Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Firefox and IE randomly slow


  • This topic is locked This topic is locked
20 replies to this topic

#1 McGonzo

McGonzo

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:04:07 PM

Posted 27 February 2016 - 04:08 PM

Both Firefox and especially IE are slow.  Reset FF, worked fine.  Then it didn't any more.  Reset it again, same problems.  Other systems run fine on same network.  Farber Recovery Scan Tool logs attached.  Also have a Hijack This! log.  I'll run any logs you guys ask for, just let me know.
 
Thanks in advance for any help.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:27-02-2016
Ran by G.S (administrator) on DEATHSTAR (27-02-2016 15:56:13)
Running from C:\Users\G.S\AppData\Local\Microsoft\Windows\INetCache\IE\XSDD8RYK
Loaded Profiles: G.S (Available Profiles: G.S)
Platform: Windows 8.1 Pro N (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Program Files (x86)\Polar\Daemon\polard.exe
(SanDisk Corporation) C:\Program Files (x86)\SanDisk\SSD Dashboard\SanDiskSSDDashboardService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\vmms.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\CSISYNCCLIENT.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSYNC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
() C:\Program Files (x86)\Polar\WebSync\WebSync.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1804432 2015-09-19] (NVIDIA Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2720144 2015-08-09] (Dominik Reichl)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\Run: [Google Update] => C:\Users\G.S\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-10-04] (Google Inc.)
HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3014224 2016-02-04] (Valve Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Polar WebSync.lnk [2015-11-06]
ShortcutTarget: Polar WebSync.lnk -> C:\Program Files (x86)\Polar\WebSync\WebSync.exe ()
Startup: C:\Users\G.S\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2016-02-27]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{91524DD3-B028-4F46-9393-28A8E021C6CE}: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{D408CC65-2AD6-4485-8063-C8767B1DD21F}: [NameServer] 8.8.4.4,8.8.8.8
Tcpip\..\Interfaces\{D408CC65-2AD6-4485-8063-C8767B1DD21F}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-02-04] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-02-04] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-02-04] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-02-04] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001 -> No Name - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - No File
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-02-04] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-02-04] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-02-04] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-02-04] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\G.S\AppData\Roaming\Mozilla\Firefox\Profiles\xq9j3auj.default-1456604363342
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-10] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-10] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-02-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-02-04] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-25] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-25] (NVIDIA Corporation)
FF Plugin HKU\S-1-5-21-4017012110-1709071101-1196858752-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\G.S\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-4017012110-1709071101-1196858752-1001: @talk.google.com/O1DPlugin -> C:\Users\G.S\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-4017012110-1709071101-1196858752-1001: @tools.google.com/Google Update;version=3 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-01-28] (Google Inc.)
FF Plugin HKU\S-1-5-21-4017012110-1709071101-1196858752-1001: @tools.google.com/Google Update;version=9 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-01-28] (Google Inc.)
FF Plugin HKU\S-1-5-21-4017012110-1709071101-1196858752-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-12-02] ()
FF Plugin ProgramFiles/Appdata: C:\Users\G.S\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\G.S\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Extension: NoScript - C:\Users\G.S\AppData\Roaming\Mozilla\Firefox\Profiles\xq9j3auj.default-1456604363342\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-02-27]
FF Extension: WOT - C:\Users\G.S\AppData\Roaming\Mozilla\Firefox\Profiles\xq9j3auj.default-1456604363342\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-02-27]
FF Extension: Adblock Plus - C:\Users\G.S\AppData\Roaming\Mozilla\Firefox\Profiles\xq9j3auj.default-1456604363342\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-02-27]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2804976 2016-02-04] (Microsoft Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IpOverUsbSvc; C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe [21744 2015-07-09] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 Mezzmo; F:\Program Files (x86)\Conceiva\Mezzmo\MezzmoMediaServer.exe [5645056 2014-12-07] (Conceiva Pty. Ltd.)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2015-10-13] ()
R2 Polar Daemon; C:\Program Files (x86)\Polar\Daemon\polard.exe [419536 2012-12-12] ()
R2 SanDisk SSD Dashboard Service; C:\Program Files (x86)\SanDisk\SSD Dashboard\SanDiskSSDDashboardService.exe [374784 2015-05-14] (SanDisk Corporation) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 Te.Service; C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\Wex.Services.exe [134656 2015-07-09] (Microsoft Corporation) [File not signed]
R2 vmms; C:\Windows\system32\vmms.exe [13784064 2015-03-31] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R1 hvservice; C:\Windows\System32\drivers\hvservice.sys [68952 2015-05-11] (Microsoft Corporation)
S3 lunparser; C:\Windows\System32\drivers\lunparser.sys [19456 2015-10-23] (Microsoft Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-02-27] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
S3 passthruparser; C:\Windows\System32\drivers\passthruparser.sys [22016 2015-10-23] (Microsoft Corporation)
S3 pvhdparser; C:\Windows\System32\drivers\pvhdparser.sys [27136 2015-10-23] (Microsoft Corporation)
S3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [226304 2014-11-21] (Microsoft Corporation)
S3 vhdparser; C:\Windows\System32\drivers\vhdparser.sys [18944 2015-10-23] (Microsoft Corporation)
R3 VMSMP; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2015-08-05] (Microsoft Corporation)
S3 VMSP; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2015-08-05] (Microsoft Corporation)
S3 VMSVSF; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2015-08-05] (Microsoft Corporation)
S3 VMSVSP; C:\Windows\system32\DRIVERS\vmswitch.sys [689152 2015-08-05] (Microsoft Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-27 15:55 - 2016-02-27 15:56 - 00000000 ____D C:\FRST
2016-02-27 15:32 - 2016-02-27 15:32 - 22908888 _____ (Malwarebytes ) C:\Users\G.S\Downloads\mbam-setup-2.2.0.1024.exe
2016-02-27 15:25 - 2016-02-27 15:25 - 00388608 _____ (Trend Micro Inc.) C:\Users\G.S\Downloads\HijackThis.exe
2016-02-26 07:02 - 2016-02-07 13:44 - 00450954 ____R C:\Windows\system32\Drivers\etc\hosts.20160226-070258.backup
2016-02-26 06:56 - 2016-02-26 06:56 - 00001407 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2016-02-26 06:56 - 2016-02-26 06:56 - 00001395 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2016-02-26 06:56 - 2016-02-26 06:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2016-02-26 06:56 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2016-02-25 22:53 - 2016-02-27 15:19 - 00000000 ____D C:\Users\G.S\Desktop\Old Firefox Data
2016-02-24 07:55 - 2016-02-24 07:55 - 00027582 _____ C:\ProgramData\1456318524.bdinstall.bin
2016-02-24 07:53 - 2016-02-24 07:53 - 00236858 _____ C:\ProgramData\1456318321.bdinstall.bin
2016-02-19 17:49 - 2016-01-24 13:19 - 00419160 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2016-02-19 17:49 - 2016-01-24 13:19 - 00378712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2016-02-19 17:49 - 2016-01-24 13:19 - 00331608 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2016-02-19 17:49 - 2016-01-24 06:57 - 01335296 _____ (Microsoft Corporation) C:\Windows\system32\mispace.dll
2016-02-19 17:49 - 2016-01-24 06:45 - 01063424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mispace.dll
2016-02-19 17:49 - 2016-01-15 11:56 - 02487296 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2016-02-19 17:49 - 2016-01-15 11:45 - 01482240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2016-02-19 17:49 - 2016-01-10 11:41 - 01707008 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2016-02-19 17:49 - 2016-01-10 11:31 - 01344512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comsvcs.dll
2016-02-19 17:49 - 2016-01-08 20:49 - 00218448 _____ (Microsoft Corporation) C:\Windows\system32\rsaenh.dll
2016-02-19 17:49 - 2016-01-08 20:49 - 00192120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rsaenh.dll
2016-02-19 17:49 - 2016-01-08 20:38 - 00091992 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2016-02-19 17:49 - 2016-01-06 18:46 - 00148752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscapi.dll
2016-02-19 17:49 - 2016-01-06 18:45 - 00177712 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll
2016-02-19 17:49 - 2016-01-06 13:25 - 00416768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-02-19 17:49 - 2016-01-06 11:47 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\wscsvc.dll
2016-02-19 17:49 - 2016-01-05 10:00 - 00570880 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2016-02-19 17:49 - 2015-12-30 16:53 - 02017624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2016-02-19 17:49 - 2015-12-30 15:49 - 00470360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2016-02-19 17:49 - 2015-12-20 09:57 - 00839168 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2016-02-19 17:49 - 2015-12-20 09:56 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\msra.exe
2016-02-19 17:49 - 2015-12-20 09:43 - 00696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
2016-02-19 17:49 - 2015-11-19 09:33 - 00994760 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-02-19 17:49 - 2015-11-19 09:26 - 00922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2016-02-17 11:24 - 2016-02-17 11:24 - 00000948 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-02-17 11:24 - 2016-02-17 11:24 - 00000936 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-02-17 11:24 - 2016-02-17 11:24 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-02-17 11:24 - 2016-02-17 11:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-02-13 12:53 - 2016-01-22 03:01 - 22365992 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-02-13 12:53 - 2016-01-22 02:11 - 19794896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-02-13 12:53 - 2016-01-22 00:25 - 14467072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2016-02-13 12:53 - 2016-01-22 00:14 - 12879360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2016-02-13 12:53 - 2016-01-22 00:07 - 02778624 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-02-13 12:53 - 2016-01-21 23:58 - 02464256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-02-13 12:53 - 2016-01-14 20:42 - 00033472 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-02-13 12:53 - 2016-01-14 15:44 - 01362944 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-02-13 12:53 - 2016-01-14 15:44 - 01162240 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-02-13 12:53 - 2016-01-14 15:44 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-02-13 12:53 - 2016-01-14 15:44 - 00677376 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-02-13 12:53 - 2016-01-14 15:44 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-02-13 12:53 - 2016-01-14 15:44 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-02-13 12:53 - 2016-01-10 14:37 - 00442720 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-02-13 12:53 - 2016-01-10 14:37 - 00136912 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-02-13 12:53 - 2016-01-10 13:39 - 00332640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-02-13 12:53 - 2016-01-10 13:15 - 00401920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-02-13 12:53 - 2016-01-10 13:15 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-02-13 12:53 - 2016-01-10 12:43 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-02-13 12:53 - 2016-01-10 12:09 - 01442304 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-02-13 12:53 - 2016-01-10 12:09 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-02-13 12:53 - 2016-01-10 11:56 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2016-02-13 12:53 - 2016-01-10 11:51 - 03707392 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-02-13 12:53 - 2016-01-10 11:39 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-02-13 12:53 - 2016-01-10 11:38 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-02-13 12:53 - 2016-01-10 11:36 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2016-02-13 12:53 - 2016-01-10 11:36 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-02-13 12:53 - 2016-01-10 11:35 - 02243584 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-02-13 12:53 - 2016-01-10 11:35 - 00897024 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-02-13 12:53 - 2016-01-10 11:29 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2016-02-13 12:53 - 2016-01-10 11:29 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2016-02-13 12:53 - 2016-01-10 11:27 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2016-02-13 12:53 - 2016-01-10 11:26 - 00726528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2016-02-13 12:53 - 2015-12-16 12:11 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2016-02-13 12:53 - 2015-12-16 11:51 - 00868864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2016-02-13 12:53 - 2015-04-30 20:13 - 06521800 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2016-02-13 12:53 - 2015-04-30 20:13 - 01488000 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2016-02-13 12:53 - 2015-04-30 20:13 - 00261376 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2016-02-13 12:53 - 2015-01-05 22:01 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2016-02-13 12:53 - 2015-01-05 21:59 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2016-02-13 12:53 - 2015-01-05 20:12 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2016-02-13 12:53 - 2015-01-05 20:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2016-02-13 12:53 - 2014-11-17 15:17 - 00672984 _____ (Microsoft Corporation) C:\Windows\system32\MDMAgent.exe
