1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Ransomware- Murief Trojan? or Nemucod

Discussion in 'Malware and Virus Removal' started by Joe L, 2016/09/18.

Tags:
Page 1 of 2
  1. 2016/09/18
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    I stupidly opened an email (from Fedex) and infected my computer and got a ransomware alert (on a notepad) shown at the end of my query. When I ran Malwarebytes it found the Murief trojan which i had MB delete, however when I reran a MB scan they were still there, then I ran ADW and a Full Scan of windows defender - which also removed thing - which i stupidly did not notate. I did some reading and found out it could be nemucod - which i think was also removed by WD.

    Then I ran NPE which found nothing important. Then i reran a full scan of windows defender, adw, npe and malwarebytes they found nothing. Then I ran Plumbytes and got a few things (Conduit, webtrends, qustionmarket, adguard,Xvidly, slick saving, openmanager adware) none of which, I believe, are related to the to the ransomware.

    Did I do this right? Is there anything else I should do to make sure I got rid of the ransomware? I appreciate your help. I am running windows 10 pro.

    Following is the ransomware alert I got:

    TTENTION!

    All your documents, photos, databases and other important personal files
    were encrypted using strong RSA-1024 algorithm with a unique key.
    To restore your files you have to pay 0.53450 BTC (bitcoins).
    Please follow this manual:
     
    Last edited: 2016/09/18
    Joe L,
    #1
  2. 2016/09/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Welcome aboard [​IMG]

    Please, complete all steps listed HERE

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
    broni,
    #2


  3. to hide this advert.

  4. 2016/09/18
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-09-2016
    Ran by JLL-NEW THINKPAD (18-09-2016 23:10:53)
    Running from C:\Users\JLL-NEW THINKPAD\Downloads
    Windows 10 Pro Version 1511 (X64) (2015-12-16 01:10:45)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-601027151-1453584952-853886390-500 - Administrator - Disabled)
    DefaultAccount (S-1-5-21-601027151-1453584952-853886390-503 - Limited - Disabled)
    Guest (S-1-5-21-601027151-1453584952-853886390-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-601027151-1453584952-853886390-1003 - Limited - Enabled)
    JLL-NEW THINKPAD (S-1-5-21-601027151-1453584952-853886390-1000 - Administrator - Enabled) => C:\Users\JLL-NEW THINKPAD
    LogMeInRemoteUser (S-1-5-21-601027151-1453584952-853886390-1001 - Administrator - Enabled) => C:\Users\LogMeInRemoteUser

