 - 00000000 ____D C:\WINDOWS\en
2016-01-01 04:17 - 2014-05-31 10:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
2016-01-01 04:17 - 2014-05-27 21:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2016-01-01 04:17 - 2014-04-19 20:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hallmark
2016-01-01 04:17 - 2014-04-13 15:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\First Christmas Screensaver
2016-01-01 04:17 - 2014-04-11 23:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\American Greetings CreataCard 6
2016-01-01 04:17 - 2014-04-11 23:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PrintMaster
2016-01-01 04:17 - 2014-04-08 15:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Mechanic Professional
2016-01-01 04:16 - 2015-07-10 02:05 - 00000000 ____D C:\Users\Default.migrated
2016-01-01 04:12 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\SysWOW64\migwiz
2016-01-01 04:12 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\SysWOW64\IME
2016-01-01 04:12 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2016-01-01 04:12 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\system32\spool
2016-01-01 04:12 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\system32\NDF
2016-01-01 04:12 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\system32\IME
2016-01-01 04:12 - 2015-08-25 19:15 - 00000000 ____D C:\WINDOWS\SysWOW64\spool
2016-01-01 04:12 - 2015-07-22 20:40 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe
2016-01-01 04:12 - 2014-07-06 01:27 - 00000000 ____D C:\WINDOWS\SysWOW64\sda
2016-01-01 04:11 - 2015-10-30 02:13 - 00000000 ____D C:\WINDOWS\ServiceProfiles
2016-01-01 04:11 - 2015-10-30 02:07 - 00000000 ____D C:\WINDOWS\ShellNew
2016-01-01 04:11 - 2015-10-30 00:24 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2016-01-01 04:11 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\schemas
2016-01-01 04:11 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2016-01-01 04:11 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2016-01-01 04:10 - 2015-10-30 00:24 - 00000000 __SHD C:\Program Files\Windows Sidebar
2016-01-01 04:10 - 2015-10-30 00:24 - 00000000 __SHD C:\Program Files (x86)\Windows Sidebar
2016-01-01 04:10 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\Help
2016-01-01 04:10 - 2015-10-30 00:24 - 00000000 ____D C:\ProgramData\USOPrivate
2016-01-01 04:10 - 2015-10-30 00:24 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-01-01 04:10 - 2014-12-09 17:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\3M Printscape™ Products
2016-01-01 04:10 - 2014-04-26 09:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2016-01-01 04:10 - 2010-11-21 00:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2016-01-01 04:10 - 2009-07-13 22:32 - 00000000 ____D C:\Program Files\Microsoft Games
2016-01-01 04:10 - 2009-07-13 20:20 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
2016-01-01 04:09 - 2015-09-14 16:01 - 00000000 ____D C:\Users\Snick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2016-01-01 04:09 - 2015-09-14 16:01 - 00000000 ____D C:\Users\Snick\AppData\Local\Packages
2016-01-01 04:08 - 2015-09-13 12:49 - 00000000 ____D C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2016-01-01 04:06 - 2015-10-29 23:28 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2016-01-01 04:03 - 2014-07-06 01:25 - 00000000 ____D C:\AMD
2016-01-01 03:58 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\tracing
2016-01-01 03:03 - 2015-10-30 02:42 - 00000000 ___HD C:\$WINDOWS.~BT
2015-12-31 20:18 - 2015-08-06 15:29 - 00000000 ____D C:\Users\SnickerSmom\AppData\Roaming\Zoom
2015-12-31 19:18 - 2014-07-03 01:16 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\Comodo
2015-12-25 19:45 - 2014-07-06 22:40 - 00000000 ____D C:\Users\SnickerSmom\AppData\Local\AMD
2015-12-25 18:45 - 2014-05-01 11:27 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-12-22 23:52 - 2014-12-28 12:44 - 00000000 ____D C:\Program Files (x86)\Raptr
2015-12-21 21:47 - 2015-05-14 11:01 - 00000000 ____D C:\Users\SnickerSmom\Leaky Gut Program
 
==================== Files in the root of some directories =======
 
2014-05-11 19:12 - 2014-05-11 19:12 - 0000000 _____ () C:\Users\SnickerSmom\AppData\Roaming\bitlord_log.txt
2016-01-05 01:19 - 2016-01-05 02:07 - 0000115 _____ () C:\Users\SnickerSmom\AppData\Roaming\LogFile.txt
2014-08-09 01:40 - 2014-08-10 22:32 - 0022741 _____ () C:\Users\SnickerSmom\AppData\Roaming\net.telestream.producer.xml
2014-08-09 01:40 - 2014-08-10 22:32 - 0000110 _____ () C:\Users\SnickerSmom\AppData\Roaming\net.telestream.wirecast.webstream.xml
2014-06-19 12:52 - 2014-12-24 13:53 - 0007666 _____ () C:\Users\SnickerSmom\AppData\Local\resmon.resmoncfg
2015-12-31 19:06 - 2015-12-31 19:06 - 0002560 _____ () C:\Users\SnickerSmom\AppData\Local\uninstall.exe
2016-01-01 04:04 - 2016-01-01 04:04 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-08-25 19:04 - 2015-08-31 20:18 - 0001059 _____ () C:\ProgramData\hpzinstall.log
2015-12-31 20:19 - 2015-12-31 20:19 - 0001843 _____ () C:\ProgramData\tempimage.bmp
 
Files to move or delete:
====================
C:\Users\SnickerSmom\Battle.net-Setup.exe
C:\Users\SnickerSmom\BlueStacks-SplitInstaller_native.exe
C:\Users\SnickerSmom\chromeinstall-8u25.exe
C:\Users\SnickerSmom\CouponPrinter.exe
C:\Users\SnickerSmom\cubisgold-110094687-setup.s110094687.c11008813.len.u.dl.exe
C:\Users\SnickerSmom\flashplayer18axau_ha_install.exe
C:\Users\SnickerSmom\flux-setup.exe
C:\Users\SnickerSmom\GoogleEarthProSetup.exe
C:\Users\SnickerSmom\HPSupportSolutionsFramework-12.0.30.81.exe
C:\Users\SnickerSmom\KindleForPC-installer.exe
C:\Users\SnickerSmom\Pricepirates7_setup.exe
 