2016-02-13 12:53 - 2014-11-17 15:17 - 00273240 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2016-02-13 12:53 - 2014-11-15 14:05 - 00801584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2016-02-13 12:53 - 2014-11-15 01:29 - 00962216 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2016-02-13 12:53 - 2014-11-14 01:57 - 01027584 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2016-02-13 12:53 - 2014-11-14 01:54 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.Handlers.dll
2016-02-13 12:53 - 2014-11-14 01:46 - 02171904 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlowUI.dll
2016-02-13 12:53 - 2014-11-14 00:03 - 00885760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2016-02-13 12:53 - 2014-11-09 21:57 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\agilevpn.sys
2016-02-13 12:53 - 2014-11-09 20:20 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vpnike.dll
2016-02-13 12:53 - 2014-11-09 20:08 - 00702464 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
2016-02-13 12:53 - 2014-11-09 19:57 - 00624640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasapi32.dll
2016-02-13 12:53 - 2014-11-07 23:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2016-02-13 12:53 - 2014-11-07 22:58 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rasl2tp.sys
2016-02-13 12:53 - 2014-11-07 22:56 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2016-02-13 12:53 - 2014-11-07 22:56 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2016-02-13 12:53 - 2014-11-07 22:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2016-02-13 12:53 - 2014-11-07 22:24 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2016-02-13 12:53 - 2014-11-07 22:13 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2016-02-13 12:53 - 2014-11-07 22:13 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2016-02-13 12:53 - 2014-11-07 22:13 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2016-02-13 12:53 - 2014-11-07 21:48 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2016-02-13 12:53 - 2014-11-07 21:38 - 00166912 _____ (Microsoft Corporation) C:\Windows\system32\AppxAllUserStore.dll
2016-02-13 12:53 - 2014-11-07 21:17 - 00143360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxAllUserStore.dll
2016-02-13 12:53 - 2014-11-07 21:03 - 00733696 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll
2016-02-13 12:53 - 2014-11-07 20:58 - 04837376 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll
2016-02-13 12:53 - 2014-11-07 20:49 - 01154048 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe
2016-02-13 12:53 - 2014-11-06 22:58 - 00952896 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2016-02-13 12:53 - 2014-11-06 22:20 - 00786120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2016-02-13 12:53 - 2014-11-04 21:12 - 00211968 _____ (Microsoft Corporation) C:\Windows\system32\QSHVHOST.DLL
2016-02-13 12:53 - 2014-11-04 21:12 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\QSVRMGMT.DLL
2016-02-13 12:53 - 2014-11-04 21:06 - 00514048 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairing.dll
2016-02-13 12:53 - 2014-11-04 20:44 - 00657920 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2016-02-13 12:53 - 2014-11-04 20:43 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2016-02-13 12:53 - 2014-11-04 20:39 - 00155648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSHVHOST.DLL
2016-02-13 12:53 - 2014-11-04 20:39 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSVRMGMT.DLL
2016-02-13 12:53 - 2014-11-04 20:33 - 00465408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DevicePairing.dll
2016-02-13 12:53 - 2014-11-04 20:21 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2016-02-13 12:53 - 2014-11-04 20:20 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2016-02-13 12:53 - 2014-11-04 20:14 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\WSDMon.dll
2016-02-13 12:53 - 2014-11-04 20:06 - 00555520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2016-02-13 12:53 - 2014-11-04 14:33 - 00058176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dam.sys
2016-02-13 12:53 - 2014-11-04 01:27 - 00128512 _____ (Microsoft Corporation) C:\Windows\splwow64.exe
2016-02-13 12:53 - 2014-11-04 00:01 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2016-02-13 12:53 - 2014-10-28 22:05 - 00551232 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2016-02-13 12:53 - 2014-10-28 20:55 - 00242176 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2016-02-13 12:53 - 2014-10-28 20:13 - 00169984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2016-02-13 12:53 - 2014-10-20 20:59 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\eventcls.dll
2016-02-13 12:53 - 2014-10-20 20:19 - 00015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eventcls.dll
2016-02-13 12:53 - 2014-10-20 19:50 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\vsstrace.dll
2016-02-13 12:53 - 2014-10-20 19:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\vssapi.dll
2016-02-13 12:53 - 2014-10-20 19:31 - 00055296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vsstrace.dll
2016-02-13 12:53 - 2014-10-20 19:30 - 01454080 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2016-02-13 12:53 - 2014-10-20 19:20 - 01142272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vssapi.dll
2016-02-13 12:53 - 2014-10-16 23:56 - 00039744 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\intelpep.sys
2016-02-13 12:53 - 2014-10-16 22:35 - 00086336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pdc.sys
2016-02-13 12:51 - 2016-02-13 12:51 - 00000000 ____D C:\Users\G.S\AppData\Temp
2016-02-13 12:40 - 2016-02-06 05:48 - 25839104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-02-13 12:40 - 2016-02-06 05:24 - 02887680 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-02-13 12:40 - 2016-02-06 05:01 - 20366848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-02-13 12:40 - 2016-02-06 04:43 - 02280448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-02-13 12:40 - 2016-02-06 04:32 - 14458368 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-02-13 12:40 - 2016-02-06 04:16 - 12857856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-02-13 12:40 - 2016-02-06 04:09 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-02-13 12:40 - 2016-02-06 03:54 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-02-13 12:40 - 2016-01-19 14:14 - 07453024 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-02-13 12:40 - 2016-01-19 14:13 - 02175008 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2016-02-13 12:40 - 2016-01-19 14:13 - 01063464 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll
2016-02-13 12:40 - 2016-01-19 14:12 - 01737088 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-02-13 12:40 - 2016-01-19 14:12 - 01133744 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-02-13 12:40 - 2016-01-19 13:23 - 01564496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2016-02-13 12:40 - 2016-01-19 13:23 - 01501496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-02-13 12:40 - 2016-01-19 13:23 - 00548024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll
2016-02-13 12:40 - 2016-01-19 13:15 - 00246784 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2016-02-13 12:40 - 2016-01-19 12:30 - 00862720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-02-13 12:40 - 2016-01-19 11:37 - 00267776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincorlib.dll
2016-02-13 12:40 - 2016-01-10 12:50 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\cfgbkend.dll
2016-02-13 12:40 - 2016-01-10 12:31 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2016-02-13 12:40 - 2016-01-10 12:16 - 00898048 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
2016-02-13 12:40 - 2016-01-10 12:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cfgbkend.dll
2016-02-13 12:40 - 2016-01-10 12:12 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2016-02-13 12:40 - 2016-01-10 12:02 - 00987648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-02-13 12:40 - 2016-01-10 11:58 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll
2016-02-13 12:40 - 2016-01-10 11:51 - 00702976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CPFilters.dll
2016-02-13 12:40 - 2016-01-10 11:49 - 00443392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
2016-02-13 12:40 - 2016-01-10 11:43 - 00801792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-02-13 12:40 - 2016-01-10 11:40 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxoci.dll
2016-02-13 12:40 - 2016-01-07 13:34 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-02-13 12:40 - 2016-01-06 13:25 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2016-02-13 12:40 - 2015-12-29 10:45 - 07783936 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2016-02-13 12:40 - 2015-12-29 10:45 - 07075328 _____ (Microsoft Corporation) C:\Windows\system32\glcndFilter.dll
2016-02-13 12:40 - 2015-12-29 10:43 - 05267968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\glcndFilter.dll
2016-02-13 12:40 - 2015-12-29 10:42 - 05264384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2016-02-13 12:39 - 2016-01-22 01:40 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-02-13 12:39 - 2016-01-22 01:29 - 06052352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-02-13 12:39 - 2016-01-22 01:28 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2016-02-13 12:39 - 2016-01-22 01:27 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-02-13 12:39 - 2016-01-22 01:02 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-02-13 12:39 - 2016-01-22 00:55 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-02-13 12:39 - 2016-01-22 00:52 - 00099328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2016-02-13 12:39 - 2016-01-22 00:51 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-02-13 12:39 - 2016-01-22 00:50 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-02-13 12:39 - 2016-01-22 00:48 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-02-13 12:39 - 2016-01-22 00:48 - 00372224 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-02-13 12:39 - 2016-01-22 00:47 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-02-13 12:39 - 2016-01-22 00:46 - 02123264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-02-13 12:39 - 2016-01-22 00:35 - 04611072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-02-13 12:39 - 2016-01-22 00:31 - 02597376 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-02-13 12:39 - 2016-01-22 00:31 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-02-13 12:39 - 2016-01-22 00:28 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2016-02-13 12:39 - 2016-01-22 00:27 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-02-13 12:39 - 2016-01-22 00:25 - 00687104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-02-13 12:39 - 2016-01-22 00:25 - 00325632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-02-13 12:39 - 2016-01-22 00:24 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-02-13 12:39 - 2016-01-22 00:08 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-02-13 12:39 - 2016-01-22 00:07 - 02120704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-02-13 12:39 - 2016-01-22 00:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-02-13 12:39 - 2015-12-28 16:42 - 00713216 _____ (Microsoft Corporation) C:\Windows\system32\WinSync.dll
2016-02-13 12:39 - 2015-12-28 15:31 - 00578048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSync.dll
2016-02-13 12:39 - 2015-12-17 13:29 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2016-02-13 12:39 - 2015-12-17 11:17 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2016-02-13 12:25 - 2016-02-13 12:25 - 00000385 _____ C:\Windows\system32\user_gensett.xml
2016-02-13 12:25 - 2016-02-13 12:25 - 00000385 _____ C:\Users\G.S\AppData\Roaminguser_gensett.xml
2016-02-13 12:24 - 2016-02-13 12:24 - 00000000 ____D C:\Users\G.S\AppData\Roaming\QuickScan
2016-02-13 12:24 - 2016-02-13 12:24 - 00000000 ____D C:\ProgramData\BDLogging
2016-02-13 12:24 - 2007-04-11 10:11 - 00511328 _____ (Microsoft Corporation) C:\Windows\capicom.dll
2016-02-13 12:18 - 2016-02-13 12:18 - 00007597 _____ C:\Users\G.S\AppData\Local\Resmon.ResmonCfg
2016-02-13 12:16 - 2016-02-13 12:16 - 00000085 _____ C:\Windows\wininit.ini
2016-02-13 12:16 - 2016-02-13 12:16 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2016-02-13 12:14 - 2016-02-13 12:14 - 09736920 _____ C:\Users\G.S\Downloads\bitdefender_tsecurity.exe
2016-02-13 12:14 - 2016-02-13 12:14 - 00000000 ____D C:\ProgramData\Bitdefender Agent
2016-02-13 09:56 - 2016-02-27 15:33 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-02-13 09:56 - 2016-02-27 15:32 - 00001118 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-02-13 09:56 - 2016-02-27 15:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-02-13 09:56 - 2016-02-27 15:32 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-02-13 09:56 - 2016-02-13 09:56 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-02-13 09:56 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-02-13 09:56 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-02-13 09:56 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-02-13 09:34 - 2016-02-13 09:34 - 44088720 _____ C:\Users\G.S\Downloads\torbrowser-install-5.5.2_en-US.exe
2016-02-13 09:34 - 2016-02-13 09:34 - 00000836 _____ C:\Users\G.S\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk
2016-02-13 09:34 - 2016-02-13 09:34 - 00000788 _____ C:\Users\G.S\Desktop\Start Tor Browser.lnk
2016-02-13 09:34 - 2016-02-13 09:34 - 00000000 ____D C:\Users\G.S\Desktop\Tor Browser
2016-02-07 13:44 - 2015-10-04 17:14 - 00450771 ____R C:\Windows\system32\Drivers\etc\hosts.20160207-134445.backup
2016-02-04 23:11 - 2016-02-04 23:11 - 00000519 _____ C:\Users\G.S\Desktop\washdryer.txt
2016-01-31 19:48 - 2016-01-31 19:48 - 00000000 ____D C:\Program Files\FLAC Property Handler
2016-01-31 19:47 - 2016-01-31 19:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2016-01-31 19:47 - 2016-01-31 19:47 - 00000000 ____D C:\Program Files\7-Zip
2016-01-31 19:17 - 2016-01-31 19:17 - 00000000 ____D C:\Program Files (x86)\WMP Tag Plus

