Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Think I have malware, previous help didn't seem to get it all.


  • Please log in to reply
8 replies to this topic

#1 zero.81

zero.81

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:29 PM

Posted 26 August 2016 - 11:48 AM

Mod Edit:  Prior AII topic at http://www.bleepingcomputer.com/forums/t/561908/can-able-to-change-my-proxy-settings-in-internet-options/ - Hamluis.

 

I think I have something changing my DNS server settings.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-08-2016 01
Ran by Dallas (administrator) on DALLAS-PC (26-08-2016 11:29:06)
Running from C:\Users\Dallas\Downloads
Loaded Profiles: Dallas (Available Profiles: Dallas & DefaultAppPool)
Platform: Windows 10 Pro Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(DTS, Inc) C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
() C:\Program Files (x86)\TradeSkillMaster Application\app\TSMApplication.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(ROCCAT GmbH Co., Ltd.) C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone Pure Optical Mouse\KonePureOpticalMonitor.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Hammer & Chisel, Inc.) C:\Users\Dallas\AppData\Local\Discord\app-0.0.295\Discord.exe
(Hammer & Chisel, Inc.) C:\Users\Dallas\AppData\Local\Discord\app-0.0.295\Discord.exe
(Hammer & Chisel, Inc.) C:\Users\Dallas\AppData\Local\Discord\app-0.0.295\Discord.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.722.10060.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft) C:\Program Files\WindowsApps\Microsoft.BingWeather_4.13.47.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe
(Microsoft) C:\Program Files\WindowsApps\Microsoft.BingFinance_4.13.47.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Money.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1608.2213.0_x64__8wekyb3d8bbwe\Calculator.exe
(Curse) C:\Users\Dallas\AppData\Local\Apps\2.0\XYPRMGLP.W6W\A8RG3P5J.QN0\curs..tion_9e9e83ddf3ed3ead_0005.0001_fb8944c2684f5b6c\CurseClient.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1608.2312.0_x64__8wekyb3d8bbwe\Time.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Trend Micro Inc.) C:\Users\Dallas\Downloads\HijackThis.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1402624 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [287592 2014-05-28] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\nvspcap64.dll [1767944 2016-06-14] (NVIDIA Corporation)
HKLM\...\Run: [outvote] => "C:\Program Files (x86)\attainment\campos.exe"
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [15818872 2016-04-28] (Logitech Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-07-26] (Apple Inc.)
HKLM-x32\...\Run: [RoccatKonePureOptical] => C:\Program Files (x86)\ROCCAT\Kone Pure Optical Mouse\KonePureOpticalMonitor.exe [561152 2013-05-02] (ROCCAT GmbH)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [4513792 2014-05-22] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ricki] => "C:\Program Files (x86)\attainment\campos.exe"
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2631120 2016-07-28] (Malwarebytes Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2857248 2016-08-23] (Valve Corporation)
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23375200 2016-07-29] (Google)
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [ibis] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [suggestiveness] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [strassburger] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [TSMApplication] => C:\Program Files (x86)\TradeSkillMaster Application\app\TSMApplication.exe [1623040 2016-08-15] ()
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [Battle.net] => C:\Program Files (x86)\Battle.net\Battle.net Launcher.exe [3122152 2016-06-22] (Blizzard Entertainment)
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [GoogleChromeAutoLaunch_5353D6F7D87BA94BE158573D745CD522] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1152840 2016-08-02] (Google Inc.)
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [1aCopyShExtError] -> {83BEA36E-7680-4598-A4DF-994426F6E78D} => C:\Users\Dallas\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-08-28] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [2aCopyShExtSynced] -> {845B7388-6F85-4F32-9FD5-F02DC7882B89} => C:\Users\Dallas\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-08-28] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [3aCopyShExtSyncing] -> {F6378A7A-F753-449B-AE1B-997A96132E61} => C:\Users\Dallas\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-08-28] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [4aCopyShExtSyncingProg1] -> {3A511828-777D-46F8-82F4-5B530C1B3D9E} => C:\Users\Dallas\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-08-28] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [5aCopyShExtSyncingProg2] -> {C8C88204-5B14-40EC-BA72-8AEBC762047E} => C:\Users\Dallas\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-08-28] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [6aCopyShExtSyncingProg3] -> {ACFF45C3-3EEB-4351-86C2-6696BA264239} => C:\Users\Dallas\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-08-28] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [7aCopyShExtSyncingProg4] -> {29AF997F-488B-46F0-AE78-7146F1B89CC3} => C:\Users\Dallas\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-08-28] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [8aCopyShExtSyncingProg5] -> {03F9AD29-1C78-4B66-8890-B177B5430C53} => C:\Users\Dallas\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-08-28] (Barracuda Networks, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Roccat Talk.lnk [2016-07-14]
ShortcutTarget: Roccat Talk.lnk -> C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe (ROCCAT GmbH Co., Ltd.)
Startup: C:\Users\Dallas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip [2016-04-26] ()
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\Parameters: [NameServer] 8.8.8.8,8.8.8.4
Tcpip\..\Interfaces\{013c772f-e1ff-4ed5-a7db-27a8530a3c24}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{013c772f-e1ff-4ed5-a7db-27a8530a3c24}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{e2eb3199-0e14-4a7e-98c2-4549d7390c5b}: [NameServer] 8.8.8.8,8.8.4.4
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
SearchScopes: HKU\S-1-5-21-1170261049-2036437327-1132982665-1000 -> {B473AB43-9747-4737-8BE4-F538F2AE84AD} URL = hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-07-23] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-07-23] (Oracle Corporation)
 
FireFox:
========
FF ProfilePath: C:\Users\Dallas\AppData\Roaming\Mozilla\Firefox\Profiles\feQBySmL.default
FF Homepage: hxxps://www.malwarebytes.org/restorebrowser/
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll [2013-09-16] (ESN Social Software AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-03-20] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-03-20] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-07-23] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-07-23] (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-07-10] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-07-10] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1170261049-2036437327-1132982665-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Dallas\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-06-08] (Unity Technologies ApS)
FF Extension: (Avira Browser Safety) - C:\Users\Dallas\AppData\Roaming\Mozilla\Firefox\Profiles\feQBySmL.default\Extensions\abs@avira.com [2015-06-19] [not signed]
 