 
Some files in TEMP:
====================
C:\Users\SnickerSmom\AppData\Local\Temp\7za.exe
C:\Users\SnickerSmom\AppData\Local\Temp\DaS_21.exe
C:\Users\SnickerSmom\AppData\Local\Temp\hijackthis.exe
C:\Users\SnickerSmom\AppData\Local\Temp\NirCmd.exe
C:\Users\SnickerSmom\AppData\Local\Temp\PEVZ.EXE
C:\Users\SnickerSmom\AppData\Local\Temp\remove.exe
C:\Users\SnickerSmom\AppData\Local\Temp\sed.exe
C:\Users\SnickerSmom\AppData\Local\Temp\shortcut.exe
C:\Users\SnickerSmom\AppData\Local\Temp\sqlite3.dll
C:\Users\SnickerSmom\AppData\Local\Temp\swreg.exe
C:\Users\SnickerSmom\AppData\Local\Temp\swxcacls.exe
C:\Users\SnickerSmom\AppData\Local\Temp\virustotal.exe
C:\Users\SnickerSmom\AppData\Local\Temp\wget.exe
C:\Users\SnickerSmom\AppData\Local\Temp\zoek-delete.exe
 
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2016-01-11 12:59
 
==================== End of FRST.txt ============================


#14 SnickerSmom

SnickerSmom
  • Topic Starter

  • Members
  • 56 posts
  • OFFLINE
  •  
  • Local time:12:50 PM

Posted 16 January 2016 - 06:06 PM

Woops! I forgot to include the edition.txt

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:07-01-2015
Ran by SnickerSmom (2016-01-16 16:02:37)
Running from C:\Users\SnickerSmom\Downloads
Windows 10 Home (X64) (2016-01-01 11:49:11)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-1673558610-3607175664-3325060128-500 - Administrator - Disabled)
ASPNET (S-1-5-21-1673558610-3607175664-3325060128-1005 - Limited - Enabled)
DefaultAccount (S-1-5-21-1673558610-3607175664-3325060128-503 - Limited - Disabled)
Guest (S-1-5-21-1673558610-3607175664-3325060128-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1673558610-3607175664-3325060128-1002 - Limited - Enabled)
Snick (S-1-5-21-1673558610-3607175664-3325060128-1009 - Limited - Enabled) => C:\Users\Snick
SnickerSmom (S-1-5-21-1673558610-3607175664-3325060128-1000 - Administrator - Enabled) => C:\Users\SnickerSmom
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: System Shield (Disabled - Up to date) {3030810C-E2AC-B12D-8BB1-B1B8C0193798}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: System Shield (Disabled - Up to date) {8B5160E8-C496-BEA3-B101-8ACABB9E7D25}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
3M Printscape™ Software V2 (HKLM-x32\...\{37A6EFC2-FE90-47BF-B84F-DD652E698D04}) (Version:  - )
4500_G510af_Help (x32 Version: 000.0.439.000 - Hewlett-Packard) Hidden
4500G510af (x32 Version: 000.0.423.000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.267 - Adobe Systems Incorporated)
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.13) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.1.171 - Adobe Systems, Inc.)
Amazon Cloud Drive (HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Amazon Cloud Drive) (Version: 3.1.2.21 - Amazon.com, Inc.)
Amazon Kindle (HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Amazon Kindle) (Version:  - Amazon)
AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
AMD Catalyst Install Manager (HKLM\...\{66AFB595-BC05-2913-7696-6D58F9B733E1}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 4.0.0.0 - AppEx Networks)
American Greetings CreataCard Select 6 (HKLM-x32\...\{9770A25C-45A7-478E-AF50-4FDE53EED270}) (Version:  - )
Apple Application Support (32-bit) (HKLM-x32\...\{7FA9ECCF-A2DE-4DA1-BFF3-81260DBDA68F}) (Version: 4.1.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{691F30EB-9009-475A-B8A9-E1BF39598FD5}) (Version: 4.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
AVSDK5 (Version: 5.4.11 - CYREN Inc.) Hidden
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Belkin USB Wireless Adapter (HKLM-x32\...\InstallShield_{549CE1BD-88E4-4C5E-BF75-B155624714CC}) (Version: 1.0.0.13 - Belkin)
Belkin USB Wireless Adapter (x32 Version: 1.0.0.13 - Belkin) Hidden
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Canon MG3100 series On-screen Manual (HKLM-x32\...\Canon MG3100 series On-screen Manual) (Version:  - )
Citrix Online Launcher (HKLM-x32\...\{DB014C85-A264-4BCA-A66F-6DD1FCF8EC36}) (Version: 1.0.335 - Citrix)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DocMgr (x32 Version: 130.0.000.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
f.lux (HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Flux) (Version:  - )
Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.111 - Google Inc.)
Google Earth Pro (HKLM-x32\...\{44FC61F0-2F8A-11E3-8CAE-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
GoToMeeting 7.8.1.4190 (HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\GoToMeeting) (Version: 7.8.1.4190 - CitrixOnline)
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hallmark Card Studio 2008 Deluxe (HKLM-x32\...\{747A6A10-DA58-48C2-A1F0-C15514419C8A}) (Version: 9.0.0.9 - Creative Home)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Document Manager 2.0 (HKLM\...\HP Document Manager) (Version: 2.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Officejet 4500 G510a-f (HKLM\...\{C98517B6-DCE9-49B7-B19E-E384178D3986}) (Version: 13.0 - HP)
HP Print Projects 1.0 (HKLM\...\HP Print Projects) (Version: 1.0 - HP)