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AV: IObit Malware Fighter (Disabled - Out of date) {4D381C57-3C7A-6F22-07EB-639F49E836D4}
    AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: IObit Malware Fighter (Disabled - Up to date) {A751AC20-3B48-5237-898A-78C4436BB78D}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Absolute Reminder (HKLM-x32\...\{40F4FF7A-B214-4453-B973-080B09CED019}) (Version: 2.0.0.19 - Absolute Software)
    Adobe Acrobat 9 Pro Extended - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}) (Version: 9.5.5 - Adobe Systems)
    Adobe Acrobat 9 Pro Extended 64-bit Add-On (HKLM\...\{AC76BA86-1033-0000-0064-0003D0000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
    Adobe Acrobat 9.5.5 - CPSID_83708 (HKLM-x32\...\{AC76BA86-1033-F400-7761-000000000004}_955) (Version: - Adobe Systems Incorporated)
    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 20.0.0.233 - Adobe Systems Incorporated)
    Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.162 - Adobe Systems Incorporated)
    Adobe Reader XI (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)
    Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.4.194 - Adobe Systems, Inc.)
    Advanced SystemCare 9 (HKLM-x32\...\Advanced SystemCare_is1) (Version: 9.3.0 - IObit)
    BDAntiRansomware (HKLM\...\{BE40AB1F-558F-4434-B72F-461EF97E7796}_is1) (Version: 1.0.12.1 - Bitdefender)
    Brother MFL-Pro Suite MFC-490CW (HKLM-x32\...\{48D082B9-18F6-4426-AFAC-8B6A3E7021B1}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
    Burn.Now 4.5 (x32 Version: 4.5.0 - Corel Corporation) Hidden
    Canon CanoScan LiDE 110 User Registration (HKLM-x32\...\Canon CanoScan LiDE 110 User Registration) (Version: - )
    Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - )
    Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version: - )
    Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - )
    CanoScan LiDE 110 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2414) (Version: - )
    CCleaner (HKLM\...\CCleaner) (Version: 5.22 - Piriform)
    Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
    Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
    Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
    Citrix Online Launcher (HKLM-x32\...\{09DA5EE2-7E46-4DC4-96F9-BFEE50D40659}) (Version: 1.0.408 - Citrix)
    Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.66.16.50 - Conexant)
    Corel Burn.Now Lenovo Edition (HKLM-x32\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - Corel Corporation)
    Corel DVD MovieFactory 7 (x32 Version: 7.0.0 - Corel Corporation) Hidden
    Corel DVD MovieFactory Lenovo Edition (HKLM-x32\...\InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}) (Version: 7.0.0 - Corel Corporation)
    Corel WinDVD (HKLM-x32\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.6.392 - Corel Inc.)
    Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Direct DiscRecorder (x32 Version: 1.00.0000 - Corel Corporation) Hidden
    Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.6.5.1 - Dolby Laboratories Inc)
    Dropbox (HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Dropbox) (Version: 10.4.25 - Dropbox, Inc.)
    Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.15 - Evernote Corp.)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 53.0.2785.116 - Google Inc.)
    Google Desktop (HKLM-x32\...\Google Desktop) (Version: 5.9.1005.12335 - Google)
    Google Talk Plugin (HKLM-x32\...\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)
    Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.7619.1252 - Google Inc.)
    Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
    GoToMeeting 5.4.0.1082 (HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\GoToMeeting) (Version: 5.4.0.1082 - CitrixOnline)
    HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )
    hppLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) Hidden
    hppP1100P1560P1600SeriesLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) Hidden
    hppusgP1100P1560P1600Series (x32 Version: 1.0.0.1 - Hewlett-Packard) Hidden
    HPSSupply (HKLM-x32\...\{7902E313-FF0F-4493-ACB1-A8147B78DCD0}) (Version: 2.1.1.0000 - Hewlett Packard Development Company L.P.)
    Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel)
    Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
    Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.35342 - Intel Corporation)
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.4.1441 - Intel Corporation)
    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
    Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
    Intel(R) Update Manager (x32 Version: 1.0.0.34813 - Intel Corporation) Hidden
    Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
    Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
    IObit Malware Fighter 4 (HKLM-x32\...\IObit Malware Fighter_is1) (Version: 4.2 - IObit)
    IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 5.3.0.142 - IObit)
    Java 8 Update 65 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418065F0}) (Version: 8.0.650.17 - Oracle Corporation)
    Java SE Development Kit 7 Update 7 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170070}) (Version: 1.7.0.70 - Oracle)
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 2.11 - )
    Lenovo Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 3.1.12.0 - Lenovo)
    Lenovo Patch Utility (HKLM-x32\...\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}) (Version: 1.3.0.9 - Lenovo Group Limited)
    Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden
    Lenovo Patch Utility 64 bit (HKLM\...\{0369F866-2CE0-4EB9-B426-88FA122C6E82}) (Version: 1.3.0.9 - Lenovo Group Limited)
    Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden
    Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.10.15 - Lenovo)
    Lenovo Registration (HKLM-x32\...\{6707C034-ED6B-4B6A-B21F-969B3606FBDE}) (Version: 1.0.4 - Lenovo Inc.)
    Lenovo SimpleTap (HKLM\...\{BF601122-9F0A-41A9-BA06-3158D9FB4B80}) (Version: 3.2.0004.00 - Lenovo Group Limited)
    Lenovo Solution Center (HKLM\...\{C1FC707B-AE6B-4DC4-89A5-6628A01F8103}) (Version: 3.3.003.00 - Lenovo)
    Lenovo Solutions for Small Business (HKLM-x32\...\{6A6D86CD-B004-46b7-8951-7BB75A776F8C}) (Version: 1.1.27.5565 - Intel(R) Corporation)
    Lenovo Solutions for Small Business Customizations (HKLM-x32\...\{5B5DEF99-85E9-423D-A1A3-B83202697B09}) (Version: 1.0.0006.00 - Lenovo Group Limited)
    Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.07.0032 - Lenovo)
    Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0009.00 - Lenovo Group Limited)
    Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0005.00 - Lenovo)
    Lenovo Welcome (HKLM-x32\...\{2DC26D10-CC6A-494F-BEA3-B5BC21126D5E}) (Version: 3.1.0020.00 - Lenovo Group Limited)
    LiveUpdate 3.3 (Symantec Corporation) (HKLM-x32\...\LiveUpdate) (Version: 3.3.0.102 - Symantec Corporation)