Chrome: 
=======
CHR DefaultSearchURL: Default -> hxxp://www-searching.com/search.aspx?site=shdefault1&prd=smw&pid=s&shr=d&q={searchTerms}&s=G7Ezamotn19312AR,53cd74a7-93c0-4b30-809a-74b33538bbb0,
CHR DefaultSearchKeyword: Default -> www-searching.com
CHR DefaultSuggestURL: Default -> hxxp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
CHR Profile: C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-07-14]
CHR Extension: (Google Docs) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-07-14]
CHR Extension: (Google Drive) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-27]
CHR Extension: (App Launcher for Messenger) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bllmngcdibgbgjnginpehneeofhbmdjm [2016-07-15]
CHR Extension: (YouTube) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-04-27]
CHR Extension: (uBlock Origin) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2016-08-08]
CHR Extension: (Entanglement) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmnpffgfpcohhpoddjankjanolcekbni [2016-07-15]
CHR Extension: (Bing Pong Helper) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\cohnfldcnegepfhhfbcgecblgjdcmcka [2016-08-22]
CHR Extension: (Google Search) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-19]
CHR Extension: (Google Play Music) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\fahmaaghhglfmonjliepjlchgpgfmobi [2016-08-22]
CHR Extension: (Google Sheets) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-07-14]
CHR Extension: (UNO 3D HD) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdkfcgceminipbgjnnimdkejmlaecebj [2016-07-15]
CHR Extension: (Google Docs Offline) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-27]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2016-08-23]
CHR Extension: (Classic) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkacjpbfdknhflllbcmjibkdeoafencn [2016-07-14]
CHR Extension: (Reddit Enhancement Suite) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2016-04-27]
CHR Extension: (Google Hangouts) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\knipolnnllmklapflnccelgolnpehhpl [2016-08-22]
CHR Extension: (Little Alchemy) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\knkapnclbofjjgicpkfoagdjohlfjhpd [2016-07-15]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2016-04-27]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-27]
CHR Extension: (Gmail) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-19]
CHR Extension: (Chrome Media Router) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-22]
CHR Profile: C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Drive) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
CHR Extension: (uBlock Origin) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2016-04-11]
CHR Extension: (Google Search) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-31]
CHR Extension: (Chuck Anderson) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gegkoiakifeoejnjkbnnojkkdoegeofp [2015-07-15]
CHR Extension: (Google Docs Offline) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2016-04-26]
CHR Extension: (Reddit Enhancement Suite) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2016-03-16]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2016-03-26]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-11]
CHR Extension: (Checker Plus for Gmail™) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\oeopbcgkkoapgobdbedcemjljbihmemj [2016-04-22]
CHR Extension: (Gmail) - C:\Users\Dallas\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-15]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bhfhojbhbnajajgihpicejdalbjlpcep] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oaocmnfllndpbbmjmniielgaanaifehp] - hxxps://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe [936728 2014-01-27] ()
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe [1360016 2014-04-24] () [File not signed]
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1362464 2016-06-23] ()
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]
R2 DTSAudioSvc; C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe [249328 2015-06-24] (DTS, Inc)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-14] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-05-28] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel® Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [154584 2014-03-20] (Intel Corporation)
R2 LogiRegistryService; C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe [193656 2016-04-28] (Logitech Inc.)
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [750032 2016-07-28] (Malwarebytes Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-14] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-14] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2122248 2016-06-24] (Electronic Arts)
S3 vmicvss; C:\Windows\System32\ICSvc.dll [511488 2015-10-30] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-06-30] (Microsoft Corporation)
S2 AdVPN Service; C:\Program Files (x86)\AdVPN\AdVpnService.exe [X]
S2 AdVpnProxyService; C:\Program Files (x86)\AdVpnProxyService\AdVpnProxyService.exe [X]
S2 GTFPOQUOTT Updater; C:\Program Files (x86)\GTFPOQUOTT Updater\GTFPOQUOTT Updater.exe [X]
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-01-27] ()
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [129152 2016-04-25] (Samsung Electronics Co., Ltd.)
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [74984 2016-07-28] ()
R3 ladfGSS; C:\Windows\system32\drivers\ladfGSS.sys [45208 2016-04-15] (Logitech Inc.)
R2 LGCoreTemp; C:\Program Files\Logitech Gaming Software\Drivers\LgCoreTemp\lgcoretemp.sys [14184 2015-06-21] (Logitech)
R3 LGJoyXlCore; C:\Windows\system32\drivers\LGJoyXlCore.sys [85160 2016-04-18] (Logitech Inc.)
S3 libusb0; C:\Windows\system32\DRIVERS\libusb0.sys [44480 2011-05-17] (hxxp://libusb-win32.sourceforge.net)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2016-08-26] (Malwarebytes)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
R0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\WINDOWS\system32\pwdspio.sys [12504 2013-09-30] ()
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [221824 2016-04-25] (Samsung Electronics Co., Ltd.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-08-15] (Apple, Inc.) [File not signed]
S1 VBoxNetAdp; C:\Windows\System32\drivers\VBoxNetAdp6.sys [117768 2015-09-08] (Oracle Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
R2 WinisoCDBus; C:\Windows\System32\drivers\WinisoCDBus.sys [204032 2014-02-26] (WinISO.com)
U3 idsvc; no ImagePath
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-08-26 11:29 - 2016-08-26 11:29 - 00028614 _____ C:\Users\Dallas\Downloads\FRST.txt
2016-08-26 11:24 - 2016-08-26 11:25 - 02396160 _____ (Farbar) C:\Users\Dallas\Downloads\FRST64.exe
2016-08-26 11:24 - 2016-08-26 11:24 - 01746432 _____ (Farbar) C:\Users\Dallas\Downloads\FRST.exe
2016-08-26 11:07 - 2016-08-26 11:07 - 00000000 ____D C:\Users\Dallas\Downloads\backups
2016-08-26 11:03 - 2016-08-26 11:03 - 00388608 _____ (Trend Micro Inc.) C:\Users\Dallas\Downloads\HijackThis.exe
2016-08-23 00:16 - 2016-08-23 00:16 - 00000000 ___HD C:\OneDriveTemp
2016-08-20 00:31 - 2016-08-20 00:31 - 00000000 ____D C:\Users\Dallas\AppData\LocalLow\Coffee Powered Machine
2016-08-09 13:07 - 2016-08-03 06:14 - 01505984 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-08-09 13:07 - 2016-08-03 06:14 - 00092352 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-08-09 13:07 - 2016-08-03 06:14 - 00050368 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-08-09 13:07 - 2016-08-03 05:36 - 07469408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-08-09 13:07 - 2016-08-03 05:36 - 00099680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2016-08-09 13:07 - 2016-08-03 05:36 - 00037744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
2016-08-09 13:07 - 2016-08-03 05:30 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-08-09 13:07 - 2016-08-03 05:23 - 00693600 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-08-09 13:07 - 2016-08-03 05:23 - 00115040 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-08-09 13:07 - 2016-08-03 05:22 - 00808288 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2016-08-09 13:07 - 2016-08-03 05:22 - 00465248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-08-09 13:07 - 2016-08-03 05:22 - 00331616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2016-08-09 13:07 - 2016-08-03 05:21 - 03675512 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-08-09 13:07 - 2016-08-03 05:21 - 00566112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2016-08-09 13:07 - 2016-08-03 05:21 - 00303216 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
2016-08-09 13:07 - 2016-08-03 05:20 - 01540224 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2016-08-09 13:07 - 2016-08-03 05:20 - 00692136 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2016-08-09 13:07 - 2016-08-03 05:19 - 00604928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-08-09 13:07 - 2016-08-03 05:19 - 00161632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-08-09 13:07 - 2016-08-03 05:13 - 01988448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-08-09 13:07 - 2016-08-03 05:13 - 00576864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2016-08-09 13:07 - 2016-08-03 05:13 - 00393056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2016-08-09 13:07 - 2016-08-03 04:51 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdlrecover.exe
2016-08-09 13:07 - 2016-08-03 04:51 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-08-09 13:07 - 2016-08-03 04:44 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2016-08-09 13:07 - 2016-08-03 04:44 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshbth.dll
2016-08-09 13:07 - 2016-08-03 04:44 - 00044544 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2016-08-09 13:07 - 2016-08-03 04:43 - 16985088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-08-09 13:07 - 2016-08-03 04:41 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryClient.dll
2016-08-09 13:07 - 2016-08-03 04:41 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll
2016-08-09 13:07 - 2016-08-03 04:40 - 00127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2016-08-09 13:07 - 2016-08-03 04:40 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2016-08-09 13:07 - 2016-08-03 04:40 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2016-08-09 13:07 - 2016-08-03 04:39 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll
2016-08-09 13:07 - 2016-08-03 04:39 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll
2016-08-09 13:07 - 2016-08-03 04:38 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2016-08-09 13:07 - 2016-08-03 04:37 - 00110080 _____ (Microsoft Corporation) C:\WINDOWS\system32\IdCtrls.dll
2016-08-09 13:07 - 2016-08-03 04:36 - 00211456 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-08-09 13:07 - 2016-08-03 04:36 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2016-08-09 13:07 - 2016-08-03 04:35 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFPlatform.dll
2016-08-09 13:07 - 2016-08-03 04:33 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2016-08-09 13:07 - 2016-08-03 04:31 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2016-08-09 13:07 - 2016-08-03 04:31 - 00247296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtutil.exe
2016-08-09 13:07 - 2016-08-03 04:30 - 00515072 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
2016-08-09 13:07 - 2016-08-03 04:29 - 14252544 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2016-08-09 13:07 - 2016-08-03 04:29 - 01500160 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2016-08-09 13:07 - 2016-08-03 04:29 - 01387520 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-08-09 13:07 - 2016-08-03 04:29 - 00784384 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-08-09 13:07 - 2016-08-03 04:28 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-08-09 13:07 - 2016-08-03 04:28 - 00848896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-08-09 13:07 - 2016-08-03 04:27 - 07536640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2016-08-09 13:07 - 2016-08-03 04:27 - 01717760 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2016-08-09 13:07 - 2016-08-03 04:18 - 06974464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-08-09 13:07 - 2016-08-03 04:18 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2016-08-09 13:07 - 2016-08-03 04:18 - 01388032 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-08-09 13:07 - 2016-08-03 04:17 - 02175488 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-08-09 13:07 - 2016-08-03 04:16 - 05123072 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2016-08-09 13:07 - 2016-08-03 04:16 - 03589120 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-08-09 13:07 - 2016-08-03 04:16 - 02635776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-08-09 13:07 - 2016-08-03 04:16 - 01732096 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-08-09 13:07 - 2016-08-03 04:14 - 01997824 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2016-08-09 13:07 - 2016-08-03 04:13 - 03025920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-08-09 13:07 - 2016-08-03 04:13 - 02280960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-08-09 13:07 - 2016-08-03 04:12 - 02746368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll
2016-08-09 13:07 - 2016-08-03 04:11 - 04171264 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-08-09 13:07 - 2016-08-03 00:52 - 00034088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
2016-08-09 13:07 - 2016-08-03 00:34 - 00501592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-08-09 13:07 - 2016-08-03 00:34 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-08-09 13:07 - 2016-08-03 00:33 - 00051128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsNativeApi.dll
2016-08-09 13:07 - 2016-08-03 00:31 - 02921368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-08-09 13:07 - 2016-08-03 00:31 - 00957608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-08-09 13:07 - 2016-08-03 00:31 - 00703840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2016-08-09 13:07 - 2016-08-03 00:30 - 21123320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-08-09 13:07 - 2016-08-03 00:30 - 00465760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2016-08-09 13:07 - 2016-08-03 00:30 - 00255168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe
2016-08-09 13:07 - 2016-08-02 23:57 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdlrecover.exe
2016-08-09 13:07 - 2016-08-02 23:48 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wshbth.dll
2016-08-09 13:07 - 2016-08-02 23:47 - 13018112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-08-09 13:07 - 2016-08-02 23:44 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll
2016-08-09 13:07 - 2016-08-02 23:44 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryBroker.dll
2016-08-09 13:07 - 2016-08-02 23:42 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll
2016-08-09 13:07 - 2016-08-02 23:40 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IdCtrls.dll
2016-08-09 13:07 - 2016-08-02 23:39 - 19351040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-08-09 13:07 - 2016-08-02 23:37 - 00219136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2016-08-09 13:07 - 2016-08-02 23:35 - 00178688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wevtutil.exe
2016-08-09 13:07 - 2016-08-02 23:34 - 00792064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-08-09 13:07 - 2016-08-02 23:34 - 00400896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll
2016-08-09 13:07 - 2016-08-02 23:33 - 18677760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-08-09 13:07 - 2016-08-02 23:33 - 02050048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-08-09 13:07 - 2016-08-02 23:33 - 00687616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-08-09 13:07 - 2016-08-02 23:32 - 12585984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2016-08-09 13:07 - 2016-08-02 23:32 - 01467392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2016-08-09 13:07 - 2016-08-02 23:32 - 00434688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2016-08-09 13:07 - 2016-08-02 23:31 - 06743040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2016-08-09 13:07 - 2016-08-02 23:31 - 00705536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2016-08-09 13:07 - 2016-08-02 23:28 - 03663360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-08-09 13:07 - 2016-08-02 23:25 - 05323776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-08-09 13:07 - 2016-08-02 23:25 - 04078080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2016-08-09 13:07 - 2016-08-02 23:23 - 05660672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-08-09 13:07 - 2016-08-02 23:23 - 01799680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2016-08-09 13:07 - 2016-08-02 23:22 - 02501120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-08-09 13:07 - 2016-08-02 23:22 - 01502208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-08-09 13:07 - 2016-08-02 23:21 - 01708032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2016-08-09 13:07 - 2016-08-02 23:19 - 02180096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll
2016-08-09 13:06 - 2016-08-03 05:22 - 01322760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-08-09 13:06 - 2016-08-03 05:22 - 00058408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.dll
2016-08-09 13:06 - 2016-08-03 05:21 - 22561256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-08-09 13:06 - 2016-08-03 05:11 - 00422744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2016-08-09 13:06 - 2016-08-03 04:46 - 22384128 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-08-09 13:06 - 2016-08-03 04:40 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthserv.dll
2016-08-09 13:06 - 2016-08-03 04:38 - 00412160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2016-08-09 13:06 - 2016-08-03 04:36 - 00221696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-08-09 13:06 - 2016-08-03 04:35 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2016-08-09 13:06 - 2016-08-03 04:34 - 00383488 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-08-09 13:06 - 2016-08-03 04:33 - 00339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2016-08-09 13:06 - 2016-08-03 04:31 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2016-08-09 13:06 - 2016-08-03 04:30 - 24613888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-08-09 13:06 - 2016-08-03 04:30 - 00970752 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-08-09 13:06 - 2016-08-03 04:29 - 02127360 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-08-09 13:06 - 2016-08-03 04:28 - 00529920 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2016-08-09 13:06 - 2016-08-03 04:27 - 01752576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-08-09 13:06 - 2016-08-03 04:27 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2016-08-09 13:06 - 2016-08-03 04:20 - 13390336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-08-09 13:06 - 2016-08-03 04:15 - 07833088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-08-09 13:06 - 2016-08-03 04:14 - 04895232 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-08-09 13:06 - 2016-08-02 23:37 - 00335872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-08-09 13:06 - 2016-08-02 23:35 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2016-08-09 13:06 - 2016-08-02 23:32 - 01526272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-08-09 13:06 - 2016-08-02 23:29 - 12133376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-08-06 17:35 - 2016-08-15 22:36 - 00000000 ____D C:\Program Files (x86)\TradeSkillMaster Application
2016-08-06 17:35 - 2016-08-06 17:35 - 00001344 _____ C:\Users\Public\Desktop\TSMApplication.lnk
2016-08-06 17:35 - 2016-08-06 17:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TradeSkillMaster Application
2016-08-06 17:32 - 2016-08-06 17:35 - 12248778 _____ (TradeSkillMaster ) C:\Users\Dallas\Downloads\setup.exe
2016-08-05 18:39 - 2016-08-05 18:39 - 00000218 _____ C:\Users\Dallas\AppData\Local\recently-used.xbel
2016-08-05 18:31 - 2016-08-05 18:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2016-08-05 18:31 - 2016-08-05 18:31 - 00000000 ____D C:\Program Files\iTunes
2016-08-05 18:31 - 2016-08-05 18:31 - 00000000 ____D C:\Program Files\iPod
2016-08-05 18:31 - 2016-08-05 18:31 - 00000000 ____D C:\Program Files (x86)\iTunes
2016-08-05 18:10 - 2016-08-05 18:29 - 170493768 _____ (Apple Inc.) C:\Users\Dallas\Downloads\iTunes6464Setup.exe
2016-08-05 17:40 - 2016-08-05 17:42 - 00000000 ____D C:\Users\Dallas\Downloads\Avenged Sevenfold - Discography
2016-08-03 22:04 - 2016-08-03 22:06 - 00000000 ____D C:\Users\Dallas\Downloads\Batman.The.Killing.Joke.2016.BRRip.XviD.AC3-EVO
2016-08-02 03:52 - 2016-08-02 03:53 - 00000000 ____D C:\Users\Dallas\Downloads\Steve Jobs 2015 1080p BluRay x264 DTS-JYK
2016-07-29 15:43 - 2016-07-29 15:44 - 00000000 ____D C:\Program Files\Logitech Gaming Software
2016-07-29 15:43 - 2016-07-29 15:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2016-07-28 15:39 - 2016-07-28 15:39 - 00003984 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-07-28 15:39 - 2016-07-28 15:39 - 00003752 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-07-27 00:42 - 2016-07-27 00:48 - 00000000 ____D C:\Users\Dallas\Downloads\Hardcore Henry 2015 1080p BluRay x264 DTS-JYK
2016-07-27 00:42 - 2016-07-27 00:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluge
2016-07-27 00:42 - 2016-07-27 00:42 - 00000000 ____D C:\Program Files (x86)\Deluge
2016-07-27 00:29 - 2016-07-10 21:34 - 01887800 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvCamera64.dll
2016-07-27 00:29 - 2016-07-10 21:34 - 01595840 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvCamera32.dll
2016-07-27 00:29 - 2016-07-10 17:37 - 00127424 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe
2016-07-27 00:28 - 2016-07-15 13:15 - 01579976 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdagenco6420103.dll
2016-07-27 00:28 - 2016-07-15 13:15 - 00046016 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdap64.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 39977920 _____ C:\WINDOWS\system32\nvcompiler.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 35117112 _____ C:\WINDOWS\SysWOW64\nvcompiler.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 31680568 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 25442240 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 10700592 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 10656296 _____ C:\WINDOWS\system32\nvptxJitCompiler.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 10243600 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 09028360 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 08742360 _____ C:\WINDOWS\SysWOW64\nvptxJitCompiler.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 08622576 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 02868160 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 02497984 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 01939000 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6436881.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 01571776 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6436881.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00999872 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00930360 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00909248 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00852024 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00802816 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFTH264.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00801792 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFThevc.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00694488 _____ C:\WINDOWS\system32\nvfatbinaryLoader.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00644184 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFTH264.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00642440 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFThevc.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00612064 _____ C:\WINDOWS\system32\nvmcumd.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00583920 _____ C:\WINDOWS\SysWOW64\nvfatbinaryLoader.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00563856 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvumdshimx.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00462904 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvumdshim.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00444472 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00413488 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00393152 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00383936 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvDecMFTMjpeg.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00348216 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvDecMFTMjpeg.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00345800 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00213952 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00177952 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvinitx.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00155952 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvinit.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00153232 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglshim64.dll
2016-07-27 00:28 - 2016-07-10 21:34 - 00131584 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglshim32.dll
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-08-26 11:29 - 2016-07-15 17:08 - 00000000 ____D C:\FRST
2016-08-26 11:21 - 2016-04-01 14:48 - 00000000 ____D C:\Users\Dallas\AppData\Local\Battle.net
2016-08-26 10:59 - 2016-07-11 22:30 - 00000000 ____D C:\Program Files (x86)\Trillian
2016-08-26 10:44 - 2015-06-19 09:03 - 00000926 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-26 10:29 - 2016-07-06 15:06 - 00000000 ____D C:\Users\Dallas\AppData\Local\Deployment
2016-08-26 10:06 - 2015-06-20 09:55 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-08-26 07:51 - 2015-08-06 23:48 - 00000000 ____D C:\Program Files (x86)\Battle.net
2016-08-26 05:05 - 2016-07-14 10:46 - 00004158 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{BCF97B55-BD8C-49BF-AC90-95F3AE5D7BF8}
2016-08-26 03:20 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-08-26 00:26 - 2015-10-30 02:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-08-25 20:26 - 2016-07-14 07:41 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit
2016-08-25 15:44 - 2015-06-19 09:03 - 00000922 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-24 20:42 - 2016-01-04 16:44 - 00002281 _____ C:\Users\Dallas\Desktop\Discord.lnk
2016-08-24 20:42 - 2016-01-04 16:44 - 00000000 ____D C:\Users\Dallas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hammer & Chisel, Inc
2016-08-24 20:42 - 2016-01-04 16:44 - 00000000 ____D C:\Users\Dallas\AppData\Roaming\discord
2016-08-24 20:42 - 2016-01-04 16:44 - 00000000 ____D C:\Users\Dallas\AppData\Local\Discord
2016-08-24 18:23 - 2015-06-19 09:09 - 00000000 ____D C:\Program Files (x86)\Steam
2016-08-24 00:44 - 2015-06-19 18:29 - 00000000 ____D C:\Users\Dallas\AppData\Roaming\Skype
2016-08-23 02:07 - 2015-06-19 11:33 - 00000000 ____D C:\Users\Dallas\AppData\Roaming\OBS
2016-08-23 01:40 - 2016-06-25 19:42 - 00000000 ____D C:\Users\Dallas
2016-08-23 00:21 - 2016-06-25 19:41 - 01011508 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-08-23 00:21 - 2015-10-30 02:21 - 00000000 ____D C:\WINDOWS\INF
2016-08-23 00:16 - 2016-03-26 17:13 - 00000000 ___RD C:\Users\Dallas\Google Drive
2016-08-23 00:16 - 2015-07-30 17:24 - 00000000 ___RD C:\Users\Dallas\OneDrive
2016-08-23 00:16 - 2015-06-19 11:33 - 00000000 ____D C:\Program Files\OBS
2016-08-23 00:15 - 2016-06-25 19:41 - 00000000 ____D C:\ProgramData\NVIDIA
2016-08-23 00:15 - 2016-04-27 01:34 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-08-23 00:15 - 2015-10-30 01:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-08-23 00:15 - 2015-08-28 01:59 - 00000000 ____D C:\Users\Dallas\AppData\Roaming\Copy
2016-08-23 00:15 - 2015-06-19 09:51 - 00000438 _____ C:\WINDOWS\Tasks\DriverNavigator Scheduled Scan.job
2016-08-22 06:42 - 2016-03-28 03:23 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-08-22 02:22 - 2016-07-06 16:47 - 00000000 ____D C:\Users\Dallas\AppData\Local\ClassicShell
2016-08-18 18:45 - 2016-03-26 17:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2016-08-17 19:54 - 2015-07-30 17:22 - 00000000 ____D C:\Users\Dallas\AppData\Local\Packages
2016-08-16 16:15 - 2015-06-19 16:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT
2016-08-16 16:15 - 2015-06-19 09:57 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-08-15 12:12 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\system32\NDF
2016-08-13 12:34 - 2016-04-27 01:42 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-08-13 04:57 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\rescache
2016-08-13 04:45 - 2016-04-27 01:21 - 00000000 ____D C:\Program Files\Windows Journal
2016-08-13 04:45 - 2015-10-30 02:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-08-13 04:45 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-08-10 22:14 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2016-08-10 22:14 - 2015-10-30 02:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-08-10 22:13 - 2015-06-19 14:39 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-08-10 22:09 - 2015-06-19 14:39 - 147640136 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-08-08 19:17 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2016-08-08 15:44 - 2016-07-14 08:01 - 00002272 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-07 16:38 - 2016-04-03 22:59 - 00000000 ____D C:\Users\Dallas\AppData\Roaming\vlc
2016-08-06 17:35 - 2015-07-01 02:04 - 00000000 ____D C:\Users\Dallas\AppData\Roaming\TradeSkillMaster
2016-08-06 11:13 - 2016-07-14 07:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Exploit
2016-08-05 18:31 - 2015-06-19 11:06 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-08-04 13:59 - 2016-04-27 01:29 - 00000000 ____D C:\WINDOWS\ServiceProfiles
2016-08-03 23:53 - 2016-06-19 16:50 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-08-03 01:21 - 2015-06-19 10:00 - 00400304 __RSH C:\bootmgr
2016-08-02 16:40 - 2016-07-14 07:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit
2016-07-27 18:02 - 2015-06-19 15:31 - 00000000 ____D C:\Users\Dallas\AppData\Roaming\deluge
2016-07-27 00:29 - 2016-06-25 19:41 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2016-07-27 00:29 - 2016-06-25 19:41 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2016-07-27 00:29 - 2016-03-12 13:06 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2016-07-27 00:29 - 2015-06-19 06:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
 
==================== Files in the root of some directories =======
 
2016-07-14 07:26 - 2016-07-14 07:26 - 7102976 _____ () C:\Users\Dallas\AppData\Roaming\agent.dat
2016-07-14 07:25 - 2016-07-14 07:25 - 0128512 _____ () C:\Users\Dallas\AppData\Roaming\Installer.dat
2016-07-14 07:26 - 2016-07-14 07:26 - 0018432 _____ () C:\Users\Dallas\AppData\Roaming\Main.dat
2016-07-14 07:09 - 2016-07-14 07:09 - 0127643 _____ () C:\Users\Dallas\AppData\Local\28848139.exe
2016-08-05 18:39 - 2016-08-05 18:39 - 0000218 _____ () C:\Users\Dallas\AppData\Local\recently-used.xbel
2015-06-20 12:31 - 2015-06-20 12:31 - 0203593 _____ () C:\ProgramData\1434821391.bdinstall.bin
2015-08-02 15:30 - 2015-08-02 15:30 - 0037086 _____ () C:\ProgramData\1438547445.bdinstall.bin
2015-08-02 15:31 - 2015-08-02 15:31 - 0099115 _____ () C:\ProgramData\1438547447.bdinstall.bin
2016-06-25 19:41 - 2016-06-25 19:41 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-11-04 01:59 - 2015-11-04 01:59 - 0000128 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
 
Some files in TEMP:
====================
C:\Users\Dallas\AppData\Local\Temp\HitmanPro.exe
C:\Users\Dallas\AppData\Local\Temp\jre-8u101-windows-au.exe
C:\Users\Dallas\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Dallas\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Dallas\AppData\Local\Temp\nvStInst.exe
C:\Users\Dallas\AppData\Local\Temp\SkypeSetup.exe
 
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2016-08-22 02:46
 
==================== End of FRST.txt ============================

Edited by hamluis, 26 August 2016 - 12:02 PM.


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 38,580 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:09:29 PM

Posted 28 August 2016 - 10:47 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.
 
start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKLM\...\Run: [outvote] => "C:\Program Files (x86)\attainment\campos.exe"
HKLM-x32\...\Run: [ricki] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [ibis] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [suggestiveness] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [strassburger] => "C:\Program Files (x86)\attainment\campos.exe"
CHR DefaultSearchURL: Default -> hxxp://www-searching.com/search.aspx?site=shdefault1&prd=smw&pid=s&shr=d&q={searchTerms}&s=G7Ezamotn19312AR,53cd74a7-93c0-4b30-809a-74b33538bbb0,
CHR DefaultSearchKeyword: Default -> www-searching.com
CHR DefaultSuggestURL: Default -> hxxp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
S2 AdVPN Service; C:\Program Files (x86)\AdVPN\AdVpnService.exe [X]
S2 AdVpnProxyService; C:\Program Files (x86)\AdVpnProxyService\AdVpnProxyService.exe [X]
S2 GTFPOQUOTT Updater; C:\Program Files (x86)\GTFPOQUOTT Updater\GTFPOQUOTT Updater.exe [X]
U3 idsvc; no ImagePath
C:\Program Files (x86)\attainment
End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and include the Addition.txt log that was created by the Farbar tool for my review.