HP Smart Web Printing 4.5 (HKLM\...\HP Smart Web Printing) (Version: 4.5 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Support Solutions Framework (HKLM-x32\...\{F6A11738-3EE4-4573-AEA5-6CD5D491C167}) (Version: 12.0.30.219 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
hpPrintProjects (x32 Version: 130.0.303.000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
hpWLPGInstaller (x32 Version: 130.0.303.000 - Hewlett-Packard) Hidden
iolo technologies' System Mechanic Professional (HKLM-x32\...\{BBD3F66B-1180-4785-B679-3F91572CD3B4}_is1) (Version: 14.5.2 - iolo technologies, LLC)
Itibiti RTC (x32 Version: 0.0.1 - Itibiti Inc) Hidden
iTunes (HKLM\...\{FBEB98F8-64E4-4FA3-A15E-4A9F42FF962E}) (Version: 12.3.2.35 - Apple Inc.)
Java 8 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218065F0}) (Version: 8.0.650.17 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1230 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 7.0.1230 - CyberLink Corp.) Hidden
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft .NET Framework 1.1 (HKLM-x32\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 43.0.4 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 43.0.4 (x86 en-US)) (Version: 43.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 43.0.4.5848 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
OpenOffice.org 3.2 (HKLM-x32\...\{981C4721-3715-4F4C-A6A4-CB89EE6D5C60}) (Version: 3.2.9505 - OpenOffice.org)
Perfect Scrapbook Maker Express (HKLM-x32\...\{4BDAD330-094B-440D-8563-64AD47F214C9}) (Version: 8.00.0000 - Cosmi Corporation)
PrintMaster 12 (HKLM-x32\...\{2A304FDE-F4E3-446D-AA0D-31425C897B71}) (Version:  - Broderbund LLC)
PrintMaster Platinum 18 (HKLM-x32\...\{EBD9A954-6C1A-4E9F-A098-C98653035381}) (Version: 18.00.0000 - Broderbund Software)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Raptr (HKLM-x32\...\Raptr) (Version:  - )
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 1.12.0007 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7601.30131 - Realtek Semiconductor Corp.)
Secunia PSI (3.0.0.11003) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.11003 - Secunia)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
SmartWebPrinting (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Speccy (HKLM\...\Speccy) (Version: 1.25 - Piriform)
Spotify (HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\Spotify) (Version: 1.0.13.108.gcd94e7db - Spotify AB)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Mechanic 12 Professional (x32 Version: 14.5.2 - ) Hidden
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.376.000 - Hewlett-Packard) Hidden
Tweaking.com - Windows Repair (HKLM-x32\...\Tweaking.com - Windows Repair) (Version: 3.7.4 - Tweaking.com)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-1673558610-3607175664-3325060128-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\SnickerSmom\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1673558610-3607175664-3325060128-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\SnickerSmom\AppData\Local\Citrix\GoToMeeting\3880\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {07B165CE-7667-4E82-B8EC-3D731B4E6501} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {08D30A33-6458-4144-BB37-2F62B0D11825} - System32\Tasks\{1D345937-C5D3-469B-A393-948D2BE9454E} => pcalua.exe -a C:\Users\SnickerSmom\AppData\Local\uninstall.exe
Task: {0A3A2FC8-8FC4-4380-B8D2-8AE5A420699A} - System32\Tasks\{EA62422D-F242-42EA-9D13-263C5EB74D5F} => pcalua.exe -a E:\chromeinstall-8u25.exe -d E:\
Task: {0CFE2E40-6A97-48C5-9F38-DE82315CF1B0} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {127311E4-F913-46F6-8032-B87F8D2B68F3} - System32\Tasks\{B614DC81-01A7-438F-A140-D5EA63BA7A9E} => Chrome.exe 
Task: {278AC42D-32BD-4952-8E4D-A7D4A0D322F9} - \IBUpd2 -> No File <==== ATTENTION
Task: {2B597885-026E-44A1-8A0D-E7232676B8BF} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {2B5FEAA5-721F-44EE-B701-ED7812B4C841} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-01-13] (Microsoft Corporation)
Task: {2D619309-5741-4C93-9ED4-B9494830A693} - System32\Tasks\G2MUpdateTask-S-1-5-21-1673558610-3607175664-3325060128-1000 => C:\Users\SnickerSmom\AppData\Local\Citrix\GoToMeeting\4190\g2mupdate.exe [2015-12-30] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {2E60D4E5-69CF-41AA-8BAB-E4DCCDFB47CD} - System32\Tasks\iolo Process Governor => C:\Program Files (x86)\iolo\System Mechanic Professional\iologovernor64.exe [2015-04-28] (iolo technologies, LLC)
Task: {32A484FF-AD9C-4BAC-BAEA-05E70DA92BF2} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {336324E1-5127-49B9-807E-0084B89BA51B} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {366172E6-7755-4D64-9911-07E52C8669A8} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {38600BEA-1584-4C5D-9F3F-3D88A0AA4C03} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {3A0D5B14-C06B-4D06-9820-4BC4399D5100} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {3A624ECA-661A-4E4C-8F39-D690E9EE9BD7} - \RegClean Pro -> No File <==== ATTENTION
Task: {3EC31131-BD2A-4D7A-9F14-73F401955A0F} - \Seventh -> No File <==== ATTENTION
Task: {42925DA3-E5A2-4B4B-A485-A3EDA2C94657} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {4D75B54E-0C3E-4A9A-AE06-1792CC69A98A} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {4F6CD5DB-99A5-48D8-AC0A-830D4BDF7C47} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe