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-27 15:49 - 2015-10-04 14:41 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{815827D3-14F0-47FD-BF68-28B59D113193}
2016-02-27 15:38 - 2015-10-04 14:40 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4017012110-1709071101-1196858752-1001
2016-02-27 15:35 - 2015-10-04 17:20 - 00000920 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4017012110-1709071101-1196858752-1001UA.job
2016-02-27 15:25 - 2015-10-04 14:34 - 00000000 ____D C:\Users\G.S\AppData\Local\VirtualStore
2016-02-27 15:24 - 2015-12-18 12:58 - 00000000 ____D C:\AdwCleaner
2016-02-27 14:35 - 2015-10-04 17:20 - 00000868 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4017012110-1709071101-1196858752-1001Core.job
2016-02-27 09:12 - 2015-10-06 20:43 - 00000000 ____D C:\Program Files (x86)\Steam
2016-02-27 09:12 - 2015-10-04 14:38 - 00000000 ___DO C:\Users\G.S\OneDrive
2016-02-27 00:58 - 2015-12-30 17:05 - 00000000 ____D C:\Users\G.S\AppData\Local\Battle.net
2016-02-26 18:48 - 2015-12-30 17:05 - 00000000 ____D C:\Program Files (x86)\Battle.net
2016-02-26 17:41 - 2015-10-19 18:12 - 00000043 _____ C:\Windows\MezzmoMediaServer.INI
2016-02-26 08:12 - 2013-08-22 08:36 - 00000000 ____D C:\Windows\Inf
2016-02-26 07:16 - 2015-10-23 17:04 - 27590656 _____ C:\Windows\system32\vmguest.iso
2016-02-26 06:59 - 2015-10-04 16:57 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-02-26 06:56 - 2015-10-04 16:57 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-02-26 06:55 - 2014-11-20 23:38 - 00863596 _____ C:\Windows\system32\PerfStringBackup.INI
2016-02-26 06:49 - 2015-10-04 14:43 - 00000000 ____D C:\ProgramData\NVIDIA
2016-02-26 06:49 - 2013-08-22 09:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-02-26 06:48 - 2013-08-22 08:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-02-25 19:55 - 2016-01-08 08:59 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2016-02-25 19:55 - 2016-01-08 08:59 - 00000000 ___SD C:\Windows\system32\GWX
2016-02-25 19:55 - 2013-08-22 10:20 - 00000000 ____D C:\Windows\CbsTemp
2016-02-24 19:05 - 2015-10-14 17:26 - 00000000 ____D C:\Users\G.S\AppData\Roaming\5kplayer
2016-02-24 17:54 - 2015-10-04 17:30 - 00000000 ____D C:\Users\G.S\AppData\Roaming\KeePass
2016-02-24 13:01 - 2015-11-09 07:14 - 00000000 ____D C:\Users\G.S\AppData\Local\Microsoft Help
2016-02-24 07:54 - 2013-08-22 10:36 - 00000000 ____D C:\Windows\ELAMBKUP
2016-02-24 07:51 - 2015-11-29 08:18 - 00000000 ____D C:\Users\G.S\Documents\Visual Studio 2015
2016-02-23 19:58 - 2013-08-22 10:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-02-23 19:57 - 2015-10-04 16:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2016-02-23 19:38 - 2013-08-22 08:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2016-02-21 13:01 - 2013-08-22 10:36 - 00000000 ____D C:\Windows\rescache
2016-02-20 16:15 - 2016-01-27 00:39 - 00000485 _____ C:\Users\G.S\Desktop\toget.txt
2016-02-14 12:42 - 2015-10-04 22:05 - 00000000 ____D C:\Windows\Minidump
2016-02-14 12:42 - 2013-08-22 10:36 - 00000000 ___SD C:\Windows\Downloaded Program Files
2016-02-14 12:42 - 2013-08-22 10:36 - 00000000 ___RD C:\Windows\Offline Web Pages
2016-02-13 13:35 - 2013-08-22 09:44 - 00476240 _____ C:\Windows\system32\FNTCACHE.DAT
2016-02-13 13:01 - 2013-08-22 10:36 - 00000000 ___RD C:\Windows\ToastData
2016-02-13 13:01 - 2013-08-22 10:36 - 00000000 ____D C:\Windows\SysWOW64\setup
2016-02-13 13:01 - 2013-08-22 10:36 - 00000000 ____D C:\Windows\system32\setup
2016-02-13 12:54 - 2016-01-08 08:59 - 00000000 ____D C:\Windows\system32\appraiser
2016-02-13 12:54 - 2014-11-21 06:33 - 00000000 ___SD C:\Windows\system32\CompatTel
2016-02-13 12:53 - 2015-11-12 18:43 - 00561952 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-02-13 12:53 - 2015-11-12 18:43 - 00177496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-02-13 12:42 - 2015-10-04 14:44 - 00000000 ____D C:\Windows\system32\MRT
2016-02-13 12:42 - 2014-11-20 23:21 - 00000000 ____D C:\Program Files\Windows Journal
2016-02-13 12:40 - 2015-12-01 00:28 - 00993632 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2016-02-13 12:40 - 2015-12-01 00:28 - 00987848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2016-02-13 12:40 - 2015-10-04 14:44 - 146614896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-02-11 19:17 - 2015-10-29 08:42 - 00002232 ____H C:\Users\G.S\Documents\Default.rdp
2016-02-11 19:17 - 2013-08-22 10:36 - 00000000 ____D C:\Windows\system32\FxsTmp
2016-02-11 02:52 - 2015-10-04 16:38 - 00003094 _____ C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-4017012110-1709071101-1196858752-1001
2016-02-09 22:08 - 2013-08-22 10:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-02-09 22:08 - 2013-08-22 10:36 - 00000000 ____D C:\Windows\AppReadiness
2016-02-02 18:19 - 2015-12-30 17:06 - 00000000 ____D C:\Program Files (x86)\Diablo III
2016-02-01 21:37 - 2016-01-08 09:02 - 00828920 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-02-01 21:37 - 2016-01-08 09:02 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-01-28 14:30 - 2015-10-04 17:20 - 00003862 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4017012110-1709071101-1196858752-1001UA
2016-01-28 14:30 - 2015-10-04 17:20 - 00003482 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4017012110-1709071101-1196858752-1001Core