Let me know what problem persists.

#3 zero.81

zero.81
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:29 PM

Posted 28 August 2016 - 11:07 AM

Fix result of Farbar Recovery Scan Tool (x64) Version: 27-08-2016
Ran by Dallas (28-08-2016 10:51:22) Run:2
Running from C:\Users\Dallas\Downloads
Loaded Profiles: Dallas (Available Profiles: Dallas & DefaultAppPool)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
start
 
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
 
HKLM\...\Run: [outvote] => "C:\Program Files (x86)\attainment\campos.exe"
HKLM-x32\...\Run: [ricki] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [ibis] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [suggestiveness] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [strassburger] => "C:\Program Files (x86)\attainment\campos.exe"
CHR DefaultSearchURL: Default -> hxxp://www-searching.com/search.aspx?site=shdefault1&prd=smw&pid=s&shr=d&q={searchTerms}&s=G7Ezamotn19312AR,53cd74a7-93c0-4b30-809a-74b33538bbb0,
CHR DefaultSearchKeyword: Default -> www-searching.com
CHR DefaultSuggestURL: Default -> hxxp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
S2 AdVPN Service; C:\Program Files (x86)\AdVPN\AdVpnService.exe [X]
S2 AdVpnProxyService; C:\Program Files (x86)\AdVpnProxyService\AdVpnProxyService.exe [X]
S2 GTFPOQUOTT Updater; C:\Program Files (x86)\GTFPOQUOTT Updater\GTFPOQUOTT Updater.exe [X]
U3 idsvc; no ImagePath
C:\Program Files (x86)\attainment
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\outvote => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ricki => value removed successfully
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ibis => value removed successfully
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\Software\Microsoft\Windows\CurrentVersion\Run\\suggestiveness => value removed successfully
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\Software\Microsoft\Windows\CurrentVersion\Run\\strassburger => value removed successfully
Chrome DefaultSearchURL => removed successfully
Chrome DefaultSearchKeyword => removed successfully
Chrome DefaultSuggestURL => removed successfully
AdVPN Service => service removed successfully
AdVpnProxyService => service removed successfully
GTFPOQUOTT Updater => service removed successfully
idsvc => service removed successfully
C:\Program Files (x86)\attainment => moved successfully
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 602367 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 97103611 B
Java, Flash, Steam htmlcache => 353892780 B
Windows/system/drivers => 20285360 B
Edge => 1101836 B
Chrome => 1624391278 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 6144 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 33538 B
NetworkService => 156686 B
Dallas => 393826874 B
DefaultAppPool => 6144 B
 