Task: {4F9E7B1B-6EE9-4163-A7C2-361799C374D0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2015-09-28] (Hewlett-Packard)
Task: {5190010A-B076-4B16-B310-A46C6828CF14} - System32\Tasks\Ruvrei => C:\PROGRA~1\GROOVE~1\Tiunja.bat
Task: {53082A4E-2707-4D04-B6EB-C79ADF286FCB} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {549F94FB-1F06-4102-8662-58395D8563C2} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {61091039-4A22-4855-B9A9-EF6F3E82F08C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {64E0CDA6-A6E5-4FED-8E96-F0E1F500E9F1} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {6A9E3564-1806-4413-9D23-E90C1B2707C1} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {6B404DBC-2C1E-495B-ABC5-B58CF0CF0389} - \SushiLeads -> No File <==== ATTENTION
Task: {6BEA0B1C-0D8D-4F4E-8876-A46913216569} - System32\Tasks\Uuuufkurlal => C:\ProgramData\Uuuufkurlal\1.0.7.1\aovsioua.exe
Task: {7194020D-0F80-4CFB-A466-8D30FFF72D53} - \WebDnsio2-daily -> No File <==== ATTENTION
Task: {71CEA010-4AF7-49FF-8FA2-5EF990428E3D} - \WebDnsio2 -> No File <==== ATTENTION
Task: {71DF3447-1219-47B7-BEF3-3F071BE79397} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {7D5A7930-CCF9-46A4-9D00-2A3789C8B42E} - System32\Tasks\{834E7941-53C1-4CA1-870B-097A60573E11} => Chrome.exe 
Task: {7DDDF413-69F8-44E1-BFB4-9FAAA19618E5} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2015-11-04] (Hewlett-Packard)
Task: {7F57B939-74A9-4A76-BC09-388CFB9583B0} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {806F6B99-21C4-4519-94D3-4946071130A3} - \SmartWeb Upgrade Trigger Task -> No File <==== ATTENTION
Task: {80CDD246-FCB4-4273-8BD7-1666A9976D54} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {8147172C-C6EF-4FA2-8797-7A951A04DC79} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {82D3E1B8-FB34-439E-8DE1-4A9C47802B4B} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {87388666-602F-45D9-B658-D6BC3BB621AB} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {87B2CFF4-9F95-4FAA-8008-A4FF72ADD5E3} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {89F2F6A9-0B75-4F11-ACB9-561C26069E67} - System32\Tasks\{07A71F26-C973-41B9-ACBA-CD5C2F1B3404} => Chrome.exe 
Task: {8AE95769-4FDC-4859-A23D-9F4E250D555C} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {8C65D826-7E3B-433B-B9C9-3A58A924CD9E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2015-09-28] (Hewlett-Packard Company)
Task: {8EEC2356-ECEB-457B-B8D2-C5C50E24AB18} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {8F3A4615-4BE1-4CD8-BD75-24AD6D052D07} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {92D97B5A-0472-46BB-B0AA-266E969A4A28} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {932A7674-43B7-4C1C-ACAF-91790415ABF8} - System32\Tasks\Xmas2 => Rundll32.exe "C:\Users\SnickerSmom\AppData\Local\Xmas\{69C3D92C-DD79-C68C-6EBD-AEB59FAC3E3B}\ygargu.dll",#1 <==== ATTENTION
Task: {93AC23FC-3282-433C-8769-631B1CA77437} - System32\Tasks\{360E44B8-1BE6-4A6E-8920-4B5BB57DD263} => D:\PopCDRun.exe
Task: {9A28E191-9809-48D2-A6AE-284A557C1F4B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2015-11-04] (Hewlett-Packard)
Task: {9D6E8FB5-5BEC-4F1E-B8A4-73D9CC2FE40A} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {A444BE2E-7110-4EBC-A272-2E0C10617EBF} - \Xmas -> No File <==== ATTENTION
Task: {A49BDC62-C1D3-4CD4-A3F5-1345D267B447} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {AF527D50-F5AA-476A-A19D-22A2DCC931D8} - System32\Tasks\HPCeeScheduleForSnickerSmom => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
Task: {B1331262-D4BE-4DE5-AF8A-0D534C4E5C08} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {B1CB4BB2-B42B-43FA-AA56-B674DE7F1B83} - \Easy Driver Pro Schedule -> No File <==== ATTENTION
Task: {B627DF80-7BE8-4EF7-98AE-DF49A432A232} - System32\Tasks\{66D277A3-226C-43CC-84B4-5836929EF8B4} => pcalua.exe -a C:\Drivers\ID4ETN15WW5.exe -d C:\Drivers
Task: {B82401F9-18C9-42C0-BDFB-5FE85FCC586F} - System32\Tasks\{8E1DE555-30B0-4A89-901F-B56D67EAE9DE} => Chrome.exe 
Task: {B9638FC1-2C5A-4C61-8B6D-7CDBAFC503DE} - System32\Tasks\{2C3BC256-B9A6-4BCC-AED2-072EC894F8E5} => Chrome.exe 
Task: {BB127772-5214-40CE-A5C1-238898AB49F7} - System32\Tasks\iolo DelOnReboot => /c IF EXIST C:\ProgramData\iolo\ops\smrr.dll del /f C:\ProgramData\iolo\ops\smrr.dll
Task: {BC5DD265-BB0D-44E0-B331-878398060CE3} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {BF65627E-970A-4020-958D-E937F8DAFCF5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-12-28] (Adobe Systems Incorporated)
Task: {C21465DF-7081-4DAB-AA3C-02B4E93AEFCD} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {C342FE79-A55E-484B-A6F8-0B7B99C84FB3} - System32\Tasks\G2MUploadTask-S-1-5-21-1673558610-3607175664-3325060128-1000 => C:\Users\SnickerSmom\AppData\Local\Citrix\GoToMeeting\4190\g2mupload.exe [2015-12-30] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {C3DAA717-1D8B-44DD-9DF3-0484304EE1F1} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {D34AEF9D-FE16-483B-BE41-8D038790EDA5} - System32\Tasks\{2B7D6153-B3F2-48E9-87B4-30096CE1503E} => Chrome.exe 
Task: {D8B1DC6C-7A0D-45A5-9F16-120EB7CF3404} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {DCFF155B-5845-4DCD-9793-8DF478BB54C7} - System32\Tasks\DRCGENIZ1 => C:\ProgramData\LolyKey\LolyKey.exe <==== ATTENTION