==================== Files in the root of some directories =======

2015-12-21 17:38 - 2015-12-21 17:38 - 0000320 _____ () C:\Users\G.S\AppData\Roaming\SEC2775906.trad
2016-02-13 12:18 - 2016-02-13 12:18 - 0007597 _____ () C:\Users\G.S\AppData\Local\Resmon.ResmonCfg
2016-02-24 07:53 - 2016-02-24 07:53 - 0236858 _____ () C:\ProgramData\1456318321.bdinstall.bin
2016-02-24 07:55 - 2016-02-24 07:55 - 0027582 _____ () C:\ProgramData\1456318524.bdinstall.bin
2015-05-22 09:11 - 2015-05-22 09:11 - 0010266 _____ () C:\ProgramData\regid.2015-05.exe.textpad_83F5EF12-C2F9-4C11-A5C5-57A7B2D7AD25.swidtag

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-02-27 10:57

==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version:27-02-2016
Ran by G.S (2016-02-27 15:56:26)
Running from C:\Users\G.S\AppData\Local\Microsoft\Windows\INetCache\IE\XSDD8RYK
Windows 8.1 Pro N (X64) (2015-10-04 19:34:43)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-4017012110-1709071101-1196858752-500 - Administrator - Disabled)
G.S (S-1-5-21-4017012110-1709071101-1196858752-1001 - Administrator - Enabled) => C:\Users\G.S
Guest (S-1-5-21-4017012110-1709071101-1196858752-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4017012110-1709071101-1196858752-1003 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