RecycleBin => 2030 B
EmptyTemp: => 2.3 GB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 10:51:47 ====
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-08-2016 01
Ran by Dallas (26-08-2016 11:29:27)
Running from C:\Users\Dallas\Downloads
Windows 10 Pro Version 1511 (X64) (2016-06-26 00:46:14)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-1170261049-2036437327-1132982665-500 - Administrator - Disabled)
Dallas (S-1-5-21-1170261049-2036437327-1132982665-1000 - Administrator - Enabled) => C:\Users\Dallas
DefaultAccount (S-1-5-21-1170261049-2036437327-1132982665-503 - Limited - Disabled)
Guest (S-1-5-21-1170261049-2036437327-1132982665-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1170261049-2036437327-1132982665-1002 - Limited - Enabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
1001 Spikes (HKLM\...\Steam App 260790) (Version:  - Nicalis, Inc.)
A Boy and His Blob (HKLM\...\Steam App 281200) (Version:  - Abstraction Games)
A Fistful of Gun (HKLM\...\Steam App 229810) (Version:  - FarmerGnome)
Absolute Drift (HKLM\...\Steam App 320140) (Version:  - Funselektor Labs Inc.)
Abyss Odyssey (HKLM-x32\...\Steam App 255070) (Version:  - ACE Team)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.017.20053 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)
Andy OS (HKLM\...\Andy OS) (Version: 0.45.0.0 - Andy OS, Inc)
Ansel (Version: 368.81 - NVIDIA Corporation) Hidden
Apple Application Support (32-bit) (HKLM-x32\...\{D4B07658-F443-4445-A261-E643996E139D}) (Version: 4.3.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{A6B0442B-E159-444B-B49D-6B9AC531EAE3}) (Version: 4.3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
ARK: Survival Evolved (HKLM\...\Steam App 346110) (Version:  - Studio Wildcard)
Asmedia USB Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.23.0 - Asmedia Technology)
Banished (HKLM-x32\...\Steam App 242920) (Version:  - Shining Rock Software LLC)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.0 - EA Digital Illusions CE AB)
Blacksea Odyssey Demo (HKLM\...\Steam App 480470) (Version:  - Blacksea Odyssey)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Broforce (HKLM-x32\...\Steam App 274190) (Version:  - Free Lives)
Bulb Boy (HKLM\...\Steam App 390290) (Version:  - Bulbware)
Cities: Skylines (HKLM-x32\...\Steam App 255710) (Version:  - Colossal Order Ltd.)
Craft The World (HKLM-x32\...\Steam App 248390) (Version:  - Dekovir Entertainment)
Crashlands (HKLM-x32\...\Steam App 391730) (Version:  - Butterscotch Shenanigans)
Curse Client (HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\101a9f93b8f0bb6f) (Version: 5.1.1.844 - Curse)
Darkest Dungeon (HKLM\...\Steam App 262060) (Version:  - Red Hook Studios)
Deathstate (HKLM\...\Steam App 402120) (Version:  - Workinman Interactive, LLC.)
Deathtrap (HKLM\...\Steam App 310510) (Version:  - NeocoreGames)
Deluge 1.3.13 (HKLM-x32\...\Deluge) (Version:  - )
Deponia: The Complete Journey (HKLM\...\Steam App 292910) (Version:  - Daedalic Entertainment)
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Discord (HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Discord) (Version: 0.0.296 - Hammer & Chisel, Inc.)
Don't Starve Together (HKLM\...\Steam App 322330) (Version:  - Klei Entertainment)
DOOM (HKLM\...\Steam App 379720) (Version:  - id Software)
Dropsy (HKLM\...\Steam App 274350) (Version:  - Tendershoot)
Dungeons 2 (HKLM-x32\...\Steam App 262280) (Version:  - Realmforge Studios)
Enter the Gungeon (HKLM\...\Steam App 311690) (Version:  - Dodge Roll)
Epic Games Launcher (HKLM-x32\...\{A1C97AE7-FB6B-425F-B75B-7A16E1E5639D}) (Version: 1.1.52.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Epistory - Typing Chronicles (HKLM\...\Steam App 398850) (Version:  - Fishing Cactus)
Evoland 2 (HKLM\...\Steam App 359310) (Version:  - Shiro Games)
Faeria (HKLM\...\Steam App 397060) (Version:  - Abrakam SA)
Fallout 4 (HKLM-x32\...\Steam App 377160) (Version:  - Bethesda Game Studios)
Far Cry 4 (HKLM-x32\...\Steam App 298110) (Version:  - Ubisoft Montreal, Red Storm, Shanghai, Toronto, Kiev)
Far Cry Primal (HKLM\...\Steam App 371660) (Version:  - Ubisoft)
Gods Will Be Watching (HKLM\...\Steam App 274290) (Version:  - Deconstructeam)
Golf With Your Friends (HKLM\...\Steam App 431240) (Version:  - Blacklight Interactive)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 52.0.2743.116 - Google Inc.)
Google Drive (HKLM-x32\...\{459CE109-4E46-4340-92BC-054642BC3BC2}) (Version: 1.31.2873.2758 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Grand Theft Auto V (HKLM-x32\...\Steam App 271590) (Version:  - Rockstar North)
Grim Dawn (HKLM\...\Steam App 219990) (Version:  - Crate Entertainment)
Grim Dawn (HKLM-x32\...\Steam App 219990) (Version:  - Crate Entertainment)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Hero Siege (HKLM-x32\...\Steam App 269210) (Version:  - Elias Viglione)
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version:  - Blizzard Entertainment)
HL-L2305 series (HKLM-x32\...\{46B58839-2405-48D6-A59D-F8246158A6ED}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
Human Resource Machine (HKLM\...\Steam App 375820) (Version:  - Tomorrow Corporation)
Influent (HKLM\...\Steam App 274980) (Version:  - Rob Howland)
Intel® Chipset Device Software (x32 Version: 10.0.20 - Intel® Corporation) Hidden
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.0.1204 - Intel Corporation)
Intel® Network Connections 19.1.51.0 (HKLM\...\PROSetDX) (Version: 19.1.51.0 - Intel)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3910 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.1.0.1058 - Intel Corporation)
Ironcast (HKLM-x32\...\Steam App 327670) (Version:  - Dreadbit)
iTunes (HKLM\...\{955524E7-79EB-4CA9-BA4D-FD2DF587651B}) (Version: 12.4.3.1 - Apple Inc.)
Java 8 Update 101 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
Killing Floor 2 (HKLM-x32\...\Steam App 232090) (Version:  - Tripwire Interactive)
K-Lite Codec Pack 9.4.0 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.4.0 - )
Launcher Prerequisites (x64) (x32 Version: 1.0.0.0 - Epic Games, Inc.) Hidden
LEGO® Worlds (HKLM\...\Steam App 332310) (Version:  - TT Games)
Lethis - Path of Progress (HKLM-x32\...\Steam App 359230) (Version:  - Triskell Interactive)
Logitech Gaming Software 8.83 (HKLM\...\Logitech Gaming Software) (Version: 8.83.85 - Logitech Inc.)
LYNE (HKLM\...\Steam App 266010) (Version:  - Thomas Bowker)
Malwarebytes Anti-Exploit version 1.8.1.2572 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.8.1.2572 - Malwarebytes)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Games for Windows - LIVE (HKLM-x32\...\{F97E3841-CA9D-4964-9D64-26066241D26F}) (Version: 3.3.24.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 (HKLM-x32\...\{2e085fd2-a3e4-4b39-8e10-6b8d35f55244}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Middle-earth: Shadow of Mordor (HKLM\...\Steam App 241930) (Version:  - Monolith Productions, Inc.)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
MiniTool Partition Wizard Free 9.1 (HKLM\...\{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1) (Version:  - MiniTool Solution Ltd.)
MSI Kombustor 2.5.9 (HKLM-x32\...\{0B7C79A5-5CB2-4ABD-A9C1-92A6213CE8DD}_is1) (Version:  - MSI Co., LTD)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MultiWall version 1.0.29 (HKLM-x32\...\{54384F46-6346-4BDC-A137-4D4037D362D3}_is1) (Version: 1.0.29 - MultiWall)
Mumble 1.2.16 (HKLM-x32\...\{8C0C80AA-EA4D-4461-8B73-15A3A27F7D98}) (Version: 1.2.16 - Thorvald Natvig)
MURDERED: SOUL SUSPECT™ (HKLM-x32\...\Steam App 233290) (Version:  - Airtight Games)
NOT A HERO (HKLM\...\Steam App 274270) (Version:  - Roll7)
Nuclear Throne (HKLM\...\Steam App 242680) (Version:  - Vlambeer)
NVIDIA 3D Vision Controller Driver 364.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 364.44 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 368.81 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 368.81 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.11.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.4.0 - NVIDIA Corporation)
NVIDIA Graphics Driver 368.81 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 368.81 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.34.15 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.15 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
Okhlos (HKLM\...\Steam App 400180) (Version:  - Coffee Powered Machine)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Origin (HKLM-x32\...\Origin) (Version: 9.5.20.5318 - Electronic Arts, Inc.)
Overwatch (HKLM-x32\...\Overwatch) (Version:  - Blizzard Entertainment)
Paint it Back (HKLM\...\Steam App 385250) (Version:  - Casual Labs)
Papers, Please (HKLM\...\Steam App 239030) (Version:  - 3909)
Path of Exile (HKLM\...\Steam App 238960) (Version:  - Grinding Gear Games)
Plex Media Server (HKLM-x32\...\{0ea202e3-5f78-4471-b853-d8164a911147}) (Version: 0.9.1604 - Plex, Inc.)
Plex Media Server (x32 Version: 0.9.1604 - Plex, Inc.) Hidden
Prison Architect (HKLM-x32\...\Steam App 233450) (Version:  - Introversion Software)
Puzzle Agent (HKLM\...\Steam App 31270) (Version:  - Telltale Games)
Puzzle Agent 2 (HKLM\...\Steam App 94590) (Version:  - Telltale Games)
Puzzle Quest 2 (HKLM\...\Steam App 47540) (Version:  - Infinite Interactive)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Reassembly (HKLM-x32\...\Steam App 329130) (Version:  - Anisoptera Games)
Renowned Explorers: International Society (HKLM-x32\...\Steam App 296970) (Version:  - Abbey Games)
Risk of Rain (HKLM\...\Steam App 248820) (Version:  - Hopoo Games, LLC)
ROCCAT Kone Pure Optical Mouse Driver (HKLM-x32\...\{22D40E66-0D41-45A3-A8A1-90B8A38D9A68}) (Version:  - Roccat GmbH)
Roccat Talk (HKLM-x32\...\{605D671E-1D1E-4840-84D9-BFACE17F160D}) (Version: 1.00.0015 - Roccat GmbH)
Rocket League (HKLM\...\Steam App 252950) (Version:  - Psyonix, Inc.)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.6.5 - Rockstar Games)
Roguelands (HKLM\...\Steam App 364420) (Version:  - SmashGames)
RONIN (HKLM\...\Steam App 274230) (Version:  - Tomasz Wacławek)
Scribblenauts Unlimited (HKLM-x32\...\Steam App 218680) (Version:  - 5th Cell Media)
Seraph (HKLM\...\Steam App 425670) (Version:  - Dreadbit)
Serious Sam HD: The First Encounter (HKLM-x32\...\Steam App 41000) (Version:  - Croteam)
Shantae: Risky's Revenge - Director's Cut (HKLM\...\Steam App 277890) (Version:  - WayForward)
ShellShock Live (HKLM\...\Steam App 326460) (Version:  - kChamp Games)
Sheltered (HKLM-x32\...\Steam App 356040) (Version:  - Unicube)
SHIELD Streaming (Version: 7.1.0280 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.11.4.0 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM\...\Steam App 8930) (Version:  - Firaxis Games)
Sid Meier's Civilization V (HKLM-x32\...\steam app 8930) (Version:  - 2K Games, Inc.)
Sid Meier's Civilization: Beyond Earth (HKLM\...\Steam App 65980) (Version:  - Firaxis Games)
Skype™ 7.26 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.26.101 - Skype Technologies S.A.)
Snakebird (HKLM\...\Steam App 357300) (Version:  - Noumenon Games)
Solitairica (HKLM\...\Steam App 463980) (Version:  - Righteous Hammer Games)
SOMA (HKLM-x32\...\Steam App 282140) (Version:  - Frictional Games)
Soul Axiom (HKLM\...\Steam App 279900) (Version:  - Wales Interactive)
Starbound (HKLM-x32\...\Steam App 211820) (Version:  - )
Stardew Valley (HKLM\...\Steam App 413150) (Version:  - ConcernedApe)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SteamWorld Heist (HKLM\...\Steam App 322190) (Version:  - Image & Form)
Stonehearth (HKLM-x32\...\Steam App 253250) (Version:  - Radiant Entertainment)
Street Fighter V (HKLM\...\Steam App 310950) (Version:  - Capcom)
Subnautica (HKLM\...\Steam App 264710) (Version:  - Unknown Worlds Entertainment)
Sven Co-op (HKLM-x32\...\Steam App 225840) (Version:  - Sven Co-op Team)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
Terraria (HKLM\...\Steam App 105600) (Version:  - Re-Logic)
The Binding of Isaac: Rebirth (HKLM-x32\...\Steam App 250900) (Version:  - Nicalis, Inc.)
The Escapists (HKLM-x32\...\Steam App 298630) (Version:  - Mouldy Toof Studios)
The Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.20.60.1020 - Electronic Arts Inc.)
The Vanishing of Ethan Carter Redux (HKLM-x32\...\Steam App 400430) (Version:  - The Astronauts)
The Witcher 3: Wild Hunt (HKLM\...\Steam App 292030) (Version:  - CD PROJEKT RED)
Tick Tock Isle (HKLM-x32\...\Steam App 418440) (Version:  - Squiddershins)
Titan Souls (HKLM\...\Steam App 297130) (Version:  - Acid Nerve)
TowerFall Ascension (HKLM\...\Steam App 251470) (Version:  - Matt Thorson)
TradeSkillMaster Application version 1.0 (HKLM-x32\...\{c44da794-b956-4d50-8733-346d56ae63c7}_is1) (Version: 1.0 - TradeSkillMaster)
Tukui Client (HKLM-x32\...\{BAD6EBBD-A6A9-41C9-898A-8C868A552E4C}) (Version: 2.4.6 - Tukui)
Undertale (HKLM-x32\...\Steam App 391540) (Version:  - tobyfox)
Unepic (HKLM-x32\...\Steam App 233980) (Version:  - Francisco Téllez de Meneses)
Unity Web Player (HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\UnityWebPlayer) (Version: 5.0.3f2 - Unity Technologies ApS)
Uplay (HKLM-x32\...\Uplay) (Version: 12.0 - Ubisoft)
Valkyria Chronicles™ (HKLM-x32\...\Steam App 294860) (Version:  - SEGA)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.2 - VideoLAN)
Vulkan Run Time Libraries 1.0.11.1 (HKLM\...\VulkanRT1.0.11.1) (Version: 1.0.11.1 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.3.0 (HKLM\...\VulkanRT1.0.3.0) (Version: 1.0.3.0 - LunarG, Inc.)
WinISO (HKLM-x32\...\WinISO) (Version: 6.4.0.5170 - WinISO Computing Inc.)
WinRAR 5.21 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
Wolfenstein: The New Order (HKLM-x32\...\Steam App 201810) (Version:  - Machine Games)
Wolfenstein: The Old Blood  (HKLM-x32\...\Steam App 350080) (Version:  - MachineGames)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)
Ziggurat (HKLM-x32\...\Steam App 308420) (Version:  - Milkstone Studios)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-1170261049-2036437327-1132982665-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Dallas\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\FileCoAuth.exe (Microsoft Corporation)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {04D2BA2F-639C-48D8-871C-23919056D0A6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {0622C44A-1117-4F97-9D7B-F3F104A47853} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {0A272C69-C745-44D0-993C-3F85FBC4F0A5} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {0C10E140-DC61-47FF-9ABC-AE6881F39774} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {14AFC03C-01F5-49A8-8978-42A3E63A617A} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {14F5D8A8-5A5E-4BC4-A57C-365E09CD19D9} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {166FE572-C86D-4DDF-B2D6-3CFB1AFC9036} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {1BD0E1A8-C93B-4034-AFB7-C8534AB785A5} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {1EED893B-6A71-4280-80AD-20471840E909} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {20FDAC89-F0A5-47E7-860A-13A86902BBD2} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-06-25] (Adobe Systems Incorporated)
Task: {2100A31C-007E-47B6-8ACA-C8E49674D912} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {374F4FE7-7E2D-42FD-B6DD-0E05292FA71B} - System32\Tasks\Da90702549070254 => C:\Program Files (x86)\attainment\campos.exe
Task: {386BF584-E3C0-4679-9230-EC5B151DD107} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {3AC9DF34-C4A5-4625-9A99-444ABB6CE0A6} - \{0A0F0F47-0F7E-0E0D-0A11-040B0B7F1105} -> No File <==== ATTENTION
Task: {3E91710A-2FE9-44CF-B945-0369A46A071E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-19] (Google Inc.)
Task: {430337AA-1E9B-4582-8361-AA70F473E949} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
Task: {44213850-5735-48DD-832C-D02CDA35F76E} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {46BB9B07-5D5D-4359-96B6-515E9A07A83E} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {49CF895F-9E46-4547-AF80-E40C4EE0ED3E} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {4A0433EC-484F-42C3-A9D8-C5EC219EB104} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {4C893B0B-F063-4D37-9A91-0BB080B36F26} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-19] (Google Inc.)
Task: {4E0BB1EA-F39D-476D-8C3E-33ADAC97E158} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {5EA4C4F5-6F94-4989-97CD-23A010DCFDB9} - \DriverNavigator Scheduled Scan -> No File <==== ATTENTION
Task: {6288ECE8-27EA-4A45-86FA-8D8D59DCA313} - \9070254 -> No File <==== ATTENTION
Task: {6E4A716E-322E-4EB3-B7BF-248782B641A8} - \{6BD0954A-5C1F-4D08-9FCC-4C05F92E739C} -> No File <==== ATTENTION
Task: {72A72682-1EFF-4968-A177-649CAF53CCCA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {7A4FA514-5799-4ACA-B86D-40002F76E4A1} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {89E7129E-57D0-4009-B587-33ABAAA5DBF2} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {9AB1DD01-C9E9-4561-A8CB-91FEAFC06FE7} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-08-10] (Microsoft Corporation)
Task: {9CD103CF-BA10-4740-A6E0-C0E6340D5BB3} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {A7A4AE11-23B7-49B6-8D41-17F1976CA2AB} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {AC69F4CD-4973-4A4B-AA0D-5F3CB25B720E} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {B27D24B1-AD1A-4D5D-BEA7-A65F64259909} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {BC5074A1-96CF-4C29-B600-977195626F54} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {BD5C508A-2257-4CEF-ABA4-D51295EBF8DF} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {C08D608A-53D5-492E-A076-94EEC64136EA} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {C45973CF-6A37-4ABA-8B2D-D107E56C4FC3} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {D0C49CEF-19EA-4964-91D2-8A1ACF92FF9F} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {D1BD66FB-523F-4D33-B8F6-FFC533BFAD73} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {D4CFF232-BFC6-41F2-B5C5-D57E80A769B5} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {E11F1D9B-6C97-40E5-AC41-DA89CBFA7BD9} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {EA889958-7286-4F20-BB94-3A636A830555} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {F0AA29C3-B44A-4D8B-B5E0-7371AF000854} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {FBB0BEBA-84FF-4CC2-9DC0-328A166390F8} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\DriverNavigator Scheduled Scan.job => C:\Program Files\Easeware\DriverNavigator\DriverNavigator.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
ShortcutWithArgument: C:\Users\Dallas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\App Launcher for Messenger.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=bllmngcdibgbgjnginpehneeofhbmdjm
ShortcutWithArgument: C:\Users\Dallas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Entanglement.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=cmnpffgfpcohhpoddjankjanolcekbni