    LogMeIn (HKLM-x32\...\{22461A1C-BD68-4D90-9897-1DB146D55ECB}) (Version: 4.1.2504 - LogMeIn, Inc.)
    LogMeIn Client (HKLM-x32\...\{26F88B15-E5F0-47D2-8176-1A9312DD44AD}) (Version: 1.3.1648 - LogMeIn, Inc.)
    Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
    MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
    Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Message Center Plus (HKLM\...\{3849486C-FF09-4F5D-B491-3E179D58EE15}) (Version: 3.1.0004.00 - Lenovo Group Limited)
    Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
    Metric Collection SDK 35 (x32 Version: 1.2.0011.00 - Lenovo Group Limited) Hidden
    Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
    Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
    Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
    Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Outlook Personal Folders Backup (HKLM-x32\...\{C63E7C60-25EB-11D3-8EDA-00A0C911E8E5}) (Version: 1.10.0.0 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50709.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    Nalpeiron License Management (x32 Version: 6.3.9.1 - Nalpeiron) Hidden
    Nitro Pro 7 (HKLM\...\{8E0790DA-185E-4DC1-8A88-750B2A6218FD}) (Version: 7.4.1.4 - Nitro PDF Software)
    On Screen Display (HKLM\...\OnScreenDisplay) (Version: 8.42.20 - )
    Pulse Secure Setup Client (HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Juniper_Setup_Client) (Version: 8.1.6.61491 - Pulse Secure, LLC)
    Pulse Secure Setup Client 64-bit Activex Control (HKLM\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Pulse Secure, LLC)
    Pulse Secure Setup Client Activex Control (HKLM-x32\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Pulse Secure, LLC)
    Quick Bridge 3.1 (remove only) (HKLM-x32\...\Quick Bridge 3.1) (Version: - )
    RapidBoot HDD Accelerator (HKLM-x32\...\Fastboot) (Version: 1.00.0802 - Lenovo)
    RapidBoot Shield (HKLM\...\{5E2652DF-743F-482B-A593-C95F431A5769}) (Version: 1.23 - Lenovo)
    Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.29092 - Realtek Semiconduct Corp.)
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.72.410.2013 - Realtek)
    Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.29005 - Realtek Semiconductor Corp.)
    SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 3.2.0.543 - Lenovo)
    Smart Defrag 5 (HKLM-x32\...\Smart Defrag_is1) (Version: 5.0.2 - IObit)
    Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
    SugarSync Manager (HKLM-x32\...\SugarSync) (Version: 1.9.61.90905 - SugarSync, Inc.)
    Superb Game Boost 3.0 (HKLM-x32\...\SuperbGameBoost_is1) (Version: 3.0 - )
    Surfing Protection (HKLM-x32\...\IObit Surfing Protection_is1) (Version: 1.3 - IObit)
    swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
    Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.17.85 - Synaptics Incorporated)
    ThinkPad Wireless LAN Adapter Software (HKLM-x32\...\{9D3D2C60-A55F-4fed-B2B9-17311226DF01}) (Version: 1.00.0031.2 - REALTEK Semiconductor Corp.)
    ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 6.25.65 - Lenovo)
    ThinkVantage Access Connections (HKLM-x32\...\{9C551D9B-5D36-46A2-9414-F658D934B129}) (Version: 5.93 - Lenovo)
    ThinkVantage Active Protection System (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.79.00.03 - Lenovo)
    Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
    VIP Access (HKLM-x32\...\{E8D46836-CD55-453C-A107-A59EC51CB8DC}) (Version: 2.0.5.13 - VeriSign)
    Vz In-Home Agent (HKLM-x32\...\VzInHomeAgent) (Version: 9.0.73.0 - Verizon)
    Windows Driver Package - Intel (iaStor) hdc (11/29/2011 11.0.0.1032) (HKLM\...\64A62163FE43328D13305746CB8BCC93F2DF6545) (Version: 11/29/2011 11.0.0.1032 - Intel)
    Windows Driver Package - Lenovo 1.65.05.21 (01/11/2012 1.65.05.21) (HKLM\...\FD2ED46D31CE7DF190049D079E92DE03D347A634) (Version: 01/11/2012 1.65.05.21 - Lenovo)
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
    WinZip Command Line Support Add-On 3.2 (HKLM-x32\...\WZCLINE) (Version: - WinZip Computing, S.L.)
    Wise Force Deleter 1.23 (HKLM-x32\...\Wise Force Deleter_is1) (Version: 1.23 - WiseCleaner.com, Inc.)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileCoAuth.exe (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\1082\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {1B6472DC-7357-4751-9560-F38930998CB1} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
    Task: {1CE74941-AC01-4789-A981-60BAC20C46A0} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
    Task: {1E4DE038-5D30-4B6E-8BCD-446DBAAACAF8} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2016-04-20] (Lenovo)
    Task: {20B2C720-BAEB-4A9B-9384-062301F6256A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
    Task: {227F3B0E-0ADB-42B3-A46C-ABEF8F48EF25} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
    Task: {299106B5-6740-4049-98DC-62DDCFFA2E09} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => Rundll32.exe C:\Windows\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0) "
    Task: {29D9DF5C-A04A-483E-8AAD-38CD0C718719} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000UA => C:\Users\JLL-NEW THINKPAD\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-26] (Dropbox, Inc.)
    Task: {2E24EFA3-EB77-48C7-AF91-73A775E82670} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-07-01] (Lenovo)
    Task: {2EC03F72-4802-4AFD-928C-2F4080BE9BDD} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
    Task: {313DAD8C-295C-4AFA-9997-C35EFEE63598} - System32\Tasks\WiseCleaner\WFDSkipUAC => C:\Program Files (x86)\Wise\Wise Force Deleter\WiseDeleter.exe [2015-09-11] (WiseCleaner.com)
    Task: {336A28DF-5114-4D0E-A594-C525C516D0A7} - System32\Tasks\{8A92669D-BC98-4135-BE5A-911B8C3C5326} => C:\Users\JLL-NEW THINKPAD\Downloads\DNA Canon LiDE50 x64 Driver\DNA Canon LiDE50 x64 Driver\LAUNCH.EXE [2006-08-03] (Canon)
    Task: {342F1C49-1EBB-44D0-8A6D-D9F170A9FD1C} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
    Task: {3A2FF5FC-3504-4163-B20D-3E0298321644} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
    Task: {3C96C557-D62F-4111-AC5D-E4C4954B5A74} - System32\Tasks\BDAntiCryptoWallTask => C:\Program Files\Bitdefender\Tools\BDAntiRansomware\BDAntiRansomware.exe [2016-05-16] ()
    Task: {3E7CE5CA-A498-4BBB-AC48-813206095BB7} - System32\Tasks\SmartDefrag_Update => C:\Program Files (x86)\IObit\Smart Defrag\AutoUpdate.exe [2016-04-18] (IObit)
    Task: {4B0F4B9E-892F-49B9-8775-2F96B075B7F6} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
    Task: {4D473A4F-3F3D-4303-BA39-C088A3494861} - \Lenovo\SimpleTap\Start SimpleTap for JLL-NEWTHINKPAD.JLL-NEW THINKPAD -> No File <==== ATTENTION
    Task: {4FD8E908-C733-47CD-9FE1-6E756A76088A} - System32\Tasks\{AD384A9D-EEEA-4AC8-AABF-B95CEA8A2F8E} => pcalua.exe -a "C:\Users\JLL-NEW THINKPAD\Downloads\lide60vst6411111a_64en\SetupSG.exe" -d "C:\Users\JLL-NEW THINKPAD\Downloads\lide60vst6411111a_64en "