5KPlayer 3.1 (HKLM-x32\...\5KPlayer_is1) (Version: - DearMob, Inc.)
7-Zip 15.14 (x64) (HKLM\...\7-Zip) (Version: 15.14 - Igor Pavlov)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated)
Age of Empires III - The Asian Dynasties (HKLM-x32\...\InstallShield_{C43C1415-3DFC-4089-9A32-0BECF28A6046}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III - The Asian Dynasties (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Empires III - The WarChiefs (HKLM-x32\...\InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III - The WarChiefs (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Empires III (HKLM-x32\...\InstallShield_{70F8B183-99EB-4304-BA35-080E2DFFD2A3}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
Entity Framework 6.1.3 Tools for Visual Studio 2015 (HKLM-x32\...\{1A8A9739-BAD7-491F-B5B9-A79A2B965422}) (Version: 14.0.40302.0 - Microsoft Corporation)
Far Cry® 3 (HKLM-x32\...\Steam App 220240) (Version: - Ubisoft Montreal, Massive Entertainment, and Ubisoft Shanghai)
FLAC Property Handler 1.0 (x64) (HKLM\...\{2B576818-7A57-49C8-BB58-E34AA2F7766F}) (Version: 1.0.0.31 - AJD)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.2.8.1124 - Foxit Software Inc.)
Google Talk Plugin (HKLM-x32\...\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)
Intellisense Lang Pack Mobile Extension SDK 10.0.10240.0 (x32 Version: 10.0.10240.0 - Microsoft Corporation) Hidden
KeePass Password Safe 2.30 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.30 - Dominik Reichl)
Kits Configuration Installer (x32 Version: 10.0.26624 - Microsoft) Hidden
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Mezzmo (HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\Mezzmo) (Version: 4.1.3.0 - Conceiva Pty. Ltd.)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU) (HKLM-x32\...\{D3517C62-68A5-37CF-92F7-93C029A89681}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (ENU) (HKLM-x32\...\{290FC320-2F5A-329E-8840-C4193BD7A9EE}) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (HKLM-x32\...\{B941AFB4-8851-33A1-9E72-0C33D463C41C}) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.6 SDK (HKLM-x32\...\{B5915D37-0637-4A26-A3AA-C5DC9F856370}) (Version: 4.6.00081 - Microsoft Corporation)
Microsoft .NET Framework 4.6 Targeting Pack (ENU) (HKLM-x32\...\{3D3CEBE6-40EA-4C48-97FD-73828281AB4A}) (Version: 4.6.00081 - Microsoft Corporation)
Microsoft .NET Framework 4.6 Targeting Pack (HKLM-x32\...\{2CC6A4A7-AAC2-46C9-9DBB-3727B5954F65}) (Version: 4.6.00081 - Microsoft Corporation)
Microsoft Help Viewer 2.2 (HKLM-x32\...\Microsoft Help Viewer 2.2) (Version: 2.2.23107 - Microsoft Corporation)
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2016 - en-us (HKLM\...\ProPlusRetail - en-us) (Version: 16.0.6568.2025 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\OneDriveSetup.exe) (Version: 17.3.6301.0127 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities (HKLM\...\{9D573E71-1077-4C7E-B4DB-4E22A5D2B48B}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client (HKLM\...\{49D665A2-4C2A-476E-9AB8-FCC425F526FC}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2014 Express LocalDB (HKLM\...\{AB8DE9BA-19E1-446A-BCFA-6B3DA9751E21}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 Management Objects (HKLM-x32\...\{2774595F-BC2A-4B12-A25B-0C37A37049B0}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 Management Objects (x64) (HKLM\...\{1F9EB3B6-AED7-4AA7-B8F1-8E314B74B2A5}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 Transact-SQL ScriptDom (HKLM\...\{020CDFE0-C127-4047-B571-37C82396B662}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 T-SQL Language Service (HKLM-x32\...\{47D08E7A-92A1-489B-B0BF-415516497BCE}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 ENU (HKLM\...\{78909610-D229-459C-A936-25D92283D3FD}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - enu (14.0.50616.0) (HKLM-x32\...\{58246C80-3941-4B69-AE31-264644E2ADB8}) (Version: 14.0.50616.0 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2014 (HKLM\...\{68BA34E8-9B9D-4A74-83F0-7D366B532D75}) (Version: 12.0.2402.11 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2014 (HKLM-x32\...\{718FFB65-F6E4-4D62-861F-ED10ED32C936}) (Version: 12.0.2402.11 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual Studio Express 2015 for Windows Desktop - ENU (HKLM-x32\...\{cf9e81f7-4c03-403e-92b1-93d18aa8c3a4}) (Version: 14.0.23107.10 - Microsoft Corporation)
Mozilla Firefox 44.0.2 (x64 en-US) (HKLM\...\Mozilla Firefox 44.0.2 (x64 en-US)) (Version: 44.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 44.0.2 - Mozilla)
NVIDIA 3D Vision Driver 355.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 355.82 - NVIDIA Corporation)
NVIDIA Graphics Driver 355.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 355.82 - NVIDIA Corporation)
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.6528.1011 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.6528.1011 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.6528.1011 - Microsoft Corporation) Hidden
Polar Daemon (HKLM-x32\...\{2BA9320D-E061-4C71-ACCB-AC0E9D4FC82B}) (Version: 2.2.20000 - Polar Electro Oy)
Polar WebSync (HKLM-x32\...\{A3C03067-855A-4B5B-B08B-A1BFD68FCAF8}) (Version: 2.8.30000 - Polar Electro Oy)
Prerequisites for SSDT (HKLM-x32\...\{21373064-AD95-48DB-A32E-0D9E08EF7355}) (Version: 12.0.2000.8 - Microsoft Corporation)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Roslyn Language Services - x86 (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
SABnzbd 0.7.20 (HKLM-x32\...\SABnzbd) (Version: 0.7.20 - The SABnzbd Team)
SanDisk SSD Dashboard (HKLM-x32\...\SanDisk SSD Dashboard) (Version: 1.4.1 - SanDisk Corporation)
SanDisk SSD Dashboard Service (HKLM-x32\...\{EE9255E4-283A-4318-ABB6-A75BEE59ACA3}) (Version: 1.0.0 - SanDisk Corporation)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Team Explorer for Microsoft Visual Studio 2015 (x32 Version: 14.0.23102 - Microsoft Corporation) Hidden
Test Tools for Microsoft Visual Studio 2015 (x32 Version: 14.0.23107 - Microsoft Corporation) Hidden
TextPad 7 (HKLM\...\{D5CA0106-90CE-4842-8194-A6D4A46FAA0E}) (Version: 7.5.1 - Helios)
TradeStation 9.1 (HKLM-x32\...\{B948B39D-214F-486E-BCD9-8AB691F8762A}) (Version: 9.01.00.12880 - TradeStation Technologies)
Universal CRT Extension SDK (x32 Version: 10.0.10150 - Microsoft Corporation) Hidden
Universal CRT Extension SDK (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
Universal CRT Headers Libraries and Sources (x32 Version: 10.0.10150 - Microsoft Corporation) Hidden
Universal CRT Headers Libraries and Sources (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
Universal CRT Redistributable (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
Universal CRT Tools x64 (Version: 10.0.26624 - Microsoft Corporation) Hidden
Universal CRT Tools x86 (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
Universal General MIDI DLS Extension SDK (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
Update for (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
Windows Media Player 64-bit Plug-in Fix (HKLM\...\{00a8ce68-cb2e-4652-aecd-c05c0d9d53a7}.sdb) (Version: - )
Windows Software Development Kit - Windows 10.0.26624 (HKLM-x32\...\{e7a0c8b6-b0e9-41e2-8a0a-a6784f88d1d4}) (Version: 10.0.26624 - Microsoft Corporation)
WinRT Intellisense Desktop - en-us (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
WinRT Intellisense Desktop - Other Languages (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
WinRT Intellisense IoT - en-us (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
WinRT Intellisense IoT - Other Languages (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
WinRT Intellisense PPI - en-us (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
WinRT Intellisense PPI - Other Languages (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
WinRT Intellisense UAP - en-us (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
WinRT Intellisense UAP - Other Languages (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
WinRT Intellisense Xbox Live Extension SDK - en-us (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
WinRT Intellisense Xbox Live Extension SDK - Other Languages (x32 Version: 10.0.26624 - Microsoft Corporation) Hidden
WMP Tag Plus 2.6 (HKLM-x32\...\{80C3019B-3BA4-4674-AC90-A0B402593BA5}_is1) (Version: 2.6 - BM-productions)
Wolfenstein: The New Order (HKLM-x32\...\Steam App 201810) (Version: - Machine Games)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{8A791F0C-C63C-4EC5-B97F-FBCE74EDBC54}\InprocServer32 -> C:\Program Files\TextPad 7\System\ShellExt64.dll ()
CustomCLSID: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll (Google Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {10EAEC7A-D7D6-4FEB-ADF9-D03710B9DDC1} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2016-02-23] (Microsoft Corporation)
Task: {50C3EE1A-3939-41D7-B878-D9206E301086} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4017012110-1709071101-1196858752-1001UA => C:\Users\G.S\AppData\Local\Google\Update\GoogleUpdate.exe [2015-10-04] (Google Inc.)
Task: {50FAB9BA-5CB5-4508-8B7F-EA08008E3D5D} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-4017012110-1709071101-1196858752-1001
Task: {765AB72D-B4AC-4794-95C0-B1B9B8A1ABAC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2016-02-23] (Microsoft Corporation)
Task: {7C17E354-78E9-4E36-981E-D05CD44B72AF} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-4017012110-1709071101-1196858752-1001 => C:\Users\G.S\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2016-02-11] (Microsoft Corporation)
Task: {7F7626D9-70DF-4D27-8603-5017BA9E210B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4017012110-1709071101-1196858752-1001Core => C:\Users\G.S\AppData\Local\Google\Update\GoogleUpdate.exe [2015-10-04] (Google Inc.)
Task: {850F8E78-2749-4C75-B044-DD13DC10DB3F} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {86AF7C32-22BD-4A41-9252-B977F70A8D2D} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-02-04] (Microsoft Corporation)
Task: {EE2C0B5E-1778-469C-9465-94E390DA54D7} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-02-04] (Microsoft Corporation)
Task: {F98E3237-8A13-468F-8B17-5D57ED0E1A3B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2016-02-13] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4017012110-1709071101-1196858752-1001Core.job => C:\Users\G.S\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4017012110-1709071101-1196858752-1001UA.job => C:\Users\G.S\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-10-13 16:00 - 2013-04-15 10:50 - 00198144 _____ () C:\Windows\System32\HP1006LM.DLL
2015-10-13 16:00 - 2013-04-15 10:50 - 00065024 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1006PP.dll
2015-10-04 16:28 - 2016-02-04 05:51 - 00173256 _____ () C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
2015-10-13 21:17 - 2015-10-13 21:17 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2012-12-12 15:20 - 2012-12-12 15:20 - 00419536 _____ () C:\Program Files (x86)\Polar\Daemon\polard.exe
2015-10-04 14:42 - 2015-08-25 09:24 - 00116344 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-02-23 19:56 - 2016-02-04 08:53 - 08914120 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2015-06-10 10:00 - 2015-06-10 10:00 - 06217728 _____ () C:\Program Files (x86)\Polar\WebSync\WebSync.exe
2012-12-12 15:20 - 2012-12-12 15:20 - 03483856 _____ () C:\Program Files (x86)\Polar\Daemon\libpolar.dll
2016-02-26 06:56 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-02-26 06:56 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-02-26 06:56 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-02-26 06:56 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-02-26 06:56 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-10-06 20:44 - 2015-12-15 00:54 - 00782336 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-10-06 20:44 - 2015-07-03 11:12 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-10-06 20:44 - 2016-02-04 16:02 - 02546768 _____ () C:\Program Files (x86)\Steam\video.dll
2015-10-06 20:44 - 2015-07-03 11:12 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-10-06 20:44 - 2015-07-03 11:12 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2015-10-06 20:44 - 2015-09-23 19:33 - 02549248 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2015-10-06 20:44 - 2015-09-23 19:33 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2015-10-06 20:44 - 2015-09-23 19:33 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2015-10-06 20:44 - 2015-09-23 19:33 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2015-10-06 20:44 - 2015-09-23 19:33 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2015-10-06 20:44 - 2016-02-04 16:01 - 00802896 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2015-10-06 20:44 - 2015-12-29 20:51 - 00208896 _____ () C:\Program Files (x86)\Steam\bin\openvr_api.dll
2015-06-10 09:47 - 2015-06-10 09:47 - 00104448 _____ () C:\Program Files (x86)\Polar\WebSync\PTransform.dll
2015-06-10 09:46 - 2015-06-10 09:46 - 03717632 _____ () C:\Program Files (x86)\Polar\WebSync\libpolar.dll
2010-02-10 16:06 - 2010-02-10 16:06 - 00334848 _____ () C:\Program Files (x86)\Polar\WebSync\QtXml4.dll
2010-02-10 16:22 - 2010-02-10 16:22 - 07971840 _____ () C:\Program Files (x86)\Polar\WebSync\QtGui4.dll
2010-02-10 16:07 - 2010-02-10 16:07 - 00929280 _____ () C:\Program Files (x86)\Polar\WebSync\QtNetwork4.dll
2011-01-14 16:01 - 2011-01-14 16:01 - 02142720 _____ () C:\Program Files (x86)\Polar\WebSync\QtCore4.dll
2010-02-10 18:45 - 2010-02-10 18:45 - 00025600 _____ () C:\Program Files (x86)\Polar\WebSync\imageformats\qgif4.dll
2010-02-10 18:45 - 2010-02-10 18:45 - 00119808 _____ () C:\Program Files (x86)\Polar\WebSync\imageformats\qjpeg4.dll
2015-10-06 20:44 - 2016-01-05 20:52 - 48387872 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2016-02-23 19:56 - 2016-02-04 08:26 - 08914120 _____ () C:\Program Files (x86)\Microsoft Office\root\Office16\1033\GrooveIntlResource.dll
2015-10-27 07:33 - 2015-10-27 07:33 - 01754296 _____ () C:\Program Files (x86)\Microsoft Office\Root\Office16\tmpod.dll
2016-02-23 19:55 - 2016-02-04 08:24 - 01073856 _____ () C:\Program Files (x86)\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7871 more sites.

IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\123simsen.com -> www.123simsen.com

There are 7871 more sites.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 08:25 - 2016-02-26 07:02 - 00450954 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com