ShortcutWithArgument: C:\Users\Dallas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Hangouts.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=knipolnnllmklapflnccelgolnpehhpl
ShortcutWithArgument: C:\Users\Dallas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Play Music.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=fahmaaghhglfmonjliepjlchgpgfmobi
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-10-30 02:18 - 2015-10-30 02:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-06-25 19:41 - 2016-07-10 17:58 - 00133056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-07-05 15:23 - 2016-07-05 15:23 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-06-25 19:41 - 2014-01-27 22:16 - 00936728 _____ () C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
2016-03-05 19:44 - 2016-06-14 15:03 - 00367552 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\MessageBus.dll
2015-12-20 18:59 - 2016-06-14 15:03 - 00288192 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamBase.dll
2016-04-03 00:22 - 2016-06-14 15:03 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\libprotobuf.dll
2016-03-05 19:44 - 2016-06-14 15:03 - 03611584 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Poco.dll
2015-06-19 07:08 - 2014-04-24 01:29 - 01360016 ____R () C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe
2016-04-03 00:22 - 2016-06-14 15:03 - 02665920 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvMdnsPlugin.dll
2016-04-03 00:22 - 2016-06-14 15:03 - 01988544 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvPortForwardPlugin.dll
2016-04-03 00:22 - 2016-06-14 15:03 - 01840576 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\RtspPlugin.dll
2016-02-12 10:45 - 2016-06-14 15:03 - 00207296 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\RtspServer.dll
2016-07-12 20:59 - 2016-06-30 23:48 - 02656408 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-07-12 20:59 - 2016-06-30 23:48 - 02656408 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-06-25 19:49 - 2016-06-25 19:49 - 00959168 _____ () C:\Users\Dallas\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64\ClientTelemetry.dll
2016-07-12 20:59 - 2016-06-30 22:21 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-07-12 20:59 - 2016-06-30 22:22 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-07-12 20:59 - 2016-06-30 23:48 - 02656408 _____ () C:\Windows\System32\CoreUIComponents.dll
2016-04-18 18:00 - 2016-04-18 18:01 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-04-03 00:22 - 2016-06-14 15:03 - 00034240 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_system-vc120-mt-1_58.dll
2016-04-03 00:22 - 2016-06-14 15:03 - 00920000 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_regex-vc120-mt-1_58.dll
2016-04-27 01:10 - 2016-04-27 01:10 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-07-12 21:00 - 2016-06-30 22:48 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-07-12 20:59 - 2016-06-30 22:27 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-07-12 20:59 - 2016-06-30 22:22 - 00936960 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-07-12 20:59 - 2016-06-30 22:24 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-03-06 19:07 - 2015-03-06 19:07 - 00908568 _____ () C:\Program Files\Logitech Gaming Software\libGLESv2.dll
2016-04-28 17:49 - 2016-04-28 17:49 - 01095448 _____ () C:\Program Files\Logitech Gaming Software\platforms\qwindows.dll
2015-03-06 19:07 - 2015-03-06 19:07 - 00060184 _____ () C:\Program Files\Logitech Gaming Software\libEGL.dll
2016-04-28 17:49 - 2016-04-28 17:49 - 00240408 _____ () C:\Program Files\Logitech Gaming Software\imageformats\qjpeg.dll
2016-08-15 22:36 - 2016-08-15 22:36 - 01623040 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\TSMApplication.exe
2016-08-08 15:44 - 2016-08-02 18:41 - 02366280 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libglesv2.dll
2016-08-08 15:44 - 2016-08-02 18:40 - 00107848 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libegl.dll
2016-08-16 06:35 - 2016-08-16 06:35 - 00017408 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.722.10060.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2016-08-16 06:35 - 2016-08-16 06:35 - 13475840 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.722.10060.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2016-06-03 06:13 - 2016-06-03 06:14 - 00680448 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.722.10060.0_x64__8wekyb3d8bbwe\Microsoft.DesignCore.dll
2016-03-03 21:50 - 2016-03-03 21:50 - 00291328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.722.10060.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2016-08-25 01:42 - 2016-08-25 01:42 - 03763712 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1608.2213.0_x64__8wekyb3d8bbwe\Calculator.exe
2016-04-26 23:52 - 2016-04-26 23:52 - 00016384 _____ () C:\Users\Dallas\AppData\Local\Apps\2.0\XYPRMGLP.W6W\A8RG3P5J.QN0\curs..tion_9e9e83ddf3ed3ead_0005.0001_fb8944c2684f5b6c\Curse.CurseClient.WowDb.dll
2016-04-26 23:52 - 2016-04-26 23:52 - 00035840 _____ () C:\Users\Dallas\AppData\Local\Apps\2.0\XYPRMGLP.W6W\A8RG3P5J.QN0\curs..tion_9e9e83ddf3ed3ead_0005.0001_fb8944c2684f5b6c\Curse.Advertising.dll
2016-04-26 23:52 - 2016-04-26 23:52 - 00099840 _____ () C:\Users\Dallas\AppData\Local\Apps\2.0\XYPRMGLP.W6W\A8RG3P5J.QN0\curs..tion_9e9e83ddf3ed3ead_0005.0001_fb8944c2684f5b6c\Curse.CurseClient.CMOD2.dll
2016-08-26 00:26 - 2016-08-26 00:26 - 04746240 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1608.2312.0_x64__8wekyb3d8bbwe\Time.exe
2016-08-26 00:26 - 2016-08-26 00:26 - 01413120 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1608.2312.0_x64__8wekyb3d8bbwe\TimeBackground.dll
2016-06-25 19:41 - 2016-08-23 00:15 - 00040080 _____ () C:\Program Files (x86)\ASUS\AXSP\1.02.00\PEbiosinterface32.dll
2016-06-25 19:41 - 2014-01-27 22:16 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.02.00\ATKEX.dll
2016-04-18 18:00 - 2016-04-18 18:01 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-04-18 18:00 - 2016-04-18 18:01 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2015-06-19 09:04 - 2016-06-14 15:03 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-06-25 19:48 - 2016-06-25 19:48 - 00679624 _____ () C:\Users\Dallas\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\ClientTelemetry.dll
2016-08-15 22:36 - 2016-08-15 22:36 - 00783360 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\_hashlib.pyd
2016-08-15 22:36 - 2016-08-15 22:36 - 00047104 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\_socket.pyd
2016-08-15 22:36 - 2016-08-15 22:36 - 00009728 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\select.pyd
2016-08-15 22:36 - 2016-08-15 22:36 - 00758784 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\unicodedata.pyd
2016-08-15 22:36 - 2016-08-15 22:36 - 00084992 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\_ctypes.pyd
2016-08-15 22:36 - 2016-08-15 22:36 - 00053760 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\_bz2.pyd
2016-08-15 22:36 - 2016-08-15 22:36 - 01861120 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\PyQt5.QtCore.pyd
2016-08-15 22:36 - 2016-08-15 22:36 - 00075264 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\sip.pyd
2016-08-15 22:36 - 2016-08-15 22:36 - 00137216 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\_lzma.pyd
2016-08-15 22:36 - 2016-08-15 22:36 - 02002944 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\PyQt5.QtGui.pyd
2016-08-15 22:36 - 2016-08-15 22:36 - 04101120 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\PyQt5.QtWidgets.pyd
2016-08-15 22:36 - 2016-08-15 22:36 - 00039424 _____ () C:\Program Files (x86)\TradeSkillMaster Application\app\psutil._psutil_windows.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00098816 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32api.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00110080 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\pywintypes27.dll
2016-08-23 00:16 - 2016-08-23 00:16 - 00364544 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\pythoncom27.dll
2016-08-23 00:16 - 2016-08-23 00:16 - 00320512 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32com.shell.shell.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00776704 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\_hashlib.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 01176576 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\wx._core_.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00806400 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\wx._gdi_.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00816128 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\wx._windows_.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 01067008 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\wx._controls_.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00733184 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\wx._misc_.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00682496 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\pysqlite2._sqlite.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00088064 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\_ctypes.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00119808 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32file.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00108544 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32security.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00007168 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\hashobjs_ext.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00017920 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\thumbnails_ext.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00088064 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\usb_ext.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00012800 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\common.time34.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00018432 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32event.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00167936 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32gui.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00046080 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\_socket.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 01208320 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\_ssl.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00128512 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\_elementtree.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00127488 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\pyexpat.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00038912 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32inet.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00036864 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\_psutil_windows.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00525208 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\windows._lib_cacheinvalidation.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00011264 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32crypt.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00077312 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\wx._html2.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00027136 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\_multiprocessing.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00020480 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\_yappi.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00035840 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32process.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00686080 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\unicodedata.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00078848 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\wx._animate.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00123392 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\wx._wizard.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00024064 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32pipe.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00010240 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\select.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00025600 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32pdh.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00017408 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32profile.pyd
2016-08-23 00:16 - 2016-08-23 00:16 - 00022528 ____R () C:\Users\Dallas\AppData\Local\Temp\_MEI99722\win32ts.pyd
2015-06-19 16:50 - 2012-10-01 18:53 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Kone Pure Optical Mouse\hiddriver.dll
2016-05-04 17:03 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-03-20 11:43 - 2014-03-20 11:43 - 01241560 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2015-06-19 09:28 - 2016-08-08 18:27 - 00785920 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-06-19 09:28 - 2015-07-01 17:06 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-06-19 09:28 - 2016-08-23 14:33 - 02321184 _____ () C:\Program Files (x86)\Steam\video.dll
2015-06-19 09:28 - 2015-07-01 17:06 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-06-19 09:28 - 2015-07-01 17:06 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2015-06-19 09:28 - 2016-01-27 02:49 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2015-06-19 09:28 - 2016-01-27 02:49 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2015-06-19 09:28 - 2016-01-27 02:49 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2015-06-19 09:28 - 2016-01-27 02:49 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2015-06-19 09:28 - 2016-01-27 02:49 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2015-06-19 09:28 - 2016-08-23 14:33 - 00835360 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2016-03-09 00:34 - 2016-07-04 17:17 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2015-06-19 09:28 - 2016-08-04 15:56 - 49825056 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2015-06-19 09:28 - 2015-09-24 18:52 - 00119208 _____ () C:\Program Files (x86)\Steam\winh264.dll
2016-08-18 12:02 - 2016-08-01 13:11 - 01950392 _____ () C:\Users\Dallas\AppData\Local\Discord\app-0.0.295\ffmpeg.dll
2016-08-18 12:02 - 2016-08-18 12:02 - 01043640 _____ () \\?\C:\Users\Dallas\AppData\Roaming\discord\0.0.295\modules\discord_voice\discord_voice.node
2016-08-18 12:02 - 2016-08-18 12:02 - 03784376 _____ () \\?\C:\Users\Dallas\AppData\Roaming\discord\0.0.295\modules\discord_voice\libdiscord.dll
2016-08-18 12:02 - 2016-08-18 12:02 - 00887992 _____ () \\?\C:\Users\Dallas\AppData\Roaming\discord\0.0.295\modules\discord_utils\discord_utils.node
2016-08-18 12:02 - 2016-08-18 12:02 - 00775864 _____ () \\?\C:\Users\Dallas\AppData\Roaming\discord\0.0.295\modules\discord_toaster\discord_toaster.node
2016-08-18 12:02 - 2016-08-01 13:11 - 02230456 _____ () C:\Users\Dallas\AppData\Local\Discord\app-0.0.295\libglesv2.dll
2016-08-18 12:02 - 2016-08-01 13:11 - 00088760 _____ () C:\Users\Dallas\AppData\Local\Discord\app-0.0.295\libegl.dll
2016-08-23 15:42 - 2016-08-23 15:42 - 00170496 _____ () \\?\C:\Users\Dallas\AppData\Local\Temp\4885.tmp.node
2016-08-24 02:33 - 2016-08-24 02:33 - 00958464 _____ () C:\Program Files\WindowsApps\Microsoft.BingWeather_4.13.47.0_x86__8wekyb3d8bbwe\SQLite3Wrapper.dll
2015-09-09 09:24 - 2015-09-09 09:24 - 00645120 _____ () C:\Program Files\WindowsApps\Microsoft.BingWeather_4.13.47.0_x86__8wekyb3d8bbwe\Microsoft.Aria.ClientTelemetry.dll
2016-08-24 02:33 - 2016-08-24 02:33 - 03312024 _____ () C:\Program Files\WindowsApps\Microsoft.BingWeather_4.13.47.0_x86__8wekyb3d8bbwe\Microsoft.Advertising.dll
2016-08-24 02:33 - 2016-08-24 02:33 - 00958464 _____ () C:\Program Files\WindowsApps\Microsoft.BingFinance_4.13.47.0_x86__8wekyb3d8bbwe\SQLite3Wrapper.dll
2015-09-09 09:24 - 2015-09-09 09:24 - 00645120 _____ () C:\Program Files\WindowsApps\Microsoft.BingFinance_4.13.47.0_x86__8wekyb3d8bbwe\Microsoft.Aria.ClientTelemetry.dll
2016-08-24 02:33 - 2016-08-24 02:33 - 03312024 _____ () C:\Program Files\WindowsApps\Microsoft.BingFinance_4.13.47.0_x86__8wekyb3d8bbwe\Microsoft.Advertising.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 21:34 - 2016-08-15 09:06 - 00000844 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Dallas\AppData\Roaming\MultiWall\wallpaper.bmp
DNS Servers: 8.8.8.8 - 8.8.4.4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\StartupApproved\StartupFolder: => "CurseClientStartup.ccip"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{115B7E3B-6852-42CF-B578-429E36527B29}] => (Allow) F:\OriginLibrary\The Sims 4\Game\Bin\TS4_x64.exe
FirewallRules: [{68D5FBE2-6486-4BDB-96A9-C137A598D527}] => (Allow) F:\OriginLibrary\The Sims 4\Game\Bin\TS4_x64.exe
FirewallRules: [{F43FCEBA-0F42-4519-9D71-766FCDFD040D}] => (Allow) F:\OriginLibrary\The Sims 4\Game\Bin\TS4.exe
FirewallRules: [{DE9F8D78-AFB7-4347-A307-F709AB8C3103}] => (Allow) F:\OriginLibrary\The Sims 4\Game\Bin\TS4.exe
FirewallRules: [{026E0B1B-BBC4-4E51-AF08-028536C054FC}] => (Allow) E:\SteamLibrary\steamapps\common\LYNE\LYNE.exe
FirewallRules: [{AAA377C0-355C-4D75-ACB3-DC4DED0FA1CE}] => (Allow) E:\SteamLibrary\steamapps\common\LYNE\LYNE.exe
FirewallRules: [{22D538EA-39D0-49E5-9E33-DBD8040B1829}] => (Allow) E:\SteamLibrary\steamapps\common\Seraph\Seraph.exe
FirewallRules: [{A8E397D2-322D-44C3-A257-8C8D9B0093C8}] => (Allow) E:\SteamLibrary\steamapps\common\Seraph\Seraph.exe
FirewallRules: [{DC8A36BE-8034-4A81-AEF9-164DE7EC0EBF}] => (Allow) E:\SteamLibrary\steamapps\common\Paint it Back\pib.exe
FirewallRules: [{95F5E611-48E2-40A4-B5BA-6AF4E2878C8B}] => (Allow) E:\SteamLibrary\steamapps\common\Paint it Back\pib.exe
FirewallRules: [{10AFADBC-B82E-4545-9EED-3EF5D68A9325}] => (Allow) E:\SteamLibrary\steamapps\common\PapersPlease\PapersPlease.exe
FirewallRules: [{60A7F792-2732-42AA-8EE5-EAC3FF21DA35}] => (Allow) E:\SteamLibrary\steamapps\common\PapersPlease\PapersPlease.exe
FirewallRules: [{0FE580D9-4F3A-439C-A820-94E8992B9F50}] => (Allow) E:\SteamLibrary\steamapps\common\Nuclear Throne\nuclearthrone.exe
FirewallRules: [{92B9DA1A-065E-4F44-B810-F28244B4C468}] => (Allow) E:\SteamLibrary\steamapps\common\Nuclear Throne\nuclearthrone.exe
FirewallRules: [{FE20A9BF-7D1C-4962-91B0-6304BD6F3155}] => (Allow) E:\SteamLibrary\steamapps\common\dont_starve\bin\dontstarve_steam.exe
FirewallRules: [{0692463B-C465-47D5-82E8-D002FE46205C}] => (Allow) E:\SteamLibrary\steamapps\common\dont_starve\bin\dontstarve_steam.exe
FirewallRules: [UDP Query User{DE0FF056-796F-46B7-ACD6-6F310683721A}E:\steamlibrary\steamapps\common\dicetiny\dicetiny\binaries\win32\dicetiny-win32-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\dicetiny\dicetiny\binaries\win32\dicetiny-win32-shipping.exe