    Task: {55377D6E-7453-4A51-8D72-4C6A2B9A84D6} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-09-13] (Microsoft Corporation)
    Task: {58465423-F7E1-417A-A704-FF1F9DA4D9C5} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
    Task: {5A95D58E-347E-4125-99FE-E24CB5256EEA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
    Task: {5B650CFD-5901-425B-B43F-9CE012D9B771} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
    Task: {63BB2C79-08BD-4AE2-8055-E9900868EFFE} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
    Task: {679F222A-A370-4173-B818-3A5DFFE23E3E} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2016-06-02] (Lenovo)
    Task: {69BE74C0-AC9C-47A9-B4A4-A35E70918973} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe [2016-08-15] (Microsoft Corporation)
    Task: {6C18B9FB-C4B2-4664-9EAE-6F0C1C3536D3} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
    Task: {6F5D5B84-2FBE-443E-8B08-D2E57218CC47} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
    Task: {7083F908-7D4E-4700-8633-4F2336C8ACFC} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2016-06-02] (Lenovo)
    Task: {710C1E07-2204-4018-8C81-4BE8789F712B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-08-26] (Piriform Ltd)
    Task: {787F9623-543D-4928-9234-D7B2A54BA046} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2016-06-02] (Lenovo)
    Task: {7937AA97-3A8E-4540-A785-010C9DB4BCEB} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
    Task: {80438DF2-09A5-4B01-9AE8-EA3FB14A897B} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
    Task: {85059F11-BC34-4D85-9E48-EFB1060E87FB} - System32\Tasks\{F74BC110-EBF1-4453-8D3C-2C470B71FB94} => pcalua.exe -a "C:\Users\JLL-NEW THINKPAD\Downloads\LiDE30_7030WNENZ\SETUPSG.EXE" -d "C:\Users\JLL-NEW THINKPAD\Downloads\LiDE30_7030WNENZ "
    Task: {8B719BFD-A938-456D-97B9-9864274EFF00} - System32\Tasks\TVT\TVSUUpdateTask_UserLogOn => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2016-07-07] ()
    Task: {8BFCCE25-7169-403B-B94C-02F838E222FC} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
    Task: {8D7C3DF3-B176-4C6E-8090-4BA93697EC4B} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2016-07-07] ()
    Task: {8FFCA407-66DE-4EB9-A014-340FE1C660E7} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSC.Services.UpdateStatusService.exe [2016-06-02] ()
    Task: {91866D7B-86B2-4E27-A795-219C988EC9E0} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
    Task: {995CA820-16A9-480B-9B9F-1B706B38F81F} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2013-05-17] (Lenovo)
    Task: {9A916928-3984-4D55-81E1-64AF8CBEE104} - System32\Tasks\{C6E8124E-92D4-40E5-BA85-4A4101771F4B} => pcalua.exe -a "C:\Users\JLL-NEW THINKPAD\Downloads\deldrvvst6424640ej.exe" -d "C:\Users\JLL-NEW THINKPAD\Downloads "
    Task: {A610B2A0-5A0D-440B-B87A-E93557092073} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
    Task: {AB373F90-9C5E-47FE-915B-B17E41A39BC3} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
    Task: {AF54A6EF-DBAF-4357-9103-9DD815C4F6FB} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
    Task: {B0B805D1-38BE-48D1-AF15-8A8ED75A8955} - System32\Tasks\{AA9B6677-9D98-4EEF-9AD8-A1A9DFCF6D3B} => pcalua.exe -a "C:\Users\JLL-NEW THINKPAD\Downloads\deldrvvst6424640ej (1).exe" -d "C:\Users\JLL-NEW THINKPAD\Downloads "
    Task: {B5FC04CA-EEC8-4E37-9325-BA82FA528EF5} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
    Task: {B82D07E5-A5B1-484C-9A83-DA0202F6B7FE} - System32\Tasks\Intel(R) Small Business Advantage\Delete Temporary Internet Files => C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\HealthCenter.CleanupTool.exe [2012-11-08] (Intel Corporation)
    Task: {B9FA8972-9000-4644-AA60-0579F4F2CAAF} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
    Task: {BA7B2291-B947-49E4-A388-51696447F1E0} - \Safer-Networking\Spybot - Search and Destroy\Check for updates -> No File <==== ATTENTION
    Task: {BB0B69F3-C2A3-448C-B5A1-DB0683AD672E} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
    Task: {BE85F8D1-F1FA-41B7-9265-404CCD68A5B6} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
    Task: {C019E490-91FF-4A1F-AE84-206F33A75B01} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000UA => C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
    Task: {C0C15E23-6A43-410D-8952-AD50A59E316D} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
    Task: {C18288D9-416E-4A7D-A955-8970D2BB644F} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
    Task: {C9FD6C60-7924-4B97-AD7B-B88A9C21BAE5} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
    Task: {CB2ED866-D21D-428E-97DC-1792DDD8A9A5} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
    Task: {D45D54AE-5F31-4E5D-9C08-599E2D4A3C92} - System32\Tasks\{FC5BEC96-7DF1-40F0-8859-AB526D8B8297} => C:\Users\JLL-NEW THINKPAD\Downloads\lide60vst6411111a_64en.exe [2012-10-15] ()
    Task: {D60F33F5-C2E0-44A8-AF1D-5A8BD129F9D0} - System32\Tasks\SuperbGameBoost => C:\Program Files (x86)\SuperBoost\Superb Game Boost\SuperbGameBoostMain.exe [2016-05-12] (SuperBoost Software)
    Task: {DADA3C01-F6C6-4094-B709-C4E35C61750C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
    Task: {E36ECE6C-6C8B-4C1E-9594-036B6DF0CC42} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-09-13] (Adobe Systems Incorporated)
    Task: {E4471D50-3291-4BD9-9CF3-442EC36732F2} - \PMTask -> No File <==== ATTENTION
    Task: {E450C898-470B-49A7-8282-01673BD1D75F} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
    Task: {E507D3E9-F119-4E92-810A-5836C7B1D227} - System32\Tasks\ASC9_PerformanceMonitor => C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe [2016-05-06] (IObit)
    Task: {E5A5968F-09D6-4365-9E92-DE8CDC0FB1C8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000Core => C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
    Task: {E681CD05-C262-48B9-8530-783625FFDBAF} - System32\Tasks\ASC9_SkipUac_JLL-NEW THINKPAD => C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe [2016-05-16] (IObit)
    Task: {E88338E9-DA52-459E-B882-DB041611C6E1} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
    Task: {EEC1E069-E9D0-4DC1-9592-B7F84D0B9214} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000Core => C:\Users\JLL-NEW THINKPAD\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-26] (Dropbox, Inc.)
    Task: {F0A5512B-B36D-44F4-B82C-246AF6D59D2A} - System32\Tasks\Lenovo\LSC\LSCTaskService => c:\program files\Lenovo\lenovo solution center\App\LSCTaskService.exe
    Task: {F110B929-5F6E-43EE-B40C-8BF85C111093} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
    Task: {F839821F-2CBC-40F1-8E75-1F4E17E01241} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
    Task: {FCD8B955-D473-4D4F-A110-3BBCA44370CD} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
    Task: {FEB9FF86-74B3-47ED-A1E5-3C91EB8A574B} - System32\Tasks\DiskUpdate => C:\SWTOOLS\OSFIXES\DISKUPDT\DiskUpdate.exe [2009-02-09] ()