Task: {DD7A1A04-97C1-4602-8C2F-06CEB87F855E} - \CCleanerSkipUAC -> No File <==== ATTENTION
Task: {DEF5D657-0F78-4C2D-A649-7AA5CD74C5DE} - System32\Tasks\{F008FC30-5CB9-42F5-A751-6CAD5C8B651B} => pcalua.exe -a C:\Users\SnickerSmom\Downloads\IN1OKR06WW1.exe -d C:\Users\SnickerSmom\Downloads
Task: {E35196DD-F101-4BC7-BC42-48CA40503107} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {E69F70F5-6D1E-4D43-AD83-AE5E7069D5CB} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {E76AE5F0-5B67-4114-B9A7-0736A87611BD} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {E780482A-231B-4EC5-86E2-6A81CC924F21} - System32\Tasks\Tweaking.com - Windows Repair Tray Icon => C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe [2015-03-11] (Tweaking.com)
Task: {E81402C7-394C-4CA0-805E-AA082CE3A857} - \Sixth -> No File <==== ATTENTION
Task: {E8479942-B5D6-41BF-926E-79B0A2819801} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {EF9B6C40-BDDC-4340-B8F4-31C3B026CD15} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {F81E5D7D-EAD2-417D-85D4-39AA53C1DBA3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2015-09-28] (Hewlett-Packard Company)
Task: {FAF7193E-9B13-48C1-8328-38A1E21BCC0A} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DRCGENIZ1.job => C:\ProgramData\LolyKey\LolyKey.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-1673558610-3607175664-3325060128-1000.job => C:\Users\SnickerSmom\AppData\Local\Citrix\GoToMeeting\4190\g2mupdate.exe
Task: C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-1673558610-3607175664-3325060128-1000.job => C:\Users\SnickerSmom\AppData\Local\Citrix\GoToMeeting\4190\g2mupload.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForSnickerSmom.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-10-30 00:18 - 2015-10-30 00:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2015-08-21 22:09 - 2015-08-21 22:09 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 00817152 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 03650560 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2015-08-21 22:09 - 2015-08-21 22:09 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2015-02-13 03:20 - 2015-02-13 03:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02653816 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-01-01 04:53 - 2016-01-01 04:53 - 02653816 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-01-13 03:06 - 2016-01-04 18:23 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-01-13 03:06 - 2015-12-06 21:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-01-13 03:06 - 2015-12-06 21:00 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-01-13 03:07 - 2016-01-04 18:29 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-01-13 03:07 - 2016-01-04 18:24 - 00936960 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-01-13 03:07 - 2016-01-04 18:24 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-01-13 03:07 - 2016-01-04 18:26 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-08-21 22:09 - 2015-08-21 22:09 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2015-11-18 17:57 - 2015-11-18 17:57 - 00676672 _____ () C:\Users\SnickerSmom\AppData\Local\Amazon Cloud Drive\sqlite3.dll
2016-01-14 16:17 - 2016-01-12 09:35 - 01590088 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\libglesv2.dll
2016-01-14 16:17 - 2016-01-12 09:35 - 00087880 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\libegl.dll
2010-11-22 15:56 - 2010-11-22 15:56 - 00087040 _____ () C:\Program Files (x86)\Raptr\_ctypes.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00043008 _____ () C:\Program Files (x86)\Raptr\_socket.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00805376 _____ () C:\Program Files (x86)\Raptr\_ssl.pyd
2014-05-13 16:26 - 2014-05-13 16:26 - 05812736 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtGui.pyd
2014-05-13 16:26 - 2014-05-13 16:26 - 00067584 _____ () C:\Program Files (x86)\Raptr\sip.pyd
2014-05-13 16:26 - 2014-05-13 16:26 - 01662464 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtCore.pyd
2014-05-13 16:26 - 2014-05-13 16:26 - 00494592 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtNetwork.pyd
2010-11-22 15:57 - 2010-11-22 15:57 - 00096256 _____ () C:\Program Files (x86)\Raptr\win32api.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00110592 _____ () C:\Program Files (x86)\Raptr\pywintypes26.dll
2010-11-22 15:56 - 2010-11-22 15:56 - 00010240 _____ () C:\Program Files (x86)\Raptr\select.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00356864 _____ () C:\Program Files (x86)\Raptr\_hashlib.pyd
2010-11-22 15:57 - 2010-11-22 15:57 - 00036352 _____ () C:\Program Files (x86)\Raptr\win32process.pyd
2010-11-22 15:57 - 2010-11-22 15:57 - 00111104 _____ () C:\Program Files (x86)\Raptr\win32file.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00044544 _____ () C:\Program Files (x86)\Raptr\_sqlite3.pyd
2011-02-15 11:17 - 2011-02-15 11:17 - 00417501 _____ () C:\Program Files (x86)\Raptr\sqlite3.dll
2010-11-22 15:57 - 2010-11-22 15:57 - 00167936 _____ () C:\Program Files (x86)\Raptr\win32gui.pyd