FirewallRules: [TCP Query User{AD3223C4-C6CE-40F1-BED8-2713CA8AC885}E:\steamlibrary\steamapps\common\dicetiny\dicetiny\binaries\win32\dicetiny-win32-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\dicetiny\dicetiny\binaries\win32\dicetiny-win32-shipping.exe
FirewallRules: [{B7AF1E65-3D93-449D-9008-B158BF4DAB89}] => (Allow) E:\SteamLibrary\steamapps\common\SteamWorld Heist\Heist.exe
FirewallRules: [{1C27C815-328E-4E88-A371-A565B5C35AEA}] => (Allow) E:\SteamLibrary\steamapps\common\SteamWorld Heist\Heist.exe
FirewallRules: [UDP Query User{D1F6A9CA-A752-4E02-A9E4-79892DEEB2F9}E:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) E:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{45CB8C67-7B20-46CE-AA7E-0505D96CBB6D}E:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) E:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{91137016-D525-47D4-9667-1E69FC1EC9BE}] => (Allow) E:\SteamLibrary\steamapps\common\Subnautica\Subnautica.exe
FirewallRules: [{77F854F3-2A74-42D6-9401-2E92CC5D5BC8}] => (Allow) E:\SteamLibrary\steamapps\common\Subnautica\Subnautica.exe
FirewallRules: [{0DD42B15-FA99-46BA-B292-00DDF79EB056}] => (Allow) E:\SteamLibrary\steamapps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [{99014991-B767-4EFF-A48F-CC49C44AEF8C}] => (Allow) E:\SteamLibrary\steamapps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [{4CDE5242-9924-47DD-B218-008D36DF469D}] => (Allow) E:\SteamLibrary\steamapps\common\BlackseaOdysseyDemo\BlackseaOdyssey.exe
FirewallRules: [{F60001BE-AB37-4907-BD90-15EF20B14083}] => (Allow) E:\SteamLibrary\steamapps\common\BlackseaOdysseyDemo\BlackseaOdyssey.exe
FirewallRules: [UDP Query User{CF210B8E-8DA5-4E36-827B-15E8E8F3E3B0}E:\blizzard games\overwatch\overwatch.exe] => (Allow) E:\blizzard games\overwatch\overwatch.exe
FirewallRules: [TCP Query User{FED48271-4A32-4000-A237-F0C1A975BBE9}E:\blizzard games\overwatch\overwatch.exe] => (Allow) E:\blizzard games\overwatch\overwatch.exe
FirewallRules: [UDP Query User{09119F25-DE18-495F-90A9-40E181B9DC4A}E:\steamlibrary\steamapps\common\solitairica\solitairica\binaries\win32\solitairica-win32-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\solitairica\solitairica\binaries\win32\solitairica-win32-shipping.exe
FirewallRules: [TCP Query User{5173CB13-9B55-495D-B918-316022BF33DF}E:\steamlibrary\steamapps\common\solitairica\solitairica\binaries\win32\solitairica-win32-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\solitairica\solitairica\binaries\win32\solitairica-win32-shipping.exe
FirewallRules: [{A76199AD-C5B7-48FB-8F50-B30A65FFCA49}] => (Allow) E:\SteamLibrary\steamapps\common\Solitairica\Solitairica.exe
FirewallRules: [{D0E092A7-A0A6-4682-8D74-D2D0A99BEF2C}] => (Allow) E:\SteamLibrary\steamapps\common\Solitairica\Solitairica.exe
FirewallRules: [{8B11CA42-396C-44CD-BB59-C687546670B7}] => (Allow) F:\SteamLibrary\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe
FirewallRules: [{EA410A66-B0DE-462D-8FD9-12472B957275}] => (Allow) F:\SteamLibrary\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe
FirewallRules: [{05EEC62C-D625-421D-82CB-12EFC976E236}] => (Allow) E:\SteamLibrary\steamapps\common\Deponia The Complete Journey\VisionaireConfigurationTool.exe
FirewallRules: [{38DC6725-7D50-4928-8E42-02CCDBBD0534}] => (Allow) E:\SteamLibrary\steamapps\common\Deponia The Complete Journey\VisionaireConfigurationTool.exe
FirewallRules: [{6697BB9E-481B-44E7-87F5-C70BB10195C4}] => (Allow) E:\SteamLibrary\steamapps\common\Deponia The Complete Journey\deponia.exe
FirewallRules: [{D3675F70-A9F2-4E1A-A84F-1FA9A600DD48}] => (Allow) E:\SteamLibrary\steamapps\common\Deponia The Complete Journey\deponia.exe
FirewallRules: [{D9275BE7-F03C-4CAE-BA96-F876C2A1E074}] => (Allow) E:\SteamLibrary\steamapps\common\DOOM\DOOMx64.exe
FirewallRules: [{42FF9594-53C6-490B-BE9C-5788A4B88512}] => (Allow) E:\SteamLibrary\steamapps\common\DOOM\DOOMx64.exe
FirewallRules: [UDP Query User{2EC6B5A7-E1F7-48FD-9C8F-2470E23B3EC3}E:\overwatch\overwatch.exe] => (Allow) E:\overwatch\overwatch.exe
FirewallRules: [TCP Query User{C20C513E-308D-48D6-8A85-ECB0671BE4D7}E:\overwatch\overwatch.exe] => (Allow) E:\overwatch\overwatch.exe
FirewallRules: [{FCA9B7B9-A481-4D7A-B35D-15EF3DDD7903}] => (Allow) E:\SteamLibrary\steamapps\common\Deathstate\Deathstate.exe
FirewallRules: [{8D0E259B-658F-4B61-8284-4CE91A35C7EB}] => (Allow) E:\SteamLibrary\steamapps\common\Deathstate\Deathstate.exe
FirewallRules: [{483DA7E8-B918-4549-957A-B754C98CE1CA}] => (Allow) E:\SteamLibrary\steamapps\common\Evoland 2\Evoland2.exe
FirewallRules: [{AEC1C47C-40B6-4BD2-B4A8-B4023C086FC1}] => (Allow) E:\SteamLibrary\steamapps\common\Evoland 2\Evoland2.exe
FirewallRules: [{8B87208E-A1F1-4C50-BE34-6C52BF0D1D63}] => (Allow) E:\SteamLibrary\steamapps\common\TowerFall\TowerFall.exe
FirewallRules: [{3D680CC7-F37A-45E7-A074-7EDE1C5042BE}] => (Allow) E:\SteamLibrary\steamapps\common\TowerFall\TowerFall.exe
FirewallRules: [{37C35506-A690-4A53-8D76-70082557AC9D}] => (Allow) E:\SteamLibrary\steamapps\common\A Boy and His Blob\Blob.exe
FirewallRules: [{350E3207-2812-4CB3-A90D-B1716B5F3C52}] => (Allow) E:\SteamLibrary\steamapps\common\A Boy and His Blob\Blob.exe
FirewallRules: [{340685C1-544C-4F8C-BC0F-F1B9CE88EDCC}] => (Allow) E:\SteamLibrary\steamapps\common\RiskysRevenge\executable\RiskysRevenge.exe
FirewallRules: [{1721648F-25D9-48E6-ACA8-63E77C2A4C17}] => (Allow) E:\SteamLibrary\steamapps\common\RiskysRevenge\executable\RiskysRevenge.exe
FirewallRules: [{B643DEB1-5175-4FE2-86A6-D65727FA5D81}] => (Allow) E:\SteamLibrary\steamapps\common\Human Resource Machine\Human Resource Machine.exe
FirewallRules: [{4392ECA4-8D94-47FF-9601-A98D314D47C5}] => (Allow) E:\SteamLibrary\steamapps\common\Human Resource Machine\Human Resource Machine.exe
FirewallRules: [UDP Query User{C4182E28-BE01-4D9E-B711-A79C646CBAE1}C:\users\dallas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\dallas\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{31A1D1ED-B60A-4309-99A4-EF4D2632194C}C:\users\dallas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\dallas\appdata\roaming\spotify\spotify.exe
FirewallRules: [{156397C4-0BF2-44E5-BBE6-5E11858CEB66}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{FFAAE004-4803-4702-BBAC-6B0736EF96B9}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{1BF87E95-8776-4868-A160-67459D5F3AB2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7F50ADCB-41B2-4395-B669-527BBB12C82C}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7865376E-AF2E-42F5-8200-177FA2995DE6}] => (Allow) E:\SteamLibrary\steamapps\common\Puzzle Agent 2\Grickle102.exe
FirewallRules: [{3BFAD7AA-F1D5-4669-8E31-9A2361F1440A}] => (Allow) E:\SteamLibrary\steamapps\common\Puzzle Agent 2\Grickle102.exe
FirewallRules: [{0D13FC84-F98C-4D22-A8F6-56B470CB1032}] => (Allow) E:\SteamLibrary\steamapps\common\Puzzle Agent\Grickle101.exe
FirewallRules: [{6F6AE00E-6399-45F9-892D-FF164C884119}] => (Allow) E:\SteamLibrary\steamapps\common\Puzzle Agent\Grickle101.exe
FirewallRules: [{E5E4D4F6-FC33-4A78-840D-B5B244A3F402}] => (Allow) E:\SteamLibrary\steamapps\common\Gods Will Be Watching\gwbw.exe
FirewallRules: [{94C7171B-0B21-41A7-9851-522935CDABAC}] => (Allow) E:\SteamLibrary\steamapps\common\Gods Will Be Watching\gwbw.exe
FirewallRules: [{EE7CE258-9C9E-423E-9950-535752CC2307}] => (Allow) E:\SteamLibrary\steamapps\common\Not a Hero\LEGACY.exe
FirewallRules: [{7CE51FF8-74A2-4939-9737-154CA90D1E9C}] => (Allow) E:\SteamLibrary\steamapps\common\Not a Hero\LEGACY.exe
FirewallRules: [{4C556E1A-3244-4180-B9AC-0CECDEE3685E}] => (Allow) E:\SteamLibrary\steamapps\common\Not a Hero\NOT A HERO.exe
FirewallRules: [{59E06A96-4F53-4AFD-ACC2-EE41299DE15F}] => (Allow) E:\SteamLibrary\steamapps\common\Not a Hero\NOT A HERO.exe
FirewallRules: [{7D99CAC6-2466-4D27-952C-5396DB46D7D4}] => (Allow) E:\SteamLibrary\steamapps\common\Dropsy\Dropsy.exe
FirewallRules: [{8B3A590D-B4AF-4E22-8998-1E9FE47B84CC}] => (Allow) E:\SteamLibrary\steamapps\common\Dropsy\Dropsy.exe
FirewallRules: [{7026B7B4-FB61-4AE5-A788-6FC414035BCC}] => (Allow) E:\SteamLibrary\steamapps\common\Titan Souls\TITAN.exe
FirewallRules: [{00722179-E481-44C1-A64E-6DC3239D83E0}] => (Allow) E:\SteamLibrary\steamapps\common\Titan Souls\TITAN.exe
FirewallRules: [{9393CA9D-3BA3-4E79-A09A-659E00C20676}] => (Allow) E:\SteamLibrary\steamapps\common\RONIN\Ronin.exe
FirewallRules: [{8B23C289-5C0C-4ECC-8C10-07CD926580EA}] => (Allow) E:\SteamLibrary\steamapps\common\RONIN\Ronin.exe
FirewallRules: [{88D2DB3C-8896-4F53-B84A-84CACDE43F63}] => (Allow) E:\SteamLibrary\steamapps\common\Fistful of Gun\FistfulofGun.exe
FirewallRules: [{63783CEC-B9B8-451B-AE9C-2DCD0B28D10D}] => (Allow) E:\SteamLibrary\steamapps\common\Fistful of Gun\FistfulofGun.exe
FirewallRules: [UDP Query User{E6AD4D7F-1BCB-422E-AF43-F8F5DBDF2B49}C:\program files\logitech gaming software\lcore.exe] => (Allow) C:\program files\logitech gaming software\lcore.exe
FirewallRules: [TCP Query User{4734BF1E-A25A-4E11-8401-6C23DEF5AAF5}C:\program files\logitech gaming software\lcore.exe] => (Allow) C:\program files\logitech gaming software\lcore.exe
FirewallRules: [{A67A0478-6A4D-4EA8-A55F-177D0360D203}] => (Allow) E:\SteamLibrary\steamapps\common\Enter the Gungeon\EtG.exe
FirewallRules: [{CDC0CFBD-8D3E-4B8F-AA4A-69D88529F8F7}] => (Allow) E:\SteamLibrary\steamapps\common\Enter the Gungeon\EtG.exe
FirewallRules: [{5ADA3B79-9768-4361-B24A-C5A6FA3E912A}] => (Allow) E:\SteamLibrary\steamapps\common\Faeria\Faeria.exe
FirewallRules: [{FFBC78FB-A302-434D-AFFD-8441F3D513A0}] => (Allow) E:\SteamLibrary\steamapps\common\Faeria\Faeria.exe
FirewallRules: [{E39E96D1-9820-40A9-AD19-D09842DFE5E6}] => (Allow) E:\SteamLibrary\steamapps\common\Risk of Rain\Risk of Rain.exe
FirewallRules: [{002CC4DE-9D31-47E8-93EE-F4ED1F8C0526}] => (Allow) E:\SteamLibrary\steamapps\common\Risk of Rain\Risk of Rain.exe
FirewallRules: [{0BC7AD82-E7FC-45BE-A341-AE9256FA3791}] => (Allow) E:\SteamLibrary\steamapps\common\PuzzleQuest2\PuzzleQuest2.exe
FirewallRules: [{0E632D51-C0CD-416F-AEFE-B0C352A2810E}] => (Allow) E:\SteamLibrary\steamapps\common\PuzzleQuest2\PuzzleQuest2.exe
FirewallRules: [{266ADD23-F2CC-4EB8-84D7-31415B6EFFB3}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe
FirewallRules: [{0BD411F2-892E-40BA-9B83-773D1A0CD23B}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe
FirewallRules: [{1AEEF410-8B68-4929-90D3-A9BC76BD647C}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe
FirewallRules: [{2FFBC0A1-1BA6-4F6A-AF05-F4400AE9EBBD}] => (Allow) E:\SteamLibrary\steamapps\common\The Witcher 3\bin\x64\witcher3.exe
FirewallRules: [{B5C0615C-6D99-4E86-A63B-360B2B23EBAD}] => (Allow) E:\SteamLibrary\steamapps\common\The Witcher 3\bin\x64\witcher3.exe
FirewallRules: [{29144185-4FA5-46E0-9033-4BD8BD2A9159}] => (Allow) F:\SteamLibrary\steamapps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [{5A64861E-A68F-4194-B275-C7DA6334CE75}] => (Allow) F:\SteamLibrary\steamapps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [{7BB9E26A-E8DF-4B27-8368-AFE9A29C7900}] => (Allow) E:\SteamLibrary\steamapps\common\Divinity Original Sin Enhanced Edition\Shipping\EoCApp.exe
FirewallRules: [{8A14EDC7-CBBB-4F10-8FE1-5304B31BCC59}] => (Allow) E:\SteamLibrary\steamapps\common\Divinity Original Sin Enhanced Edition\Shipping\EoCApp.exe
FirewallRules: [{F9EE4D42-69A5-4DD6-A10B-632F56C28B09}] => (Allow) E:\SteamLibrary\steamapps\common\abyss_odyssey\Binaries\Win32\AO.exe
FirewallRules: [{D929263D-42E8-41C9-BA8F-1C60764DEB14}] => (Allow) E:\SteamLibrary\steamapps\common\abyss_odyssey\Binaries\Win32\AO.exe
FirewallRules: [{5D4FFFE3-FD39-427F-97B3-F91802912406}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry 4\bin\FarCry4.exe
FirewallRules: [{8EC402EE-EBD7-4857-BBC4-5A2678C19151}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry 4\bin\FarCry4.exe
FirewallRules: [UDP Query User{B035F1CB-B943-42EE-8305-F4129F8F103C}C:\program files (x86)\leawo\video converter\loadingscreen.exe] => (Allow) C:\program files (x86)\leawo\video converter\loadingscreen.exe
FirewallRules: [TCP Query User{24D84E7F-4440-4E41-9849-8564D8E1B7F3}C:\program files (x86)\leawo\video converter\loadingscreen.exe] => (Allow) C:\program files (x86)\leawo\video converter\loadingscreen.exe
FirewallRules: [{F83968B4-703F-48BA-9D64-60564BF00778}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{5370DD05-5C6C-42FD-B6CD-481D4D475138}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{8D559DA1-99C9-4F92-9816-A9E8DC8B4F69}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{DBA49B06-4EB1-4744-8397-993D977A069F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{60F7245A-03D3-4FA3-905A-440455B4ED26}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [UDP Query User{3E497B05-31A8-4802-9048-5E0B6B018FEB}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe
FirewallRules: [TCP Query User{655821BB-04CB-4253-B652-04FA9EF5686C}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe
FirewallRules: [{5623813A-43B5-4AF4-862F-82ABF4ED452B}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{0A025A73-BADA-48D3-B9AC-A2422FAB4149}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{AF047A92-8446-4473-8E0B-C8A915F7F6B5}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{2DA8990E-071C-40CE-925E-F329DE3C39BD}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{48B5D9AA-9BA4-4866-BC75-0455FD553821}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{D88A65E3-1BB7-49AE-B4D9-DB4A640CDEC8}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{F81DD553-C09E-4471-B370-ECA9751F7305}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{02F10855-CB7A-46A5-9FA2-577509EAFC6A}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{14BBC9EB-163A-4FF4-8EAA-CDC012D5C7D6}] => (Allow) C:\Users\Dallas\AppData\Roaming\Andy_45_Online\Setup.exe
FirewallRules: [{4789B161-7ABC-4C7A-8F69-4366F5CEE5C4}] => (Allow) C:\Users\Dallas\AppData\Roaming\Andy_45_Online\Setup.exe
FirewallRules: [{2A725E44-26DE-49BC-96B0-9DCB7EF309B8}] => (Allow) ERROR\Andy.exe
FirewallRules: [{D6B5BB92-CE4B-450C-93CA-F1C30CEEEFA4}] => (Allow) ERROR\Andy.exe
FirewallRules: [{6DC4D75B-A2D1-4AF3-82DB-F9382A3CBDAE}] => (Allow) ERROR\HandyAndy.exe
FirewallRules: [{7E9E1DD2-54E4-4986-85C0-70CF78B96AA7}] => (Allow) ERROR\HandyAndy.exe
FirewallRules: [{5B79D59C-5132-4AD8-B8A8-0D586585C623}] => (Allow) E:\SteamLibrary\steamapps\common\Lethis - Path of Progress\Lethis-Path_Of_Progress.exe
FirewallRules: [{0AEFB03B-7329-45CE-BD92-F7D609BCD23D}] => (Allow) E:\SteamLibrary\steamapps\common\Lethis - Path of Progress\Lethis-Path_Of_Progress.exe
FirewallRules: [{A6312374-A1DB-49F4-9B43-7640779372DD}] => (Allow) E:\SteamLibrary\steamapps\common\Grim Dawn\Grim Dawn.exe
FirewallRules: [{0A8735E3-10E0-4843-959E-E6BE152CB4C4}] => (Allow) E:\SteamLibrary\steamapps\common\Grim Dawn\Grim Dawn.exe
FirewallRules: [{3623E2D8-5A00-4C8E-B9C9-20B548BAD021}] => (Allow) F:\SteamLibrary\steamapps\common\Murdered Soul Suspect\Binaries\Win64\Murdered.exe
FirewallRules: [{059ABBF8-EBFC-4927-A90B-72FE7BC57E97}] => (Allow) F:\SteamLibrary\steamapps\common\Murdered Soul Suspect\Binaries\Win64\Murdered.exe
FirewallRules: [{736C6C34-1C42-4030-836B-48BA30B073EF}] => (Allow) E:\SteamLibrary\steamapps\common\Prison Architect\Prison Architect.exe
FirewallRules: [{497B2785-620B-4F1D-8BFB-608195092CBA}] => (Allow) E:\SteamLibrary\steamapps\common\Prison Architect\Prison Architect.exe
FirewallRules: [{FFD48483-CE83-41A9-B4EB-0F1CDB0E1F09}] => (Allow) E:\SteamLibrary\steamapps\common\Dungeons2\Dungeons2.exe
FirewallRules: [{F9DF48FC-3F25-4A68-A5D3-778E18E64D1D}] => (Allow) E:\SteamLibrary\steamapps\common\Dungeons2\Dungeons2.exe
FirewallRules: [{FC91869E-379E-46BF-B956-981B798120A7}] => (Allow) F:\SteamLibrary\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{06D07AD7-FA51-4FF8-8FBA-DCA7852F6120}] => (Allow) F:\SteamLibrary\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{97546790-6AD8-48FA-BC91-9D127A9B3286}] => (Allow) E:\SteamLibrary\steamapps\common\Broforce\Broforce_beta.exe
FirewallRules: [{E5BBC4D8-9963-4F02-AD14-DCF7021B14DC}] => (Allow) E:\SteamLibrary\steamapps\common\Broforce\Broforce_beta.exe
FirewallRules: [{F72E87F5-3C2A-4FAC-8FFC-E91E11881A91}] => (Allow) E:\SteamLibrary\steamapps\common\Valkyria Chronicles\Launcher.exe
FirewallRules: [{2A846ABC-5C0D-42DD-80A7-E96B9DA916FE}] => (Allow) E:\SteamLibrary\steamapps\common\Valkyria Chronicles\Launcher.exe
FirewallRules: [{3DCB6B26-EFFE-4588-8662-11EACD90D3A1}] => (Allow) E:\SteamLibrary\steamapps\common\Ironcast\Ironcast.exe
FirewallRules: [{71BB05D3-1135-4899-A0D4-A9ED91982290}] => (Allow) E:\SteamLibrary\steamapps\common\Ironcast\Ironcast.exe
FirewallRules: [{CA284B95-5934-4B93-A96A-3688AE47F455}] => (Allow) F:\SteamLibrary\steamapps\common\The Vanishing of Ethan Carter Redux\EthanCarter.exe
FirewallRules: [{DFD46E2E-9300-4B7A-8BA0-C9A9A950DE14}] => (Allow) F:\SteamLibrary\steamapps\common\The Vanishing of Ethan Carter Redux\EthanCarter.exe
FirewallRules: [{924994D7-178A-4AC6-82A5-F1E7A5D528A4}] => (Allow) F:\SteamLibrary\steamapps\common\Age2HD\Launcher.exe
FirewallRules: [{48B2E9D1-2167-4D65-82AE-FDD9F0DA59E2}] => (Allow) F:\SteamLibrary\steamapps\common\Age2HD\Launcher.exe
FirewallRules: [{7CAF4025-4178-4553-8EE5-5DFD50A4E983}] => (Allow) F:\SteamLibrary\steamapps\common\Wolfenstein.The.New.Order\WolfNewOrder_x64.exe
FirewallRules: [{FFB7DACF-4008-484B-A135-A7DD3B962C08}] => (Allow) F:\SteamLibrary\steamapps\common\Wolfenstein.The.New.Order\WolfNewOrder_x64.exe
FirewallRules: [{573F9621-61F4-4839-81E6-5EDB8F8EFD15}] => (Allow) F:\SteamLibrary\steamapps\common\Wolfenstein The Old Blood\WolfOldBlood_x64.exe
FirewallRules: [{0FEBCA40-280E-4193-8CA8-770E13143034}] => (Allow) F:\SteamLibrary\steamapps\common\Wolfenstein The Old Blood\WolfOldBlood_x64.exe
FirewallRules: [{441B43DF-0B11-4906-B8FE-82935F9CAC0C}] => (Allow) F:\SteamLibrary\steamapps\common\SOMA\Soma.exe
FirewallRules: [{59CEEBE2-0D61-4901-BED8-31C5BC81E8AE}] => (Allow) F:\SteamLibrary\steamapps\common\SOMA\Soma.exe
FirewallRules: [{CACD068E-09C4-4E28-BC00-07B62F389909}] => (Allow) F:\SteamLibrary\steamapps\common\SOMA\ModLauncher.exe
FirewallRules: [{DA1D25E0-072E-47BF-8835-002E6E4DE245}] => (Allow) F:\SteamLibrary\steamapps\common\SOMA\ModLauncher.exe
FirewallRules: [{3C4811DF-84F7-46F1-8513-48DB9A33B8C8}] => (Allow) F:\SteamLibrary\steamapps\common\The Curious Expedition\nw.exe
FirewallRules: [{75D387E8-5FAC-4AEF-B8F3-B02DE45AE63A}] => (Allow) F:\SteamLibrary\steamapps\common\The Curious Expedition\nw.exe
FirewallRules: [{77064C8B-0CCB-4BEC-A65B-6361A4035750}] => (Allow) F:\SteamLibrary\steamapps\common\Fallout 4\Fallout4Launcher.exe
FirewallRules: [{3D8D60B4-407B-4615-BCAE-B00F1C5F67E2}] => (Allow) F:\SteamLibrary\steamapps\common\Fallout 4\Fallout4Launcher.exe
FirewallRules: [{4DD5BABC-02E1-42F4-B399-8304D46C90A8}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry 4\bin\FarCry4.exe
FirewallRules: [{43CC5A98-BCB9-4C89-9325-E6B14B58771B}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry 4\bin\FarCry4.exe
FirewallRules: [{7911491C-1C27-4351-A91C-5CD33BDD68A8}] => (Allow) E:\SteamLibrary\steamapps\common\Ziggurat\Ziggurat.exe