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\WINDOWS\Tasks\ASC9_SkipUac_JLL-NEW THINKPAD.job => C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe
    Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000Core.job => C:\Users\JLL-NEW THINKPAD\AppData\Local\Dropbox\Update\DropboxUpdate.exe
    Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000UA.job => C:\Users\JLL-NEW THINKPAD\AppData\Local\Dropbox\Update\DropboxUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000Core.job => C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000UA.job => C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\GoogleUpdate.exe

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2015-10-30 03:17 - 2015-10-30 03:17 - 00028672 _____ () C:\WINDOWS\SYSTEM32\efsext.dll
    2015-10-30 03:18 - 2015-10-30 03:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
    2014-12-22 13:00 - 2012-08-31 16:03 - 00288768 _____ () C:\WINDOWS\System32\HP1100LM.DLL
    2015-12-15 21:05 - 2012-08-31 16:02 - 00074240 _____ () C:\WINDOWS\system32\spool\PRTPROCS\x64\HP1100PP.DLL
    2012-09-16 05:20 - 2012-03-06 18:49 - 00128280 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
    2013-02-08 11:10 - 2005-04-22 14:36 - 00143360 _____ () C:\WINDOWS\system32\BrSNMP64.dll
    2012-10-12 12:52 - 2012-08-31 16:03 - 03034112 _____ () C:\WINDOWS\system32\spool\DRIVERS\x64\3\hp1100su.dll
    2012-10-12 12:52 - 2012-08-31 16:02 - 01038336 _____ () C:\WINDOWS\system32\spool\DRIVERS\x64\3\HP1100GC.dll
    2016-09-13 15:18 - 2016-09-07 01:39 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
    2016-09-13 15:18 - 2016-09-07 01:39 - 02656952 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
    2016-08-15 20:04 - 2016-08-15 20:04 - 01864384 _____ () C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\ClientTelemetry.dll
    2012-05-24 02:04 - 2012-05-24 02:04 - 00108040 _____ () C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NPShellExtension64.dll
    2016-09-13 15:14 - 2016-09-07 00:10 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
    2015-12-17 23:44 - 2015-12-07 00:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
    2016-07-13 09:24 - 2016-06-30 23:48 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
    2016-09-13 15:15 - 2016-09-07 00:15 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
    2016-09-13 15:15 - 2016-09-07 00:11 - 00936448 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
    2016-09-13 15:15 - 2016-09-07 00:10 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
    2016-09-13 15:15 - 2016-09-07 00:13 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
    2015-12-15 20:49 - 2010-10-26 13:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
    2016-09-02 20:24 - 2016-07-07 15:21 - 00028544 _____ () C:\Program Files (x86)\Lenovo\System Update\SUService.exe
    2016-04-18 23:16 - 2016-04-18 23:16 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
    2012-09-16 05:32 - 2012-01-17 02:29 - 00030512 ____N () C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBServiceps.dll
    2016-05-19 22:45 - 2015-12-23 18:32 - 00355616 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare\madExcept_.bpl
    2016-05-19 22:45 - 2015-12-23 18:32 - 00190240 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare\madBasic_.bpl
    2016-05-19 22:45 - 2015-12-23 18:32 - 00057632 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare\madDisAsm_.bpl
    2016-08-15 20:04 - 2016-08-15 20:04 - 01383616 _____ () C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\ClientTelemetry.dll
    2016-08-15 20:04 - 2016-08-15 20:04 - 00118976 _____ () C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileSyncViews.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 02281984 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtCore4.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 00891392 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtNetwork4.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 00016896 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\featureController.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 00062976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\osEvents.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 00322048 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\log4cplus.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 00339456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtXml4.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 00400384 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\sqlite3.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 00195584 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\libgsoap.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 00062464 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\zlib1.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 00446976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\deviceProfile.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 00019456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\eventsSender.dll
    2012-09-16 05:36 - 2012-07-12 08:59 - 00062976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\serviceManagerStarter.dll
    2016-06-02 10:21 - 2016-03-28 16:46 - 00130880 _____ () C:\Program Files (x86)\SuperBoost\Superb Game Boost\Temperature.dll
    2016-06-02 10:21 - 2016-02-02 09:53 - 00629056 _____ () C:\Program Files (x86)\SuperBoost\Superb Game Boost\SgbStatistics.dll
    2016-06-02 10:21 - 2016-05-10 14:08 - 00829760 _____ () C:\Program Files (x86)\SuperBoost\Superb Game Boost\GA_IG.dll
    2016-06-02 10:21 - 2016-01-29 18:03 - 00337216 _____ () C:\Program Files (x86)\SuperBoost\Superb Game Boost\taskMgr.dll
    2016-06-02 10:21 - 2016-05-10 14:08 - 00510272 _____ () C:\Program Files (x86)\SuperBoost\Superb Game Boost\GA_ID.dll
    2016-06-02 10:21 - 2016-01-29 15:21 - 00276800 _____ () C:\Program Files (x86)\SuperBoost\Superb Game Boost\D3DX8Wrapper.dll
    2016-06-02 10:21 - 2016-05-10 14:08 - 01214272 _____ () c:\program files (x86)\superboost\superb game boost\GA_CheackDx.dll
    2012-09-16 05:20 - 2012-03-06 18:27 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
    2016-04-18 23:16 - 2016-04-18 23:16 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
    2016-04-18 23:16 - 2016-04-18 23:17 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
    2016-05-19 22:45 - 2015-12-28 13:50 - 00899872 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare\webres.dll
    2016-05-19 22:45 - 2015-12-28 13:50 - 01293088 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare\Scan.dll
    2016-05-19 22:45 - 2015-12-28 13:49 - 00629536 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare\ProductStatistics.dll
    2016-09-16 21:50 - 2016-09-13 20:38 - 01806152 _____ () C:\Program Files (x86)\Google\Chrome\Application\53.0.2785.116\libglesv2.dll
    2016-09-16 21:50 - 2016-09-13 20:38 - 00094024 _____ () C:\Program Files (x86)\Google\Chrome\Application\53.0.2785.116\libegl.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice => " "= "Service "