2014-05-13 16:26 - 2014-05-13 16:26 - 00313856 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtWebKit.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00127488 _____ () C:\Program Files (x86)\Raptr\pyexpat.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00009216 _____ () C:\Program Files (x86)\Raptr\winsound.pyd
2015-10-21 13:29 - 2015-10-21 13:29 - 00113171 _____ () C:\Program Files (x86)\Raptr\libvlc.dll
2015-10-21 13:29 - 2015-10-21 13:29 - 02396691 _____ () C:\Program Files (x86)\Raptr\libvlccore.dll
2010-11-22 15:56 - 2010-11-22 15:56 - 00583680 _____ () C:\Program Files (x86)\Raptr\unicodedata.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00354304 _____ () C:\Program Files (x86)\Raptr\pythoncom26.dll
2010-11-22 15:57 - 2010-11-22 15:57 - 00263168 _____ () C:\Program Files (x86)\Raptr\win32com.shell.shell.pyd
2010-11-22 15:56 - 2010-11-22 15:56 - 00324608 _____ () C:\Program Files (x86)\Raptr\PIL._imaging.pyd
2015-06-26 16:09 - 2015-06-26 16:09 - 00271872 _____ () C:\Program Files (x86)\Raptr\amd_ags.dll
2010-11-22 15:57 - 2010-11-22 15:57 - 00024064 _____ () C:\Program Files (x86)\Raptr\win32pipe.pyd
2010-11-22 15:57 - 2010-11-22 15:57 - 00141312 _____ () C:\Program Files (x86)\Raptr\gobject._gobject.pyd
2014-06-17 17:56 - 2014-06-17 17:56 - 02717595 _____ () C:\Program Files (x86)\Raptr\heliotrope._purple.pyd
2011-02-15 11:17 - 2011-02-15 11:17 - 01213633 _____ () C:\Program Files (x86)\Raptr\libxml2-2.dll
2010-11-22 16:06 - 2010-11-22 16:06 - 00055808 _____ () C:\Program Files (x86)\Raptr\zlib1.dll
2013-05-09 16:52 - 2013-05-09 16:52 - 00495680 _____ () C:\Program Files (x86)\Raptr\plugins\libaim.dll
2013-05-09 16:52 - 2013-05-09 16:52 - 01183699 _____ () C:\Program Files (x86)\Raptr\liboscar.dll
2013-05-09 16:52 - 2013-05-09 16:52 - 00483306 _____ () C:\Program Files (x86)\Raptr\plugins\libicq.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 00655356 _____ () C:\Program Files (x86)\Raptr\plugins\libirc.dll
2013-05-03 11:56 - 2013-05-03 11:56 - 01306387 _____ () C:\Program Files (x86)\Raptr\plugins\libmsn.dll
2013-05-03 11:56 - 2013-05-03 11:56 - 00565461 _____ () C:\Program Files (x86)\Raptr\plugins\libxmpp.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 01640221 _____ () C:\Program Files (x86)\Raptr\libjabber.dll
2013-05-03 11:56 - 2013-05-03 11:56 - 00506276 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoo.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 01053730 _____ () C:\Program Files (x86)\Raptr\libymsg.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 00497782 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoojp.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 00603326 _____ () C:\Program Files (x86)\Raptr\plugins\ssl-nss.dll
2013-05-03 11:57 - 2013-05-03 11:57 - 00474199 _____ () C:\Program Files (x86)\Raptr\plugins\ssl.dll
2016-01-14 16:17 - 2016-01-12 09:35 - 16799048 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\PepperFlash\pepflashplayer.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\ProgramData\Temp:B34A7CD6
AlternateDataStreams: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Windows\Start Menu\MSN.com.website:TASKICON_0favicon1129903636
AlternateDataStreams: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Windows\Start Menu\MSN.com.website:TASKICON_1favicon-298702541
AlternateDataStreams: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Windows\Start Menu\MSN.com.website:TASKICON_2favicon-1464078272
AlternateDataStreams: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Windows\Start Menu\MSN.com.website:TASKICON_3favicon-860043155
AlternateDataStreams: C:\Users\SnickerSmom\AppData\Roaming\Microsoft\Windows\Start Menu\MSN.com.website:TASKICON_4favicon640180837
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppXSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BFE => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BITS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ClipSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MpsSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\msiserver => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SharedAccess => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TweakingRemoveSafeBoot => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vss => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WSService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppXSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BITS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ClipSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\msiserver => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SamSs => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\srv => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\srv2 => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\srvnet => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TweakingRemoveSafeBoot => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vss => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WSService => ""="Service"
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\webcompanion.com -> hxxp://webcompanion.com
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 19:34 - 2015-12-31 19:11 - 00000728 ____N C:\WINDOWS\system32\Drivers\etc\hosts
 