FirewallRules: [{97ACF9CB-CE9B-4535-B62A-41E75E169BE7}] => (Allow) E:\SteamLibrary\steamapps\common\Ziggurat\Ziggurat.exe
FirewallRules: [{57E26F84-B0DD-4ED4-95B5-F4F879D9138E}] => (Allow) F:\SteamLibrary\steamapps\common\Undertale\UNDERTALE.exe
FirewallRules: [{03A9D3CD-3E9C-488C-A305-F5B48F688AE1}] => (Allow) F:\SteamLibrary\steamapps\common\Undertale\UNDERTALE.exe
FirewallRules: [{C912DC7E-8F42-43EA-B5F4-4BC538E97F61}] => (Allow) F:\SteamLibrary\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe
FirewallRules: [{9DEED305-577F-4A95-95C1-BDA92E4DD6D2}] => (Allow) F:\SteamLibrary\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe
FirewallRules: [{FDB5609A-57CB-4A14-A375-60755A85EEAE}] => (Allow) F:\SteamLibrary\steamapps\common\firstassault\Shipping\GAME.exe
FirewallRules: [{5C0FC317-68E0-4510-9D86-23A090337935}] => (Allow) F:\SteamLibrary\steamapps\common\firstassault\Shipping\GAME.exe
FirewallRules: [{4712542C-6262-4BD1-AA32-A2E4CE30F0C9}] => (Allow) E:\SteamLibrary\steamapps\common\CraftTheWorld\CraftWorld.exe
FirewallRules: [{9186FE03-E093-4089-BEB5-F092B91711E0}] => (Allow) E:\SteamLibrary\steamapps\common\CraftTheWorld\CraftWorld.exe
FirewallRules: [{8C6502D2-01BF-43B6-BF6C-EF2672B9D237}] => (Allow) E:\SteamLibrary\steamapps\common\Stonehearth\Stonehearth.exe
FirewallRules: [{47652920-A1E5-4968-9B75-2C2B1F3EB6FC}] => (Allow) E:\SteamLibrary\steamapps\common\Stonehearth\Stonehearth.exe
FirewallRules: [{BBC090BD-292C-4D5B-AC1C-FA7D3EE306F3}] => (Allow) E:\SteamLibrary\steamapps\common\Crashlands\Crashlands.exe
FirewallRules: [{A5DAECE9-F5CC-41A2-8907-BD2643E52E6D}] => (Allow) E:\SteamLibrary\steamapps\common\Crashlands\Crashlands.exe
FirewallRules: [{7A08F04A-6D82-4A76-98DE-544A74392A03}] => (Allow) E:\SteamLibrary\steamapps\common\Scribblenauts\Scribble.exe
FirewallRules: [{8170343F-23D5-4321-B62D-45F96F8989C5}] => (Allow) E:\SteamLibrary\steamapps\common\Scribblenauts\Scribble.exe
FirewallRules: [{A405F91C-6A50-49F6-8025-C9EECBEAE5DB}] => (Allow) E:\SteamLibrary\steamapps\common\Unepic\unepic.exe
FirewallRules: [{24967DDA-70C8-44C6-BD41-FD3C8B0983F2}] => (Allow) E:\SteamLibrary\steamapps\common\Unepic\unepic.exe
FirewallRules: [{F41EF842-0739-4176-899D-FD0436BC7B59}] => (Allow) E:\SteamLibrary\steamapps\common\Banished\Application-steam-x64.exe
FirewallRules: [{ADE1A5D2-4006-4BF5-8F5D-B8ABEA9CAC19}] => (Allow) E:\SteamLibrary\steamapps\common\Banished\Application-steam-x64.exe
FirewallRules: [TCP Query User{8C0C8EF3-9B42-4556-B3B1-51F85FBA68DE}F:\steamlibrary\steamapps\common\the vanishing of ethan carter redux\ethancarter\binaries\win64\ethancarter-win64-shipping.exe] => (Allow) F:\steamlibrary\steamapps\common\the vanishing of ethan carter redux\ethancarter\binaries\win64\ethancarter-win64-shipping.exe
FirewallRules: [UDP Query User{F06B1AE5-9D46-4E03-9B39-DD497AE58D0D}F:\steamlibrary\steamapps\common\the vanishing of ethan carter redux\ethancarter\binaries\win64\ethancarter-win64-shipping.exe] => (Allow) F:\steamlibrary\steamapps\common\the vanishing of ethan carter redux\ethancarter\binaries\win64\ethancarter-win64-shipping.exe
FirewallRules: [TCP Query User{1AC4AF7D-B86E-4CF3-ADB0-B36B067A7FEE}F:\epic games\unrealtournamentdev\engine\binaries\win64\ue4-win64-shipping.exe] => (Block) F:\epic games\unrealtournamentdev\engine\binaries\win64\ue4-win64-shipping.exe
FirewallRules: [UDP Query User{F391E1D9-D318-4138-8504-7B1AD70D4A36}F:\epic games\unrealtournamentdev\engine\binaries\win64\ue4-win64-shipping.exe] => (Block) F:\epic games\unrealtournamentdev\engine\binaries\win64\ue4-win64-shipping.exe
FirewallRules: [{CA4C4D39-BA82-4A80-A40D-7EDFFB938305}] => (Allow) E:\SteamLibrary\steamapps\common\Sven Co-op\svencoop.exe
FirewallRules: [{C7EB6835-7C47-4080-B7CF-9F69E5CE338D}] => (Allow) E:\SteamLibrary\steamapps\common\Sven Co-op\svencoop.exe
FirewallRules: [{9DB7847A-F381-4C30-A1FE-0371E2DBBD9C}] => (Allow) E:\SteamLibrary\steamapps\common\Serious Sam HD The First Encounter\Bin\SamHD.exe
FirewallRules: [{E60235E3-3393-4B46-9139-7D300E3C5DEB}] => (Allow) E:\SteamLibrary\steamapps\common\Serious Sam HD The First Encounter\Bin\SamHD.exe
FirewallRules: [TCP Query User{86902FD8-ABE3-46BB-B3C3-B94683763567}E:\steamlibrary\steamapps\common\guardians of orion\orion\binaries\win64\orion-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\guardians of orion\orion\binaries\win64\orion-win64-shipping.exe
FirewallRules: [UDP Query User{53DD458D-2DF5-439E-B635-2B6B3A7D83AB}E:\steamlibrary\steamapps\common\guardians of orion\orion\binaries\win64\orion-win64-shipping.exe] => (Allow) E:\steamlibrary\steamapps\common\guardians of orion\orion\binaries\win64\orion-win64-shipping.exe
FirewallRules: [{AE29C5C5-2A0B-46F4-B620-2375B19BB0E3}] => (Allow) E:\SteamLibrary\steamapps\common\Cities_Skylines\Cities.exe
FirewallRules: [{3B9C431B-34F8-4752-89BC-EF894DDE7E55}] => (Allow) E:\SteamLibrary\steamapps\common\Cities_Skylines\Cities.exe
FirewallRules: [{42919376-F99F-4B97-82B7-96871616C966}] => (Allow) E:\SteamLibrary\steamapps\common\Tick Tock Isle\Tick Tock Isle.exe
FirewallRules: [{3379EE82-13C7-4DBF-815A-F3984F5794C2}] => (Allow) E:\SteamLibrary\steamapps\common\Tick Tock Isle\Tick Tock Isle.exe
FirewallRules: [{06B6F595-3B99-408D-AD79-1419CD7368B2}] => (Allow) E:\SteamLibrary\steamapps\common\The Escapists\TheEscapists.exe
FirewallRules: [{48F0FC11-8172-46E6-89EA-8DA81BE81584}] => (Allow) E:\SteamLibrary\steamapps\common\The Escapists\TheEscapists.exe
FirewallRules: [{92FF1274-C68C-44DE-87FE-BDCC024F69CD}] => (Allow) E:\SteamLibrary\steamapps\common\Sheltered\Sheltered.exe
FirewallRules: [{9226E36C-387F-4DD5-AC4C-2E65A137F525}] => (Allow) E:\SteamLibrary\steamapps\common\Sheltered\Sheltered.exe
FirewallRules: [{6BE9F504-0D88-45BB-8E99-4E70AF80BBC9}] => (Allow) E:\SteamLibrary\steamapps\common\Far Cry 3\bin\FC3UpdaterSteam.exe
FirewallRules: [{3E19801C-6926-4017-A9A9-301035383187}] => (Allow) E:\SteamLibrary\steamapps\common\Far Cry 3\bin\FC3UpdaterSteam.exe
FirewallRules: [{56D5577C-C5A6-4289-9AB3-622C9D061864}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry 4\bin\IGE_WPF64.exe
FirewallRules: [{72BD3A45-D30E-467B-9620-13A34104E8CF}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry 4\bin\IGE_WPF64.exe
FirewallRules: [{91748EE2-D0D1-4182-8F98-0CA86EDE8A03}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound - Unstable\win32\launcher\launcher.exe
FirewallRules: [{6901D1F9-BA72-4277-B854-85EF3E1E55B9}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound - Unstable\win32\launcher\launcher.exe
FirewallRules: [{1F75A13B-1C49-47CA-9130-C2CDD3257AEC}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry 3 Blood Dragon\bin\FC3BDUpdaterSteam.exe
FirewallRules: [{C368049C-26A4-4B57-B0F4-9E19DC16762B}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry 3 Blood Dragon\bin\FC3BDUpdaterSteam.exe
FirewallRules: [{18B4BB27-9C68-4837-9C94-DF118A240D87}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry 3\bin\FC3UpdaterSteam.exe
FirewallRules: [{E68392DA-5129-4320-8362-973863CD5AAE}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry 3\bin\FC3UpdaterSteam.exe
FirewallRules: [{D3E97996-62AD-4142-990E-1623C361C23C}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{3A03411B-3EF5-42AF-AE0C-B1047911CF74}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{B2C9C80A-43C8-4F32-82E8-42076B889EF3}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{33605249-2E65-4180-A438-E108AF12987D}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{891D2125-3784-41C1-AF0F-8B7675D03E4F}] => (Allow) E:\SteamLibrary\steamapps\common\Prison Architect\Prison Architect Safe Mode.exe
FirewallRules: [{20A1530E-5A89-40ED-9CB6-4F8B479035BB}] => (Allow) E:\SteamLibrary\steamapps\common\Prison Architect\Prison Architect Safe Mode.exe
FirewallRules: [TCP Query User{2D76B2FA-12EB-41AB-BB5C-DBDBC9754491}C:\program files\logitech gaming software\lcore.exe] => (Block) C:\program files\logitech gaming software\lcore.exe
FirewallRules: [UDP Query User{6AD6A40F-E904-4C0F-ABCF-CDE8A3E87320}C:\program files\logitech gaming software\lcore.exe] => (Block) C:\program files\logitech gaming software\lcore.exe
FirewallRules: [{4438B59E-13AA-4AED-A2A1-949A628B30CE}] => (Allow) E:\SteamLibrary\steamapps\common\Terraria\Terraria.exe
FirewallRules: [{4D61C01A-4F34-400F-9F66-98EAF3031BAD}] => (Allow) E:\SteamLibrary\steamapps\common\Terraria\Terraria.exe
FirewallRules: [{2302B82B-7BB7-4A6C-B037-BCF32E737933}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{54F4E00F-0B7A-4D86-8BE1-494301222CCF}] => (Allow) E:\SteamLibrary\steamapps\common\Dark Souls Prepare to Die Edition\DATA\DARKSOULS.exe
FirewallRules: [{18741782-B67A-4E1D-BAAD-E9B2199D5DA1}] => (Allow) E:\SteamLibrary\steamapps\common\Dark Souls Prepare to Die Edition\DATA\DARKSOULS.exe
FirewallRules: [{320A5447-27D3-477E-AC8F-3B09EA32DCA6}] => (Allow) E:\SteamLibrary\steamapps\common\ShellShock Live\ShellShockLive.exe
FirewallRules: [{B44309F5-36EA-47C3-BBBF-53388AACC16D}] => (Allow) E:\SteamLibrary\steamapps\common\ShellShock Live\ShellShockLive.exe
FirewallRules: [TCP Query User{BAF0527B-4480-496B-AD38-98292F21B184}E:\steamlibrary\steamapps\common\forced showdown\bugtracker\bugtracker.exe] => (Allow) E:\steamlibrary\steamapps\common\forced showdown\bugtracker\bugtracker.exe
FirewallRules: [UDP Query User{067F3456-65D5-4762-8E48-FF18322C2525}E:\steamlibrary\steamapps\common\forced showdown\bugtracker\bugtracker.exe] => (Allow) E:\steamlibrary\steamapps\common\forced showdown\bugtracker\bugtracker.exe
FirewallRules: [{3E6BDB68-4CEF-4B4B-B5AF-9A13530B039B}] => (Allow) E:\SteamLibrary\steamapps\common\Epistory\Epistory.exe
FirewallRules: [{E166C429-0B73-4AA4-9E60-C545B855BB6B}] => (Allow) E:\SteamLibrary\steamapps\common\Epistory\Epistory.exe
FirewallRules: [{456535DA-0547-478D-B2C0-2049E1E0A3A6}] => (Allow) E:\SteamLibrary\steamapps\common\Bulb Boy\BulbBoy.exe
FirewallRules: [{CEA258E0-001D-4BA1-B684-5456AEEB8DFC}] => (Allow) E:\SteamLibrary\steamapps\common\Bulb Boy\BulbBoy.exe
FirewallRules: [{E13829D6-F169-49EB-8672-D50B29BB08A1}] => (Allow) E:\SteamLibrary\steamapps\common\Soul Axiom\SoulAxiom.exe
FirewallRules: [{6F3FE3FF-A3DC-4026-81BA-59E20E681FA1}] => (Allow) E:\SteamLibrary\steamapps\common\Soul Axiom\SoulAxiom.exe
FirewallRules: [{9F206E7E-4C54-4B72-A346-216AB01EDA31}] => (Allow) E:\SteamLibrary\steamapps\common\Deathtrap\DeathTrap.exe
FirewallRules: [{12A7D090-D1B7-4EAF-919D-8BC67D54F30E}] => (Allow) E:\SteamLibrary\steamapps\common\Deathtrap\DeathTrap.exe
FirewallRules: [{B514A4A3-6AA9-4C30-8385-9DEF02E5F0F7}] => (Allow) E:\SteamLibrary\steamapps\common\Snakebird\Snakebird.exe
FirewallRules: [{6EF6C318-9B8B-4494-80BF-4EF6E03F1FDF}] => (Allow) E:\SteamLibrary\steamapps\common\Snakebird\Snakebird.exe
FirewallRules: [{311FC994-5B2F-40F3-9B7C-7A18B1F5F42C}] => (Allow) E:\SteamLibrary\steamapps\common\1001 Spikes\1001 Spikes.exe
FirewallRules: [{CCBE05E3-A0F0-4926-9619-92C263642349}] => (Allow) E:\SteamLibrary\steamapps\common\1001 Spikes\1001 Spikes.exe
FirewallRules: [{A1C09A38-AB8A-4BEE-AFDF-A2A52F1E8890}] => (Allow) E:\SteamLibrary\steamapps\common\Absolute Drift\AbsoluteDrift.exe
FirewallRules: [{5CCC816B-FB69-4F44-B3D1-368535324AC7}] => (Allow) E:\SteamLibrary\steamapps\common\Absolute Drift\AbsoluteDrift.exe
FirewallRules: [{33876617-7208-4676-853E-3E40D9B32099}] => (Allow) F:\SteamLibrary\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{755BAEF1-7A28-4D75-A842-87CCD1452CD5}] => (Allow) F:\SteamLibrary\steamapps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{39278F8C-9529-4D0B-8148-90479F29D371}] => (Allow) F:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe
FirewallRules: [{1D218E2E-56E8-431D-B4B0-A3A5AAE7169B}] => (Allow) F:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_DX11.exe
FirewallRules: [{DFAE04E1-913A-4452-8041-C223CF13A194}] => (Allow) F:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe
FirewallRules: [{0678B730-D249-4D45-B252-DA9D60018DB9}] => (Allow) F:\SteamLibrary\steamapps\common\Sid Meier's Civilization Beyond Earth\CivilizationBE_Mantle.exe
FirewallRules: [{4CB0340B-4DA7-4701-8146-6F16C03BFBFD}] => (Allow) F:\SteamLibrary\steamapps\common\StreetFighterV\StreetFighterV.exe
FirewallRules: [{589E229B-8514-4530-B257-B88E9A5EA8D0}] => (Allow) F:\SteamLibrary\steamapps\common\StreetFighterV\StreetFighterV.exe
FirewallRules: [{D697F49C-5FD0-4DFC-8FE8-DE263F620324}] => (Allow) F:\SteamLibrary\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe
FirewallRules: [{7B7353D9-302A-46F9-8661-816872054AA0}] => (Allow) F:\SteamLibrary\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe
FirewallRules: [{A852852A-AAB5-4BAE-B058-0098E1A73FEB}] => (Allow) F:\SteamLibrary\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe
FirewallRules: [{06038D57-C2EE-4981-8934-E9A7580BE2CD}] => (Allow) F:\SteamLibrary\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe
FirewallRules: [TCP Query User{29926D17-273B-474A-8ECC-4ACE3E327E1B}E:\blizzard games\diablo iii\diablo iii.exe] => (Allow) E:\blizzard games\diablo iii\diablo iii.exe
FirewallRules: [UDP Query User{531ACDC9-77DA-41D5-96FB-34C8DAACBB23}E:\blizzard games\diablo iii\diablo iii.exe] => (Allow) E:\blizzard games\diablo iii\diablo iii.exe
FirewallRules: [{D61C9218-0980-4DD6-99EE-A9665F95A987}] => (Allow) E:\SteamLibrary\steamapps\common\Influent\Influent.exe
FirewallRules: [{C5EB466D-76BB-469A-B95D-1D459D8B7EAA}] => (Allow) E:\SteamLibrary\steamapps\common\Influent\Influent.exe
FirewallRules: [{C066A672-6796-4A7C-A3AA-E1F0CBF4C981}] => (Allow) E:\SteamLibrary\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{4560D4AC-CBA3-4AC3-B592-4AB40ABD7904}] => (Allow) E:\SteamLibrary\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{0F4476C3-1CAE-48A3-B48C-16BCD89989FB}] => (Allow) E:\SteamLibrary\steamapps\common\Roguelands\Roguelands.exe
FirewallRules: [{0FA0DB8E-A48B-4265-9B69-641138BE6166}] => (Allow) E:\SteamLibrary\steamapps\common\Roguelands\Roguelands.exe
FirewallRules: [{5CB0B215-3EFF-47C8-86FA-B0B6CBAC500A}] => (Allow) E:\SteamLibrary\steamapps\common\Golf With Your Friends\Golf With Your Friends.exe
FirewallRules: [{591B5F04-1DBA-40A8-AD5C-B7DD73202D60}] => (Allow) E:\SteamLibrary\steamapps\common\Golf With Your Friends\Golf With Your Friends.exe
FirewallRules: [{4468C796-DEAE-4241-A5BD-E9965EFEBDB5}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩慲杮履楷牮湡敧攮數
FirewallRules: [{5C1FD7AF-E330-4C9C-BC10-B3D8D5F786DB}] => (Allow) C:\Users\Dallas\AppData\Local\ddnowyes.exe
FirewallRules: [{FEA7A7C5-93E5-4F3F-848F-460DEACAD5FC}] => (Allow) C:\Users\Dallas\AppData\Local\Temp\installer.exe
FirewallRules: [{F0E53C49-ACC5-4996-8407-7E0534FD98E6}] => (Allow) C:\Users\Dallas\AppData\Local\3731120.exe
FirewallRules: [{049A595F-420F-4C95-B27D-E3F7CF2B15E8}] => (Allow) C:\Program Files (x86)\attainment\campos.exe
FirewallRules: [{0584891F-A6AF-4E80-B6EC-11D4F9DB4DDB}] => (Allow) E:\SteamLibrary\steamapps\common\Stardew Valley\Stardew Valley.exe
FirewallRules: [{4685718C-AF1C-4549-A918-A78D0B6D7348}] => (Allow) E:\SteamLibrary\steamapps\common\Stardew Valley\Stardew Valley.exe
FirewallRules: [{F356D736-47A9-402D-BFAE-72D6AFA1FCE2}] => (Allow) E:\SteamLibrary\steamapps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [{FA06B648-36B6-44F2-B956-027D3106A807}] => (Allow) E:\SteamLibrary\steamapps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [{D93C1F3A-DF36-4F88-A0B3-9F188ED26765}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry Primal\bin\FCPrimal.exe
FirewallRules: [{9E8D0E74-E79B-41A5-947D-3C4C5E703ED9}] => (Allow) F:\SteamLibrary\steamapps\common\Far Cry Primal\bin\FCPrimal.exe
FirewallRules: [{7A6CBDB3-EEAF-434D-B089-E0DB2FE30E7B}] => (Allow) E:\SteamLibrary\steamapps\common\DarkestDungeon\_windows\Darkest.exe
FirewallRules: [{3D47A3E7-08AC-46DC-A92A-15FFDB276CC1}] => (Allow) E:\SteamLibrary\steamapps\common\DarkestDungeon\_windows\Darkest.exe
FirewallRules: [{1BB0BC52-E247-4C68-B3C1-4358125BFAAF}] => (Allow) E:\SteamLibrary\steamapps\common\Renowned Explorers\win64\abbeycore_win32_steam.exe
FirewallRules: [{7CAF7AD3-843B-4ADB-8BB0-17FD485F23DE}] => (Allow) E:\SteamLibrary\steamapps\common\Renowned Explorers\win64\abbeycore_win32_steam.exe
FirewallRules: [{A6EF13B1-9275-4DF4-8224-B876BF1BD51C}] => (Allow) E:\SteamLibrary\steamapps\common\Reassembly\win32\ReassemblyRelease.exe
FirewallRules: [{B053F563-BA4B-4D33-806D-27D8DF07AD0B}] => (Allow) E:\SteamLibrary\steamapps\common\Reassembly\win32\ReassemblyRelease.exe
FirewallRules: [{B011CC40-A2C1-4EBC-955E-900BC55E80C7}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound\win32\mod_uploader.exe
FirewallRules: [{A52292E2-409E-4927-98E1-1B08AFF15E0A}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound\win32\mod_uploader.exe
FirewallRules: [{C824142D-4C8E-438E-8180-47142B16F036}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound\win64\starbound.exe
FirewallRules: [{CCABC8A7-08B3-4D56-99A5-C35418F28858}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound\win64\starbound.exe
FirewallRules: [{FD88669F-FE91-4474-8146-3063A7E166A4}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound\win64\starbound_server.exe
FirewallRules: [{C28A0F16-3291-42A3-BB3D-A43FB61779F2}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound\win64\starbound_server.exe
FirewallRules: [{FEEA016A-6C8A-4EE3-9487-69555B564728}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound\win64\mod_uploader.exe
FirewallRules: [{E2475CF9-F3D0-48CE-86AC-11EDDE883E35}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound\win64\mod_uploader.exe
FirewallRules: [{48131581-C7C1-4568-8B2F-80B9145E0721}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound\win32\starbound.exe
FirewallRules: [{E94476A9-0356-42E8-BD74-7F05A4B55F6E}] => (Allow) E:\SteamLibrary\steamapps\common\Starbound\win32\starbound.exe
FirewallRules: [{95E9F6BC-732F-4E92-95E7-53C8A0BB5EAB}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{F7F77499-8577-4231-97E0-37005E75BEC5}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{2A9A62CD-A0E8-4336-BB83-481A0A1BF378}] => (Allow) E:\SteamLibrary\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [{003B89CF-7259-40A4-B40F-1FAC44F48135}] => (Allow) E:\SteamLibrary\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [{3137D999-A2D6-497E-8506-7CD6C82D2B75}] => (Allow) F:\SteamLibrary\steamapps\common\Okhlos\Okhlos.exe
FirewallRules: [{E0B23C35-4A55-4248-9A93-A82E038CF992}] => (Allow) F:\SteamLibrary\steamapps\common\Okhlos\Okhlos.exe
FirewallRules: [{EEFE7794-CBE0-488D-A431-4BEA62F2EAF5}] => (Allow) E:\SteamLibrary\steamapps\common\HeroSiege\bin\Hero_Siege.exe
FirewallRules: [{D8D677BA-4B03-4CE4-9E87-204766CF23C6}] => (Allow) E:\SteamLibrary\steamapps\common\HeroSiege\bin\Hero_Siege.exe
FirewallRules: [{0934B5AD-5181-4FB2-9691-88309CA04F50}] => (Allow) F:\SteamLibrary\steamapps\common\killingfloor2\Binaries\Win64\KFGame.exe
FirewallRules: [{F6751A16-1E55-47E3-9D28-9F2FC8889731}] => (Allow) F:\SteamLibrary\steamapps\common\killingfloor2\Binaries\Win64\KFGame.exe
 