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\008i.com -> 008i.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\008k.com -> 008k.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\00hq.com -> 00hq.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\0190-dialers.com -> 0190-dialers.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\01i.info -> 01i.info
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\05p.com -> 05p.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\0calories.net -> 0calories.net
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\0cj.net -> 0cj.net
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\0scan.com -> 0scan.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\1-domains-registrations.com -> 1-domains-registrations.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\1-se.com -> 1-se.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\1001movie.com -> 1001movie.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\1001night.biz -> 1001night.biz
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\100gal.net -> 100gal.net
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\100sexlinks.com -> 100sexlinks.com

    There are 4790 more sites.


    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\windows live photo gallery wallpaper.jpg
    DNS Servers: 192.168.5.1 - 192.168.1.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    MSCONFIG\startupreg: Adobe ARM => c:\program files (x86)\common files\adobe\arm\1.0\adobearm.exe
    MSCONFIG\startupreg: Advanced SystemCare 6 =>
    MSCONFIG\startupreg: BrMfcWnd => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
    MSCONFIG\startupreg: CanonSolutionMenuEx => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
    MSCONFIG\startupreg: ControlCenter3 =>
    MSCONFIG\startupreg: Google Desktop Search =>
    MSCONFIG\startupreg: HPUsageTrackingLEDM =>
    MSCONFIG\startupreg: LogMeIn GUI => "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe "
    MSCONFIG\startupreg: Skype =>
    MSCONFIG\startupreg: SunJavaUpdateSched => c:\program files (x86)\common files\java\java update\jusched.exe
    HKLM\...\StartupApproved\Run32: => "IObit Malware Fighter "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\StartupApproved\StartupFolder: => "Dropbox.lnk "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\StartupApproved\Run: => "CCleaner Monitoring "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\StartupApproved\Run: => "Dropbox Update "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\StartupApproved\Run: => "Crypted "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\StartupApproved\Run: => "Advanced SystemCare 9 "
     