127.0.0.1       localhost127.0.0.1       down.baidu2016.com
127.0.0.1       123.sogou.com
127.0.0.1       www.czzsyzgm.com
127.0.0.1       www.czzsyzxl.com
127.0.0.1       down.baidu2016.com
127.0.0.1       123.sogou.com
127.0.0.1       www.czzsyzgm.com
127.0.0.1       www.czzsyzxl.com
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\SnickerSmom\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\sam_0722.jpg
DNS Servers: 69.144.127.53 - 71.10.216.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Planner Reminder 2008.lnk => C:\Windows\pss\Event Planner Reminder 2008.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Forget Me Not.lnk => C:\Windows\pss\Forget Me Not.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^SnickerSmom^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Webshots Wallpaper & Screensaver.lnk => C:\Windows\pss\Webshots Wallpaper & Screensaver.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Raptr => C:\PROGRA~2\Raptr\RAPTRS~1.EXE --startup
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKLM\...\StartupApproved\StartupFolder: => "AllPCoptimizer.exe.lnk"
HKLM\...\StartupApproved\Run: => "SpaceSoundPro"
HKLM\...\StartupApproved\Run32: => "gmsd_us_005010193"
HKLM\...\StartupApproved\Run32: => "msrtn32"
HKLM\...\StartupApproved\Run32: => "SmartWeb"
HKLM\...\StartupApproved\Run32: => "Update Pro"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\StartupFolder: => "SmartWeb.lnk"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "ezwfea"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "SushiLeadsApplication"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "PCSpeedUp"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "ssn"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "Windi"
HKU\S-1-5-21-1673558610-3607175664-3325060128-1000\...\StartupApproved\Run: => "Update Pro"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{59B56D79-CD04-49A4-BE47-DB9B59D3BC8F}] => (Allow) C:\WINDOWS\system32\rundll32.exe
FirewallRules: [{BF999CBE-AE8E-4640-B997-00507EE92CA5}] => (Allow) 㩃啜敳獲卜楮正牥浓浯䅜灰慄慴剜慯業杮獜湳獜癡略⹰硥e
FirewallRules: [{8223EE8E-C6B2-41F9-B609-07C072147660}] => (Allow) 㩃啜敳獲卜楮正牥浓浯䅜灰慄慴剜慯業杮獜湳獜湳攮數
FirewallRules: [{82242D99-2EDF-474F-9875-4D6A41C6A9AF}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩潨瑳獵履楷桮獯畴敳⹟硥e
FirewallRules: [{AEEED65E-DED2-46F8-9F96-11FAE5BD6DF8}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩潨瑳獵履楷桮獯畴敳攮數
FirewallRules: [UDP Query User{ECF3313D-2573-4DA4-AD28-88D63B3523CA}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [TCP Query User{BE8DD4B2-4E85-4F30-9A26-9536AF337132}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [{ABC0C26C-6C89-4469-9A4D-E36A1A3F1009}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{1B9961BD-A982-4C00-BE52-B480506BA38F}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{0FF89689-BFA2-42C8-92C0-69AB176D8BE2}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{3E0AEE84-CE46-4071-8627-97647CEAAA66}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{4B769071-827D-47BA-AB57-26336811825A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{C9C1A9AD-176E-4004-9383-52DF216D0E48}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{24D58498-79EA-48FE-AE67-A50B755AAE60}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{24E42D0F-5FF1-4335-BFED-84CB926F46E2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E3DBE7B3-E668-43B5-94BC-BEE1A979DF95}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{B9E8F23F-BDF0-4E5F-BC26-29EA36739CC5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{782D9A82-996D-4FBA-9575-FA9640ED9127}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EA301A53-6E60-4C9C-A7D6-2F573EEAE496}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A474D4E3-56AB-4EA1-B0E3-7AFD9B55F935}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{43304378-87ED-4601-8C9E-E715006D70A0}] => (Allow) C:\Program Files (x86)\iolo\System Mechanic Professional\SysMech.exe
FirewallRules: [{08628AFF-EBF0-4BBA-BA4D-62D489E15AC6}] => (Allow) C:\Program Files (x86)\iolo\System Mechanic Professional\SysMech.exe
FirewallRules: [TCP Query User{6C421354-E8A4-41C7-A49C-79C9E58F1383}C:\users\snickersmom\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\snickersmom\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{8F176C89-73E4-4D01-9B0C-A411543D911F}C:\users\snickersmom\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\snickersmom\appdata\roaming\spotify\spotify.exe
FirewallRules: [{018B1779-4AC4-47DB-B5ED-4251BD564053}] => (Allow) C:\Users\SnickerSmom\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{B1FA5D57-A4ED-4651-9F59-063E0EF57143}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{AE9CF740-C537-4265-BD20-C4FC3555817D}] => (Allow) LPort=2869
FirewallRules: [{790BD8FE-6615-49BD-8E04-AD27CEDB164C}] => (Allow) LPort=1900
FirewallRules: [{FBB9E6C6-7519-4782-9312-19735AA08E1B}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{4F3BB0BA-CD6A-43D3-A4E0-B7E3F54D1E24}] => (Allow) C:\Program Files (x86)\LimeWire\LimeWire.exe
FirewallRules: [{9CF61B4A-2F94-4C43-B903-02B4C317131D}] => (Allow) C:\Program Files (x86)\LimeWire\LimeWire.exe
FirewallRules: [{E6040A49-0153-46AB-981E-D97A09793CDE}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
FirewallRules: [{6B449717-0096-4FFE-8965-1C15E202CDA4}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
FirewallRules: [{CA4E2C31-5A14-40A6-9266-7C93C3CF2100}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxm08.exe
FirewallRules: [{08CE735E-6C6B-48C1-997C-EAA307CF825B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposfx08.exe
FirewallRules: [{97D5060D-3764-42F4-BA8F-B4F85F823B8E}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
FirewallRules: [{6C8B2940-FA39-4E5A-864E-447E8210A2CE}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{3E0043B6-A014-4304-9BCC-C394329F648A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{321A6FF2-923C-447F-A7D4-4EE184E09C34}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpzwiz01.exe
FirewallRules: [{69D15292-D88E-4541-8DB6-38D543EEC49D}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
FirewallRules: [{318259B5-95C5-4452-8527-98DAC2230E82}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{930CD880-96CC-4077-89B9-07F133337E6B}] => (Allow) C:\Program Files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{2718D40D-315A-4DA5-B016-FC848BF93855}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxs08.exe
FirewallRules: [{8A17D646-F3FD-4745-A260-DD1A43D3D1D0}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqfxt08.exe
FirewallRules: [{12CC753B-9E26-4D02-942C-F031C8F3ABC4}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{48B806D1-249D-43AD-9B48-EC56F5CA1921}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{2BD28BD6-BA63-46C5-B73B-E8D9D201C27B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe
FirewallRules: [{43DB0EB0-B7B5-496A-9855-2769D2A28C14}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe
FirewallRules: [{B9BAAC3F-39BE-47CE-9875-630927065E43}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{94D96EB3-BE19-43BE-9FEE-D5C9B6BA9C92}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe
FirewallRules: [TCP Query User{56D004BD-DEE0-41AD-92EF-A9913B30E691}C:\users\snickersmom\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\snickersmom\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{7D1B1C3D-7799-4EA8-B8B5-897217FDF5CE}C:\users\snickersmom\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\snickersmom\appdata\roaming\spotify\spotify.exe
FirewallRules: [{17DB8744-9FE6-4032-AE7D-968AE6605B68}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Restore Points =========================
 