==================== Restore Points =========================
 
10-08-2016 22:09:09 Windows Update
16-08-2016 16:14:55 Removed Maximized Software iCoverArt
22-08-2016 02:22:55 Removed Classic Shell
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (08/25/2016 06:44:19 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: WmiApRplC:\WINDOWS\system32\wbem\wmiaprpl.dll8
 
Error: (08/25/2016 06:44:18 PM) (Source: PerfNet) (EventID: 2004) (User: )
Description: 
 
Error: (08/25/2016 06:44:18 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: MSDTCC:\WINDOWS\system32\msdtcuiu.DLL8
 
Error: (08/25/2016 06:44:18 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: LsaC:\Windows\System32\Secur32.dll8
 
Error: (08/25/2016 06:44:18 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: ESENTC:\WINDOWS\system32\esentprf.dll8
 
Error: (08/25/2016 06:44:18 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8
 
Error: (08/24/2016 02:33:34 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DALLAS-PC)
Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (08/23/2016 12:45:16 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DALLAS-PC)
Description: Activation of app Microsoft.WindowsMaps_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (08/22/2016 02:22:56 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
 
System Error:
Access is denied.
.
 
Error: (08/22/2016 12:32:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: dwm.exe, version: 10.0.10586.0, time stamp: 0x5632d756
Faulting module name: KERNELBASE.dll, version: 10.0.10586.494, time stamp: 0x5775e4c5
Exception code: 0xc0000005
Fault offset: 0x0000000000032149
Faulting process id: 0x138
Faulting application start time: 0xdwm.exe0
Faulting application path: dwm.exe1
Faulting module path: dwm.exe2
Report Id: dwm.exe3
Faulting package full name: dwm.exe4
Faulting package-relative application ID: dwm.exe5
 
 
System errors:
=============
Error: (08/23/2016 02:33:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Steam Client Service service failed to start due to the following error: 
%%1053 = The service did not respond to the start or control request in a timely fashion.
 
Error: (08/23/2016 02:33:16 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
 
Error: (08/23/2016 12:15:39 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The GTFPOQUOTT Updater service failed to start due to the following error: 
%%2 = The system cannot find the file specified.
 
Error: (08/23/2016 12:15:39 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error: 
%%1058 = The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
 
Error: (08/23/2016 12:15:39 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AdVpnProxyService service failed to start due to the following error: 
%%2 = The system cannot find the file specified.
 
Error: (08/23/2016 12:15:39 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AdVPN Service service failed to start due to the following error: 
%%2 = The system cannot find the file specified.
 
Error: (08/23/2016 12:15:39 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{22279AF5-03AE-4CAF-989D-2530918B2F1C}{0773CCD6-59A2-4D26-B235-19247767E645}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (08/23/2016 12:15:12 AM) (Source: DCOM) (EventID: 10010) (User: DALLAS-PC)
Description: Windows.Media.Capture.Internal.AppCaptureShell
 
Error: (08/23/2016 12:15:11 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Access_35f143d1 service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.
 
Error: (08/23/2016 12:15:11 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Storage_35f143d1 service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.
 
 
CodeIntegrity:
===================================
  Date: 2016-08-13 04:46:18.842
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-08-10 23:02:54.817
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-07-15 15:12:05.553
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-07-15 03:16:33.583
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-07-14 07:32:38.799
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-07-14 07:17:37.566
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
  Date: 2016-07-14 07:17:37.401
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
  Date: 2016-07-14 07:17:36.296
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
  Date: 2016-07-14 07:17:36.115
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
  Date: 2016-07-12 03:09:00.848
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i5-4690K CPU @ 3.50GHz
Percentage of memory in use: 34%
Total physical RAM: 16324.22 MB
Available physical RAM: 10622.49 MB
Total Virtual: 32708.22 MB
Available Virtual: 24907.49 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:232.44 GB) (Free:101.62 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive e: (New Volume) (Fixed) (Total:447 GB) (Free:108.08 GB) NTFS
Drive f: (New Volume) (Fixed) (Total:1863.01 GB) (Free:1366.76 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 297075AB)
Partition 1: (Active) - (Size=232.4 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)
 
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 447.1 GB) (Disk ID: 00000000)
 
Partition: GPT.
 
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 2A763B4C)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================


#4 zero.81

zero.81
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:29 PM

Posted 28 August 2016 - 11:45 AM

Everything seems to be in order. The only way I could tell something was up before was that large chunks of my applications would suddenly have the same install date.



#5 nasdaq

nasdaq

  • Malware Response Team
  • 38,580 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:09:29 PM

Posted 28 August 2016 - 12:55 PM

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to a new file.
 
Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

Task: {04D2BA2F-639C-48D8-871C-23919056D0A6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {0622C44A-1117-4F97-9D7B-F3F104A47853} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {14F5D8A8-5A5E-4BC4-A57C-365E09CD19D9} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {1BD0E1A8-C93B-4034-AFB7-C8534AB785A5} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {374F4FE7-7E2D-42FD-B6DD-0E05292FA71B} - System32\Tasks\Da90702549070254 => C:\Program Files (x86)\attainment\campos.exe
Task: {3AC9DF34-C4A5-4625-9A99-444ABB6CE0A6} - \{0A0F0F47-0F7E-0E0D-0A11-040B0B7F1105} -> No File <==== ATTENTION
Task: {49CF895F-9E46-4547-AF80-E40C4EE0ED3E} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {4A0433EC-484F-42C3-A9D8-C5EC219EB104} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {5EA4C4F5-6F94-4989-97CD-23A010DCFDB9} - \DriverNavigator Scheduled Scan -> No File <==== ATTENTION
Task: {6288ECE8-27EA-4A45-86FA-8D8D59DCA313} - \9070254 -> No File <==== ATTENTION
Task: {6E4A716E-322E-4EB3-B7BF-248782B641A8} - \{6BD0954A-5C1F-4D08-9FCC-4C05F92E739C} -> No File <==== ATTENTION
Task: {BC5074A1-96CF-4C29-B600-977195626F54} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {BD5C508A-2257-4CEF-ABA4-D51295EBF8DF} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {C08D608A-53D5-492E-A076-94EEC64136EA} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {E11F1D9B-6C97-40E5-AC41-DA89CBFA7BD9} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {F0AA29C3-B44A-4D8B-B5E0-7371AF000854} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.

Please let me know what problem persists with this computer.

====

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/

#6 zero.81

zero.81
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:29 PM

Posted 28 August 2016 - 01:41 PM

Fix result of Farbar Recovery Scan Tool (x64) Version: 27-08-2016
Ran by Dallas (28-08-2016 13:37:38) Run:3
Running from C:\Users\Dallas\Downloads
Loaded Profiles: Dallas (Available Profiles: Dallas & DefaultAppPool)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
Start
 
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
 
Task: {04D2BA2F-639C-48D8-871C-23919056D0A6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {0622C44A-1117-4F97-9D7B-F3F104A47853} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {14F5D8A8-5A5E-4BC4-A57C-365E09CD19D9} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {1BD0E1A8-C93B-4034-AFB7-C8534AB785A5} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {374F4FE7-7E2D-42FD-B6DD-0E05292FA71B} - System32\Tasks\Da90702549070254 => C:\Program Files (x86)\attainment\campos.exe
Task: {3AC9DF34-C4A5-4625-9A99-444ABB6CE0A6} - \{0A0F0F47-0F7E-0E0D-0A11-040B0B7F1105} -> No File <==== ATTENTION
Task: {49CF895F-9E46-4547-AF80-E40C4EE0ED3E} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {4A0433EC-484F-42C3-A9D8-C5EC219EB104} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {5EA4C4F5-6F94-4989-97CD-23A010DCFDB9} - \DriverNavigator Scheduled Scan -> No File <==== ATTENTION
Task: {6288ECE8-27EA-4A45-86FA-8D8D59DCA313} - \9070254 -> No File <==== ATTENTION
Task: {6E4A716E-322E-4EB3-B7BF-248782B641A8} - \{6BD0954A-5C1F-4D08-9FCC-4C05F92E739C} -> No File <==== ATTENTION
Task: {BC5074A1-96CF-4C29-B600-977195626F54} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {BD5C508A-2257-4CEF-ABA4-D51295EBF8DF} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {C08D608A-53D5-492E-A076-94EEC64136EA} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {E11F1D9B-6C97-40E5-AC41-DA89CBFA7BD9} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {F0AA29C3-B44A-4D8B-B5E0-7371AF000854} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{04D2BA2F-639C-48D8-871C-23919056D0A6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04D2BA2F-639C-48D8-871C-23919056D0A6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0622C44A-1117-4F97-9D7B-F3F104A47853}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0622C44A-1117-4F97-9D7B-F3F104A47853}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{14F5D8A8-5A5E-4BC4-A57C-365E09CD19D9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{14F5D8A8-5A5E-4BC4-A57C-365E09CD19D9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1BD0E1A8-C93B-4034-AFB7-C8534AB785A5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1BD0E1A8-C93B-4034-AFB7-C8534AB785A5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{374F4FE7-7E2D-42FD-B6DD-0E05292FA71B}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{374F4FE7-7E2D-42FD-B6DD-0E05292FA71B}" => key removed successfully
C:\WINDOWS\System32\Tasks\Da90702549070254 => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Da90702549070254" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3AC9DF34-C4A5-4625-9A99-444ABB6CE0A6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3AC9DF34-C4A5-4625-9A99-444ABB6CE0A6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{0A0F0F47-0F7E-0E0D-0A11-040B0B7F1105}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{49CF895F-9E46-4547-AF80-E40C4EE0ED3E}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{49CF895F-9E46-4547-AF80-E40C4EE0ED3E}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4A0433EC-484F-42C3-A9D8-C5EC219EB104}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4A0433EC-484F-42C3-A9D8-C5EC219EB104}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5EA4C4F5-6F94-4989-97CD-23A010DCFDB9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5EA4C4F5-6F94-4989-97CD-23A010DCFDB9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DriverNavigator Scheduled Scan" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6288ECE8-27EA-4A45-86FA-8D8D59DCA313}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6288ECE8-27EA-4A45-86FA-8D8D59DCA313}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\9070254 => key not found. 
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6E4A716E-322E-4EB3-B7BF-248782B641A8}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6E4A716E-322E-4EB3-B7BF-248782B641A8}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6BD0954A-5C1F-4D08-9FCC-4C05F92E739C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BC5074A1-96CF-4C29-B600-977195626F54}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BC5074A1-96CF-4C29-B600-977195626F54}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BD5C508A-2257-4CEF-ABA4-D51295EBF8DF}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BD5C508A-2257-4CEF-ABA4-D51295EBF8DF}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C08D608A-53D5-492E-A076-94EEC64136EA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C08D608A-53D5-492E-A076-94EEC64136EA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E11F1D9B-6C97-40E5-AC41-DA89CBFA7BD9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E11F1D9B-6C97-40E5-AC41-DA89CBFA7BD9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F0AA29C3-B44A-4D8B-B5E0-7371AF000854}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F0AA29C3-B44A-4D8B-B5E0-7371AF000854}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => key removed successfully
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 5474468 B
Java, Flash, Steam htmlcache => 8512272 B
Windows/system/drivers => 0 B
Edge => 0 B
Chrome => 129108863 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 1634 B
NetworkService => 0 B
Dallas => 84482736 B
DefaultAppPool => 0 B
 
RecycleBin => 0 B
EmptyTemp: => 217 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 13:37:41 ====


#7 nasdaq

nasdaq

  • Malware Response Team
  • 38,580 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:09:29 PM

Posted 29 August 2016 - 08:43 AM

Looking good.

#8 zero.81

zero.81
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:29 PM

Posted 29 August 2016 - 02:26 PM

Thank you for the help, nasdaq.  What exactly was on my system?



#9 nasdaq

nasdaq

  • Malware Response Team
  • 38,580 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:09:29 PM

Posted 30 August 2016 - 08:20 AM

I do not know how these were installed but certainly not required.

HKLM\...\Run: [outvote] => "C:\Program Files (x86)\attainment\campos.exe"
HKLM-x32\...\Run: [ricki] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [ibis] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [suggestiveness] => "C:\Program Files (x86)\attainment\campos.exe"
HKU\S-1-5-21-1170261049-2036437327-1132982665-1000\...\Run: [strassburger] => "C:\Program Files (x86)\attainment\campos.exe"


If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users