    Joe L,
    #3
  5. 2016/09/18
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice => " "= "Service "

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\008i.com -> 008i.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\008k.com -> 008k.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\00hq.com -> 00hq.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\0190-dialers.com -> 0190-dialers.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\01i.info -> 01i.info
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\05p.com -> 05p.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\0calories.net -> 0calories.net
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\0cj.net -> 0cj.net
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\0scan.com -> 0scan.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\1-domains-registrations.com -> 1-domains-registrations.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\1-se.com -> 1-se.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\1001movie.com -> 1001movie.com
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\1001night.biz -> 1001night.biz
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\100gal.net -> 100gal.net
    IE restricted site: HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\100sexlinks.com -> 100sexlinks.com

    There are 4790 more sites.


    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\windows live photo gallery wallpaper.jpg
    DNS Servers: 192.168.5.1 - 192.168.1.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    MSCONFIG\startupreg: Adobe ARM => c:\program files (x86)\common files\adobe\arm\1.0\adobearm.exe
    MSCONFIG\startupreg: Advanced SystemCare 6 =>
    MSCONFIG\startupreg: BrMfcWnd => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
    MSCONFIG\startupreg: CanonSolutionMenuEx => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
    MSCONFIG\startupreg: ControlCenter3 =>
    MSCONFIG\startupreg: Google Desktop Search =>
    MSCONFIG\startupreg: HPUsageTrackingLEDM =>
    MSCONFIG\startupreg: LogMeIn GUI => "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe "
    MSCONFIG\startupreg: Skype =>
    MSCONFIG\startupreg: SunJavaUpdateSched => c:\program files (x86)\common files\java\java update\jusched.exe
    HKLM\...\StartupApproved\Run32: => "IObit Malware Fighter "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\StartupApproved\StartupFolder: => "Dropbox.lnk "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\StartupApproved\Run: => "CCleaner Monitoring "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\StartupApproved\Run: => "Dropbox Update "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\StartupApproved\Run: => "Crypted "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\StartupApproved\Run: => "Advanced SystemCare 9 "

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
    FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
    FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
    FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
    FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
    FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
    FirewallRules: [{E4F0FDE2-2B37-4323-A6DE-47C2CBDD07AB}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
    FirewallRules: [{4FAEC451-6015-4935-B3B6-22BEA06AC34A}] => (Allow) LPort=2869
    FirewallRules: [{64753141-CCC0-47D6-A68D-BDFFE056A0D5}] => (Allow) LPort=1900
    FirewallRules: [{B56D6CA8-C146-4B03-845D-DDBEAFB9B85C}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    FirewallRules: [{82C83FAC-F608-4EDE-A10C-ABDE3BB2645F}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
    FirewallRules: [TCP Query User{427546A9-5948-4E18-8259-A52344E3B12F}C:\program files (x86)\intel\intelappstore\bin\ismagent.exe] => (Allow) C:\program files (x86)\intel\intelappstore\bin\ismagent.exe
    FirewallRules: [UDP Query User{7275111E-2424-4134-8B16-BB8D523AB452}C:\program files (x86)\intel\intelappstore\bin\ismagent.exe] => (Allow) C:\program files (x86)\intel\intelappstore\bin\ismagent.exe
    FirewallRules: [TCP Query User{FD67B084-1E6D-4A51-B60F-E822CAFC04C1}C:\program files (x86)\intel\intelappstore\bin\ismagent.exe] => (Allow) C:\program files (x86)\intel\intelappstore\bin\ismagent.exe
    FirewallRules: [UDP Query User{88F140C0-FCAD-4BF4-8298-95404D35AFC6}C:\program files (x86)\intel\intelappstore\bin\ismagent.exe] => (Allow) C:\program files (x86)\intel\intelappstore\bin\ismagent.exe
    FirewallRules: [{CDF8292A-1910-4909-AF7D-FD114A814099}] => (Allow) C:\LJP1100_P1560_P1600_Full_Solution\ProductInst64.exe
    FirewallRules: [{FB8789A9-1816-4EFC-AF72-E056730F07B8}] => (Allow) C:\LJP1100_P1560_P1600_Full_Solution\ProductInst64.exe
    FirewallRules: [{AC487BB5-35F5-431F-B9D9-1667EC8CFBC8}] => (Allow) LPort=9100
    FirewallRules: [{7E0B5757-394F-41B2-8888-04874CBA374D}] => (Allow) LPort=427
    FirewallRules: [{62689C38-ED3C-49A6-839E-5011F86BF62F}] => (Allow) LPort=161
    FirewallRules: [{12F0467A-8548-4B44-9782-F1E92AA1AF2A}] => (Allow) LPort=427
    FirewallRules: [{496528F5-68C5-4CCB-8409-1A102C97291B}] => (Allow) C:\Program Files (x86)\Brother\Brmfl08x\FAXRX.exe
    FirewallRules: [{6FB0E983-14BE-4E6A-976C-0E606CA1832D}] => (Allow) C:\Program Files (x86)\Brother\Brmfl08x\FAXRX.exe
    FirewallRules: [{8FAA5447-1F7C-472B-9FCE-A316CB965100}] => (Allow) LPort=54925
    FirewallRules: [TCP Query User{82CD7CE7-ADEA-45B6-B67B-932B196E5BCC}C:\users\jll-new thinkpad\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\jll-new thinkpad\appdata\roaming\dropbox\bin\dropbox.exe
    FirewallRules: [UDP Query User{4FF74F3C-085D-4267-826C-AB9D1315E159}C:\users\jll-new thinkpad\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\jll-new thinkpad\appdata\roaming\dropbox\bin\dropbox.exe
    FirewallRules: [{07348FAA-16AB-4840-837F-BA28453DCA0B}] => (Allow) C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\Dropbox.exe
    FirewallRules: [{61E86958-1723-4D15-9AAF-9B5ACF1795A7}] => (Allow) C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\Dropbox.exe
    FirewallRules: [TCP Query User{E7A4E4AC-C6F6-4DE1-AD40-874109CCF65C}C:\users\jll-new thinkpad\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\jll-new thinkpad\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
    FirewallRules: [UDP Query User{8C581C65-203A-4C29-AC69-F73F68E83117}C:\users\jll-new thinkpad\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\jll-new thinkpad\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
    FirewallRules: [{BBD72DFE-BEA4-4939-9EEA-3B8AB237CE86}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
    FirewallRules: [{03CD79D2-9DB7-4E3C-BF56-F2EE964A08C4}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
    FirewallRules: [{A861D849-35BA-4E03-854C-C89020878321}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
    FirewallRules: [{13D2FF89-7C39-4787-8C41-0C4DFFFD9166}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
    FirewallRules: [{BD639121-E091-408C-9395-F639D017843D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    ==================== Restore Points =========================