05-01-2016 18:19:34 Windows Update
06-01-2016 15:56:07 Reimage Express Restore Point
08-01-2016 04:48:55 Windows Modules Installer
13-01-2016 13:33:26 Windows Update
13-01-2016 13:34:27 Windows Update
14-01-2016 21:38:31 Removed Coupons at Checkout
16-01-2016 15:45:44 zoek.exe restore point
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (01/16/2016 04:03:07 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/16/2016 03:59:54 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/16/2016 03:49:00 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/16/2016 03:48:07 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/16/2016 03:45:47 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
 
System Error:
Access is denied.
.
 
Error: (01/16/2016 03:44:54 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/16/2016 03:44:54 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/16/2016 03:39:13 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/16/2016 03:33:07 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!ppleae38af2e007f4358a809ac99a64a67c1 failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/16/2016 03:33:07 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SNICKERSMOM-PC)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
 
System errors:
=============
Error: (01/16/2016 03:43:12 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/16/2016 03:43:10 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/16/2016 03:41:55 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/16/2016 03:41:52 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
Error: (01/15/2016 09:54:53 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/15/2016 09:52:54 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/15/2016 09:43:46 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/15/2016 05:53:23 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4
 
Error: (01/15/2016 02:19:50 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
Error: (01/15/2016 02:17:50 PM) (Source: DCOM) (EventID: 10010) (User: SNICKERSMOM-PC)
Description: NLInternal.SharedRecoActivation
 
 
CodeIntegrity:
===================================
  Date: 2016-01-14 22:04:19.164
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-08 16:49:30.905
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-05 23:22:49.197
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-05 22:46:45.593
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-01 04:30:05.168
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-01 04:26:31.616
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-01 03:59:56.320
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: AMD A6-3600 APU with Radeon™ HD Graphics
Percentage of memory in use: 56%
Total physical RAM: 5625.98 MB
Available physical RAM: 2427.89 MB
Total Virtual: 11257.98 MB
Available Virtual: 6642.41 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:440.15 GB) (Free:354.73 GB) NTFS
Drive e: () (Removable) (Total:14.9 GB) (Free:14.48 GB) FAT32
Drive f: () (Removable) (Total:3.76 GB) (Free:3.66 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 6F471639)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=440.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
Partition 4: (Not Active) - (Size=25.1 GB) - (Type=12)
 
========================================================
Disk: 1 (Size: 3.8 GB) (Disk ID: 04DD5721)
Partition 1: (Not Active) - (Size=3.8 GB) - (Type=0C)
 
========================================================
Disk: 2 (Size: 14.9 GB) (Disk ID: 6F20736B)
No partition Table on disk 2.
Disk 2 is a removable device.
 
==================== End of Addition.txt ============================


#15 loki2007

loki2007

  • Members
  • 551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Hampshire
  • Local time:02:50 PM

Posted 17 January 2016 - 10:13 AM

Hi Again,
 
Thanks for those logs. Are you familiar with AntiVirus5 and did you install this on your system? I suspect it may have come with System Mechanic at some point? Windows Defender might be a better option if you are not happy with this product or there are other free options that could work better for you. Also I see your AV and Spyware protection is disabled. If you did this before you ran Zoek for me you can now enable them again. And I assume you will want Chrome reinstalled? If so we will do that after you complete these steps. Please follow the steps below in order and report back with any questions or issues.
 
 
Step 1:
 
We need to run a fix with FRST:

  • Please download the attached fixlist.txt file and save it to the same location as FRST
    Note: It's important that both files, FRST64.exe and fixlist.txt are in the same location or the fix will not work
    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system!
    Attached File  fixlist.txt   13.45KB   10 downloads
  • Run FRST64.exe and press the Fix button just once and wait
  • If for some reason the tool needs a restart, please make sure you let the system restart normally, then let the tool complete its run
  • When finished, FRST will generate a log (Fixlog.txt) in the same location the tool was run, please copy and paste your results to your reply.

 

Step 2:
 
We need to run a Command
 
Please do the following to kill any running Chrome processes:

  • Press the Windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type cmd and press Enter
  • Copy and Paste the following script into the command prompt:
    taskkill /IM chrome.exe /F 
  • Depending on if Windows found any processes running or not you will either get an ERROR message (The process "chrome.exe" not found) or a SUCCESS message (The process "chrome.exe" with PID #### has been terminated.)
  • Close the command window

 

Step 3:
 
Uninstalling a Program using Add/Remove Program

--------------------

I would recommend that you uninstall the program(s) listed below.Please report back if any of these programs would not uninstall.

  • Press the Windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type appwiz.cpl and press Enter
  • A list of installed programs will be displayed
  • Uninstall the following by clicking on the program(s) below (and any other similar names) and selecting Remove or Uninstall

  • Google Chrome

    Itibiti RTC

     

  • Reboot your computer

Please report back if any of these programs would not uninstall.
 
 
Step 4:
 
Please do another scan with FRST (be sure to select the Addition box under Optional Scan) and copy and paste both FRST.txt and Addition.txt to your next reply.
 
 
Please remember to copy and paste the log files to your reply. How is your computer running? As always if you have any issues or questions please don't hesitate to reply back to this thread. Thanks,
 
loki


 
Member of the Bleeping Computer A.I.I. early response team!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users