There are 15469 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\G.S\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img3.jpg
DNS Servers: 8.8.4.4 - 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\...\StartupApproved\Run: => "SpybotPostWindows10UpgradeReInstall"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{BF53BB5D-B8C8-4DF8-B212-DDF8EAF87B8F}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{8D533769-7602-4691-9741-8CEBD2C371C9}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{7FDB2588-3BCC-4D64-9FC0-E115260B8F21}] => (Allow) C:\Users\G.S\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{49269847-5070-42C3-93CD-9BBC71815FFE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{DAC1BF5F-3016-451B-94E3-C4C055FE222A}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{812C80D2-5DC3-42E2-88AC-25017DAA8D7D}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{FFA63EE8-C810-49F1-9AC0-4A86CA1994BA}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{15F4B853-B875-4783-B230-1D66EE190692}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Far Cry 3\bin\FC3UpdaterSteam.exe
FirewallRules: [{DBFE87B3-20F4-47CE-8248-D7B40D51CDDE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Far Cry 3\bin\FC3UpdaterSteam.exe
FirewallRules: [{D47B9F08-00C8-4E36-9C6B-AE04EA573760}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{4830F4F4-446D-4603-9404-19DA6587FE1F}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{D9830656-B159-4AAD-B311-D2E88A78901C}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{8F920277-9717-470D-A127-B58EF969E565}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{F6F713BC-0D4F-4D92-888A-6C084517E3BF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Far Cry 3\bin\farcry3.exe
FirewallRules: [{F2828E6D-4760-48A5-9435-C82E96686BE6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Far Cry 3\bin\farcry3.exe
FirewallRules: [{F1172CB2-2350-42E2-BB12-F35BE80889F2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Far Cry 3\bin\farcry3_d3d11.exe
FirewallRules: [{B20B03A9-9041-459E-A493-E864859B0396}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Far Cry 3\bin\farcry3_d3d11.exe
FirewallRules: [{E5CE7656-24C6-4FAD-844E-E5BCE91D8291}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2CB63380-5946-4D0A-A855-8D204453B937}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{53410DC4-8BE5-4FAB-973F-050EA21FA6D6}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B880C0C4-50C5-4185-9AD3-23B4313A1074}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [TCP Query User{33562429-8A70-4545-82B9-C09F38012EBE}C:\program files (x86)\dearmob\5kplayer\5kplayer.exe] => (Block) C:\program files (x86)\dearmob\5kplayer\5kplayer.exe
FirewallRules: [UDP Query User{D1314D0A-4808-4C07-A45E-AC60E6DFB665}C:\program files (x86)\dearmob\5kplayer\5kplayer.exe] => (Block) C:\program files (x86)\dearmob\5kplayer\5kplayer.exe
FirewallRules: [TCP Query User{393270DD-03C4-45E0-8597-E9AB19043376}C:\program files (x86)\steam\steamapps\common\far cry 3\bin\farcry3_d3d11.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\far cry 3\bin\farcry3_d3d11.exe
FirewallRules: [UDP Query User{DA6B774C-E851-449F-AFB6-B72847FE9C31}C:\program files (x86)\steam\steamapps\common\far cry 3\bin\farcry3_d3d11.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\far cry 3\bin\farcry3_d3d11.exe
FirewallRules: [{EEDFE752-9404-41FC-B928-94BBE4271C59}] => (Allow) LPort=53168
FirewallRules: [{EA99FF18-1736-43CD-848C-FF0946906B93}] => (Allow) LPort=2869
FirewallRules: [{0F2FC0A0-8E65-4219-BDD5-EBC45D58E8C0}] => (Allow) LPort=1900
FirewallRules: [{42FDE9FC-0D4E-408F-BF94-941EF62F27E7}] => (Allow) LPort=53168
FirewallRules: [{64917696-33C0-4A58-9A56-3FEF2A20BF0F}] => (Allow) LPort=2869
FirewallRules: [{BA02EC96-399F-4A39-B9E7-136C079E9B7C}] => (Allow) LPort=1900
FirewallRules: [{8DD10B80-A181-4080-90D5-21FD01D4EE2F}] => (Allow) LPort=53168
FirewallRules: [{5A899921-7FFB-4477-BD3D-8B799A5872AE}] => (Allow) LPort=2869
FirewallRules: [{4469DBEF-6576-4F6B-A1BC-B5F79AA4C64D}] => (Allow) LPort=1900
FirewallRules: [TCP Query User{99B073A8-5F62-4D1E-9E42-F43D2CD6CEE2}F:\program files (x86)\conceiva\mezzmo\mezzmo.exe] => (Allow) F:\program files (x86)\conceiva\mezzmo\mezzmo.exe
FirewallRules: [UDP Query User{522A4968-224D-41CE-B608-036C76BF9E12}F:\program files (x86)\conceiva\mezzmo\mezzmo.exe] => (Allow) F:\program files (x86)\conceiva\mezzmo\mezzmo.exe
FirewallRules: [VIRT-MIGL-In-TCP-NoScope] => (Allow) %systemroot%\system32\vmms.exe
FirewallRules: [VIRT-REMOTEDESKTOP-In-TCP-NoScope] => (Allow) %systemroot%\system32\vmms.exe
FirewallRules: [TCP Query User{F8C46293-A275-4D19-AC09-04CE646848DF}F:\program files (x86)\conceiva\mezzmo\mezzmo.exe] => (Allow) F:\program files (x86)\conceiva\mezzmo\mezzmo.exe
FirewallRules: [UDP Query User{8226A68B-56FC-4EC2-8B7A-57D13831F3DC}F:\program files (x86)\conceiva\mezzmo\mezzmo.exe] => (Allow) F:\program files (x86)\conceiva\mezzmo\mezzmo.exe
FirewallRules: [{D896DFFC-534C-4AFA-B629-F981EB87F78C}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{A9EA0514-D298-4657-9161-D0A1C050051E}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\WDExpress.exe
FirewallRules: [{D555296C-86D6-40DB-A96E-D2126CB8E5C6}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3.exe
FirewallRules: [{63BD5A83-20D8-40E8-874F-DF9DDADBF03E}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3.exe
FirewallRules: [{BA8628DB-9894-48F3-AE2C-4FCD3CF1A8C9}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3y.exe
FirewallRules: [{AA18CA0F-7B94-4875-87E7-096CC4FF4D8E}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3y.exe
FirewallRules: [{01AEB1D5-FB19-417B-8F0A-26786F111E2A}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3x.exe
FirewallRules: [{FD6FBB7B-FC51-4B99-A13B-1EAC46BE5B10}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3x.exe
FirewallRules: [{CC506764-F73B-46DD-B044-ABF4A058146E}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{78037348-9D07-4140-B85D-2EA84FF9656E}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{B257C206-2D72-4BD8-B1AF-2A623B646F24}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Wolfenstein.The.New.Order\WolfNewOrder_x64.exe
FirewallRules: [{43155750-5258-4B64-A94A-F798887DBBC8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Wolfenstein.The.New.Order\WolfNewOrder_x64.exe
FirewallRules: [TCP Query User{FDDE40E0-2182-4E45-883D-05DEB3A410D5}C:\program files (x86)\diablo iii\diablo iii.exe] => (Allow) C:\program files (x86)\diablo iii\diablo iii.exe
FirewallRules: [UDP Query User{2EE6DE32-8CA9-4B92-AB63-10202443CC1C}C:\program files (x86)\diablo iii\diablo iii.exe] => (Allow) C:\program files (x86)\diablo iii\diablo iii.exe
FirewallRules: [{181954F3-BEEA-4200-B048-0D97F3473D9A}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{2548B1FB-4626-4634-93CE-A1188BAF9762}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{778C8848-EEA2-4B0C-97B9-6CA7BA7181E2}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\WDExpress.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Restore Points =========================

13-02-2016 12:40:12 Windows Update
19-02-2016 17:49:58 Windows Update
25-02-2016 19:55:08 Windows Update

==================== Faulty Device Manager Devices =============

Name: Microsoft Visual Studio Location Simulator Sensor
Description: Microsoft Visual Studio Location Simulator Sensor
Class Guid: {5175d334-c371-4806-b3ba-71fd53c9258d}
Manufacturer: Microsoft Corporation
Service: SensorsSimulatorDriver
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Application errors:
==================
Error: (02/26/2016 07:09:56 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: The volume System Reserved (D:) was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (02/26/2016 07:09:55 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: The volume \\?\Volume{eeb6d3ae-6acd-11e5-9bf6-806e6f6e6963}\ was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (02/25/2016 07:55:09 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (02/25/2016 07:40:41 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program WINWORD.EXE version 16.0.6568.2025 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 17a8

Start Time: 01d1702e131a1268

Termination Time: 0

Application Path: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Report Id: 8c0dea5f-dc21-11e5-9c17-50e549b8a837

Faulting package full name:

Faulting package-relative application ID:

Error: (02/25/2016 07:38:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program WINWORD.EXE version 16.0.6568.2025 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1db0

Start Time: 01d16fd0075bc8eb

Termination Time: 0

Application Path: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Report Id: 4b2f7d24-dc21-11e5-9c17-50e549b8a837

Faulting package full name:

Faulting package-relative application ID:

Error: (02/24/2016 10:32:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Client application registered 2 identical instances of service DeathStar._airplay._tcp.local. port 8000.

Error: (02/24/2016 10:31:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Client application registered 2 identical instances of service DeathStar._airplay._tcp.local. port 8000.

Error: (02/24/2016 10:30:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Client application registered 2 identical instances of service DeathStar._airplay._tcp.local. port 8000.

Error: (02/24/2016 10:29:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Client application registered 2 identical instances of service DeathStar._airplay._tcp.local. port 8000.

Error: (02/24/2016 10:28:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Client application registered 2 identical instances of service DeathStar._airplay._tcp.local. port 8000.


System errors:
=============
Error: (02/26/2016 04:39:42 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.

Error: (02/24/2016 07:53:15 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Bitdefender Virus Shield service terminated unexpectedly. It has done this 1 time(s).

Error: (02/24/2016 07:52:42 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Steam Client Service service terminated unexpectedly. It has done this 1 time(s).

Error: (02/23/2016 07:37:42 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the VSSERV service.

Error: (02/19/2016 05:51:04 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the VSSERV service.

Error: (02/17/2016 10:13:54 PM) (Source: DCOM) (EventID: 10010) (User: DEATHSTAR)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (02/13/2016 01:34:29 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Bitdefender Virus Shield service terminated unexpectedly. It has done this 1 time(s).

Error: (02/13/2016 01:02:03 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the VSSERV service.

Error: (02/13/2016 12:47:17 PM) (Source: Microsoft-Windows-Eventlog) (EventID: 30) (User: NT AUTHORITY)
Description: The event logging service encountered an error (5) while enabling publisher {0BF2FB94-7B60-4B4D-9766-E82F658DF540} to channel Microsoft-Windows-Kernel-ShimEngine/Operational. This does not affect channel operation, but does affect the ability of the publisher to raise events to the channel. One common reason for this error is that the Provider is using ETW Provider Security and has not granted enable permissions to the Event Log service identity.

Error: (02/13/2016 12:47:15 PM) (Source: Microsoft-Windows-Eventlog) (EventID: 30) (User: NT AUTHORITY)
Description: The event logging service encountered an error (5) while enabling publisher {0BF2FB94-7B60-4B4D-9766-E82F658DF540} to channel Microsoft-Windows-Kernel-ShimEngine/Operational. This does not affect channel operation, but does affect the ability of the publisher to raise events to the channel. One common reason for this error is that the Provider is using ETW Provider Security and has not granted enable permissions to the Event Log service identity.


CodeIntegrity:
===================================
Date: 2016-02-27 15:55:54.137
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-27 15:55:53.996
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-08 10:32:40.170
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-08 10:32:40.023
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-07 13:45:30.512
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-02-07 13:45:30.365
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-01-31 19:16:26.316
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-01-31 19:16:26.170
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-01-31 19:16:21.902
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

Processor: Intel® Core™ i7-3770K CPU @ 3.50GHz
Percentage of memory in use: 21%
Total physical RAM: 16341.82 MB
Available physical RAM: 12908.11 MB
Total Virtual: 18773.82 MB
Available Virtual: 14760.98 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:446.79 GB) (Free:320.11 GB) NTFS
Drive d: (System Reserved) (Fixed) (Total:0.34 GB) (Free:0.1 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive f: () (Fixed) (Total:1862.68 GB) (Free:427.01 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 4FA4B5EC)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1862.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Attached Files


Edited by Oh My!, 02 March 2016 - 10:49 AM.


BC AdBot (Login to Remove)

 


#2 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,043 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:07 PM

Posted 02 March 2016 - 10:49 AM

Greetings McGonzo and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that.

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met.
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • When you post your reply, use the Replytopic.jpg button instead.
  • In the upper right hand corner of the topic you will see the Followtopic.jpg button. Click on this then choose Immediate E-Mail notification and then Proceed and you will be sent an email once I have posted a response.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far.

Please download a fresh copy of FRST and save it to your Desktop.

===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Press the Windows key Windows_Logo_key.gif + r on your keyboard at the same time. Type in notepad and press Enter
  • Click Format and check Word Wrap
  • Please copy and paste the contents of the below code box into the open notepad and save it to your desktop (<<<Important) as fixlist.txt
CreateRestorePoint:
CloseProcesses:
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
Toolbar: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001 -> No Name - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - No File
2016-02-24 07:55 - 2016-02-24 07:55 - 00027582 _____ C:\ProgramData\1456318524.bdinstall.bin
2016-02-24 07:53 - 2016-02-24 07:53 - 00236858 _____ C:\ProgramData\1456318321.bdinstall.bin
CustomCLSID: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File
File: C:\Users\G.S\AppData\Roaming\SEC2775906.trad
  • Launch FRST and press the Fix button just once and wait, the program will automatically launch fixlist.txt.
  • The tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

AdwCleaner by Xplode - Delete Adware

-------------------
  • Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browser
  • Double click on AdwCleaner.exe, click Run, then select I agree if it appears
  • Click Scan
  • Once the scan has completed youi will see Pending. Please check elements you don't want to remove above the progress bar
  • Click on Clean
  • Confirm the cleaning and rebooting of your computer by clicking OK
  • Your computer will be rebooted automatically. A text file will open after the restart
  • Copy and paste the contents in your reply
  • You can also find the logfile at C:\AdwCleaner\AdwCleaner.txt
===================================================

Junkware Removal Tool

-------------------
  • Please download Junkware Removal Tool and save it to your desktop.
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Right-mouse click JRT.exe and select Run as administrator (Windows XP double click the icon)
  • Please allow the program time to run
  • Once completed a Notepad document will open on your desktop
  • Copy and paste the contents in your reply
===================================================

Running Firefox in Browser Safe Mode

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Copy and paste the following into the run box and press Enter

firefox --safe-mode

  • Select Start in Safe Mode
  • Please report how Firefox is running
===================================================

Launching Internet Explorer Without Add-ons

----------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type iexplore.exe -extoff then press Enter
  • Check the browser behavior
===================================================

System Summary Information

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type msinfo32 and press Enter
  • Left click on System Summary
  • Click File, Save, and name the file Summary
  • Zip and attach the file to your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Fixlog
  • AdwCleaner log
  • Junkware log
  • Firefox performance?
  • Internet Explorer performance
  • System Summary Information
  • Update on computer behavior

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#3 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,043 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:07 PM

Posted 05 March 2016 - 09:49 PM

Greetings,

===================================================

3 Day Bump

It has been more than 3 days since my last post.
  • Do you still need help with this?
  • If after 48hrs you have not replied to this thread then it will have to be closed.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#4 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,043 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:07 PM

Posted 07 March 2016 - 08:20 PM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#5 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,043 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:07 PM

Posted 09 March 2016 - 05:02 PM

This topic has been re-opened at the request of the person who originally posted.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#6 McGonzo

McGonzo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:04:07 PM

Posted 10 March 2016 - 12:48 PM

Thanks Gary.   First the logs, then I'll add some details:

 

Fix result of Farbar Recovery Scan Tool (x64) Version:02-03-2016
Ran by G.S (2016-03-02 11:13:18) Run:1
Running from C:\Users\G.S\Desktop
Loaded Profiles: G.S (Available Profiles: G.S)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
CloseProcesses:
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
Toolbar: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001 -> No Name - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - No File
2016-02-24 07:55 - 2016-02-24 07:55 - 00027582 _____ C:\ProgramData\1456318524.bdinstall.bin
2016-02-24 07:53 - 2016-02-24 07:53 - 00236858 _____ C:\ProgramData\1456318321.bdinstall.bin
CustomCLSID: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File
File: C:\Users\G.S\AppData\Roaming\SEC2775906.trad
*****************

Restore point was successfully created.
Processes closed successfully.
"HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon" => key removed successfully
HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1DAC0C53-7D23-4AB3-856A-B04D98CD982A} => value removed successfully
HKCR\CLSID\{1DAC0C53-7D23-4AB3-856A-B04D98CD982A} => key not found.
C:\ProgramData\1456318524.bdinstall.bin => moved successfully
C:\ProgramData\1456318321.bdinstall.bin => moved successfully
"HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}" => key removed successfully
"HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}" => key removed successfully

========================= File: C:\Users\G.S\AppData\Roaming\SEC2775906.trad ========================

File not signed
MD5: 7DC4A6AE31111EF92F5709EE72E58ABE
Creation and modification date: 2015-12-21 17:38 - 2015-12-21 17:38
Size: 0000320
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product:
Description:
File Version:
Product Version:
Copyright:

====== End of File: ======

 

The system needed a reboot.

==== End of Fixlog 11:13:25 ====

 

# AdwCleaner v5.037 - Logfile created 02/03/2016 at 11:17:21
# Updated 28/02/2016 by Xplode
# Database : 2016-02-28.2 [Local]
# Operating system : Windows 8.1 Pro N  (x64)
# Username : G.S - DEATHSTAR
# Running from : C:\Users\G.S\AppData\Local\Microsoft\Windows\INetCache\IE\AMOGBVFT\AdwCleaner.exe
# Option : Clean
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

***** [ Files ] *****

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

***** [ Web browsers ] *****

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [2216 bytes] - [18/12/2015 12:58:37]
C:\AdwCleaner\AdwCleaner[C2].txt - [798 bytes] - [02/03/2016 11:17:21]
C:\AdwCleaner\AdwCleaner[S1].txt - [1989 bytes] - [18/12/2015 12:58:15]
C:\AdwCleaner\AdwCleaner[S2].txt - [631 bytes] - [25/02/2016 22:45:39]
C:\AdwCleaner\AdwCleaner[S3].txt - [631 bytes] - [27/02/2016 15:24:25]
C:\AdwCleaner\AdwCleaner[S4].txt - [1076 bytes] - [02/03/2016 11:16:51]

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [1160 bytes] ##########

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.3 (02.09.2016)
Operating System: Windows 8.1 Pro N x64
Ran by G.S (Administrator) on Wed 03/02/2016 at 11:20:29.28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

File System: 1

Successfully deleted: C:\Windows\wininit.ini (File)

 

Registry: 0

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 03/02/2016 at 11:20:58.61
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



#7 McGonzo

McGonzo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:04:07 PM

Posted 10 March 2016 - 01:18 PM

Summary.nfo
 
Data removed due to formatting.

Edited by Oh My!, 10 March 2016 - 05:13 PM.


#8 McGonzo

McGonzo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:04:07 PM

Posted 10 March 2016 - 01:29 PM

Data removed due to formatting.

Edited by Oh My!, 10 March 2016 - 05:13 PM.


#9 McGonzo

McGonzo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:04:07 PM

Posted 10 March 2016 - 01:35 PM

Gary, I sent PM with the last part of the summary.nfo file.  Forum rules would not allow me to post the entire thing.  Meanwhile, here's some observed behaviors.

 

First, this initially solved my problem.  Everything was fast.  Then it got slower and slower.  I've also observed that things run much faster in the AM - almost as if some sort of communication occur between my system and a host, and the host gets bogged down as more infected PCs come OL.  Finally, it gets slow enough that I can see something interesting happen.

 

When I am in Firefox or IE and have a webpage open, then enter a new address, it takes a *long* time to go to a new site.  But if I open a new tab and enter that address it is much faster.

 

If you want, I can run another set of logs.  Quite happy to run down any ideas.  Thanks again.



#10 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,043 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:07 PM

Posted 10 March 2016 - 05:17 PM

Thanks for the information. Please zip the System Summary file and try to attach it again.

Did you try the steps in Post #2 to run Firefox and Internet Explorer in the browser Safe Mode?

Is your whole computer running slow or just surfing the net?

Please do this.

===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Press the Windows key Windows_Logo_key.gif + r on your keyboard at the same time. Type in notepad and press Enter
  • Please copy and paste the contents of the below code box into the open notepad and save it to your desktop (<<<Important) as fixlist.txt
C:\Users\G.S\AppData\Roaming\SEC2775906.trad
emptytemp:
  • Launch FRST and press the Fix button just once and wait, the program will automatically launch fixlist.txt.
  • The tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Browser Safe Mode?
  • Fixlog

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#11 McGonzo

McGonzo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:04:07 PM

Posted 10 March 2016 - 06:45 PM

Here's the zip and the FST log.  I had to recreate the FSTFix.txt file since this deletes it.  I used the command line option to launch both browsers.  At first it was fast.  Then I used them normally.  It was still fast.  Then they got slow, even if I used the run options.

 

My computer runs normally.  Taskmgr shows normal CPU.

 

Fix result of Farbar Recovery Scan Tool (x64) Version:05-03-2016
Ran by G.S (2016-03-10 18:48:21) Run:2
Running from C:\Users\G.S\Desktop
Loaded Profiles: G.S (Available Profiles: G.S)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
CloseProcesses:
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
Toolbar: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001 -> No Name - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - No File
2016-02-24 07:55 - 2016-02-24 07:55 - 00027582 _____ C:\ProgramData\1456318524.bdinstall.bin
2016-02-24 07:53 - 2016-02-24 07:53 - 00236858 _____ C:\ProgramData\1456318321.bdinstall.bin
CustomCLSID: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\G.S\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File
File: C:\Users\G.S\AppData\Roaming\SEC2775906.trad
*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon => key not found.
HKU\S-1-5-21-4017012110-1709071101-1196858752-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1DAC0C53-7D23-4AB3-856A-B04D98CD982A} => value not found.
HKCR\CLSID\{1DAC0C53-7D23-4AB3-856A-B04D98CD982A} => key not found.
"C:\ProgramData\1456318524.bdinstall.bin" => not found.
"C:\ProgramData\1456318321.bdinstall.bin" => not found.
HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2} => key not found.
HKU\S-1-5-21-4017012110-1709071101-1196858752-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF} => key not found.

========================= File: C:\Users\G.S\AppData\Roaming\SEC2775906.trad ========================

"C:\Users\G.S\AppData\Roaming\SEC2775906.trad" => not found.
====== End of File: ======

 

The system needed a reboot.

==== End of Fixlog 18:48:28 ====

 

 

Attached Files


Edited by McGonzo, 10 March 2016 - 07:41 PM.


#12 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,043 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:07 PM

Posted 10 March 2016 - 08:30 PM

Thanks,

Please do this.

===================================================

Farbar's MiniToolBox

--------------------
  • Please download MiniToolBox, save it to your desktop
  • Please close any Firefox browsers you may have open
  • Double click the icon to launch the program
  • Make sure only the following options are checked:

Flush DNS
Report IE Proxy Settings
Reset IE Proxy Settings
Report FF Proxy Settings
Reset FF Proxy Settings
List content of Hosts
List IP configuration
List Winsock Entries

  • Click Go and once the scan is completed a Result.txt Notepad document will open on your desktop
  • Please copy and paste the contents in your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Result.txt

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#13 McGonzo

McGonzo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:04:07 PM

Posted 12 March 2016 - 09:24 AM

All the entries in the host file redirect to 127.0.0.1.

 

MiniToolBox by Farbar  Version: 07-02-2016 01
Ran by G.S (administrator) on 12-03-2016 at 09:20:58
Running from "C:\Users\G.S\Desktop"
Microsoft Windows 8.1 Pro N  (X64)
Model: To be filled by O.E.M. Manufacturer: Gigabyte Technology Co., Ltd.
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================

"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com

There are 15469 entries.

========================= IP Configuration: ================================

Realtek PCIe GBE Family Controller = Ethernet (Connected)
Hyper-V Virtual Ethernet Adapter = vEthernet (Virty) (Connected)

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled
set interface interface="Local Area Connection* 1" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Ethernet 2" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="vEthernet (Virty)" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled

popd
# End of IPv4 configuration

 

Windows IP Configuration

   Host Name . . . . . . . . . . . . : DeathStar
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : hsd1.tn.comcast.net

Ethernet adapter vEthernet (Virty):

   Connection-specific DNS Suffix  . : hsd1.tn.comcast.net
   Description . . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter #2
   Physical Address. . . . . . . . . : 50-E5-49-B8-A8-37
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2601:840:8000:4066:69a1:dd8c:809f:96fd(Preferred)
   Temporary IPv6 Address. . . . . . : 2601:840:8000:4066:6116:464b:e689:3b95(Preferred)
   Link-local IPv6 Address . . . . . : fe80::69a1:dd8c:809f:96fd%8(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.0.0.9(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Thursday, March 10, 2016 6:49:09 PM
   Lease Expires . . . . . . . . . . : Saturday, March 19, 2016 9:01:26 AM
   Default Gateway . . . . . . . . . : fe80::1286:8cff:fe7d:b5c1%8
                                       10.0.0.1
   DHCP Server . . . . . . . . . . . : 10.0.0.1
   DHCPv6 IAID . . . . . . . . . . . : 156296521
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-A3-36-44-50-E5-49-B8-A8-37
   DNS Servers . . . . . . . . . . . : 2001:4860:4860::8844
                                       2001:4860:4860::8888
                                       8.8.4.4
                                       8.8.8.8
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.hsd1.tn.comcast.net:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6ab8:34cc:2817:f5ff:fff6(Preferred)
   Link-local IPv6 Address . . . . . : fe80::34cc:2817:f5ff:fff6%5(Preferred)
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 134217728
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-A3-36-44-50-E5-49-B8-A8-37
   NetBIOS over Tcpip. . . . . . . . : Disabled
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  2001:4860:4860::8844

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
Name:    google.com
Address:  2607:f8b0:4002:c06::8a

Pinging google.com [2607:f8b0:4002:c06::8b] with 32 bytes of data:
Reply from 2607:f8b0:4002:c06::8b: time=31ms
Reply from 2607:f8b0:4002:c06::8b: time=31ms

Ping statistics for 2607:f8b0:4002:c06::8b:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 31ms, Maximum = 31ms, Average = 31ms
Server:  google-public-dns-b.google.com
Address:  2001:4860:4860::8844

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.

Pinging yahoo.com [2001:4998:44:204::a7] with 32 bytes of data:
Request timed out.
Request timed out.

Ping statistics for 2001:4998:44:204::a7:
    Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
  8...50 e5 49 b8 a8 37 ......Hyper-V Virtual Ethernet Adapter #2
  1...........................Software Loopback Interface 1
  4...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
  5...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.0.0.1         10.0.0.9     10
         10.0.0.0    255.255.255.0         On-link          10.0.0.9    266
         10.0.0.9  255.255.255.255         On-link          10.0.0.9    266
       10.0.0.255  255.255.255.255         On-link          10.0.0.9    266
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link          10.0.0.9    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link          10.0.0.9    266
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  8    266 ::/0                     fe80::1286:8cff:fe7d:b5c1
  1    306 ::1/128                  On-link
  5    306 2001::/32                On-link
  5    306 2001:0:9d38:6ab8:34cc:2817:f5ff:fff6/128
                                    On-link
  8    266 2601:840:8000:4066::/64  On-link
  8    266 2601:840:8000:4066:6116:464b:e689:3b95/128
                                    On-link
  8    266 2601:840:8000:4066:69a1:dd8c:809f:96fd/128
                                    On-link
  8    266 fe80::/64                On-link
  5    306 fe80::/64                On-link
  5    306 fe80::34cc:2817:f5ff:fff6/128
                                    On-link
  8    266 fe80::69a1:dd8c:809f:96fd/128
                                    On-link
  1    306 ff00::/8                 On-link
  8    266 ff00::/8                 On-link
  5    306 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None
========================= Winsock entries =====================================

Catalog5 01 C:\Windows\SysWOW64\napinsp.dll [55296] (Microsoft Corporation)
Catalog5 02 C:\Windows\SysWOW64\pnrpnsp.dll [70144] (Microsoft Corporation)
Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [70144] (Microsoft Corporation)
Catalog5 04 C:\Windows\SysWOW64\NLAapi.dll [65536] (Microsoft Corporation)
Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [286208] (Microsoft Corporation)
Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [23040] (Microsoft Corporation)
Catalog5 07 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [286208] (Microsoft Corporation)
Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [286208] (Microsoft Corporation)
Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [286208] (Microsoft Corporation)
Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [286208] (Microsoft Corporation)
Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [286208] (Microsoft Corporation)
Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [286208] (Microsoft Corporation)
Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [286208] (Microsoft Corporation)
Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [286208] (Microsoft Corporation)
Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [286208] (Microsoft Corporation)
Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [286208] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\napinsp.dll [69120] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\pnrpnsp.dll [88576] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [88576] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\NLAapi.dll [86016] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [339456] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [30720] (Microsoft Corporation)
x64-Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [132968] (Apple Inc.)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [339456] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [339456] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [339456] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [339456] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [339456] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [339456] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [339456] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [339456] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [339456] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [339456] (Microsoft Corporation)

**** End of log ****



#14 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,043 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:07 PM

Posted 12 March 2016 - 09:36 AM

Greetings,
 

All the entries in the host file redirect to 127.0.0.1.

That is be design and for your benefit. What that means is those web addresses are automatically routed internally which prevents them from acutally going to the bad sites. They are basically transferred to a dead end.

I would like you to boot your computer into Safe Mode with Networking and test your browsers. If your browsers work fine then complete the following.

===================================================

Clean Boot

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type msconfig and press Enter
  • If you are prompted for an administrator password or for a confirmation, type the password, or provide confirmation
  • Click the General tab then click Selective Startup
  • Check Load system services
  • Uncheck Load Startup Items

2440069.png

  • Click the Services tab
  • Click to select the Hide All Microsoft Services check box
  • Click Disable All, and then click OK
  • When you are prompted, click Restart and boot into Normal Mode
  • Check your computer performance
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Safe Mode with Networking?
  • Clean Boot?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#15 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,043 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:07 PM

Posted 14 March 2016 - 09:37 AM

Greetings,

===================================================

3 Day Bump

It has been more than 3 days since my last post.
  • Do you still need help with this?
  • If after 48hrs you have not replied to this thread then it will have to be closed.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users