    01-09-2016 11:59:16 Windows Update
    08-09-2016 22:27:41 Scheduled Checkpoint
    13-09-2016 15:02:15 Windows Modules Installer
    13-09-2016 15:03:08 Windows Modules Installer
    17-09-2016 18:13:02 JRT Pre-Junkware Removal
    17-09-2016 23:06:45 JRT Pre-Junkware Removal
    18-09-2016 15:49:05 Restore Operation
    18-09-2016 20:16:05 JRT Pre-Junkware Removal

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (09/18/2016 08:16:24 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
    Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

    Details:
    AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

    System Error:
    Access is denied.
    .

    Error: (09/18/2016 07:57:02 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: JLL-NEWTHINKPAD)
    Description: Activation of app Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

    Error: (09/18/2016 07:54:13 PM) (Source: SideBySide) (EventID: 78) (User: )
    Description: Activation context generation failed for "C:\Program Files (x86)\Adobe\Acrobat 9.0\Designer 8.2\FormDesigner.exe ".Error in manifest or policy file " " on line .
    A component version required by the application conflicts with another component version already active.
    Conflicting components are:.
    Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.589_none_a2ddb3caa539acce.manifest.
    Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.589_none_ea8aeaa1b9b5d5d4.manifest.

    Error: (09/18/2016 07:53:15 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
    Description: The index cannot be initialized.

    Details:
    The specified object cannot be found. Specify the name of an existing object. (HRESULT : 0x80040d06) (0x80040d06)

    Error: (09/18/2016 07:53:15 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
    Description: The application cannot be initialized.

    Context: Windows Application

    Details:
    The specified object cannot be found. Specify the name of an existing object. (HRESULT : 0x80040d06) (0x80040d06)

    Error: (09/18/2016 07:53:15 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
    Description: The gatherer object cannot be initialized.

    Context: Windows Application, SystemIndex Catalog

    Details:
    The specified object cannot be found. Specify the name of an existing object. (HRESULT : 0x80040d06) (0x80040d06)

    Error: (09/18/2016 07:53:15 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
    Description: The plug-in in <Search.TripoliIndexer> cannot be initialized.

    Context: Windows Application, SystemIndex Catalog

    Details:
    The specified object cannot be found. Specify the name of an existing object. (HRESULT : 0x80040d06) (0x80040d06)

    Error: (09/18/2016 07:53:14 PM) (Source: Windows Search Service) (EventID: 3057) (User: )
    Description: The plug-in manager <Search.TripoliIndexer> cannot be initialized.

    Context: Windows Application

    Details:
    (HRESULT : 0x8e5e0210) (0x8e5e0210)

    Error: (09/18/2016 07:53:14 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
    Description: The Windows Search Service is being stopped because there is a problem with the indexer: The catalog is corrupt.

    Details:
    The content index catalog is corrupt. 0xc0041801 (0xc0041801)

    Error: (09/18/2016 07:52:57 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
    Description: The search service has detected corrupted data files in the index {id=4810 - base\appmodel\search\search\ytrip\common\util\jetutil.cpp (203)}. The service will attempt to automatically correct this problem by rebuilding the index.

    Details:
    0x8e5e0210 (0x8e5e0210)


    System errors:
    =============
    Error: (09/18/2016 08:48:33 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The SAService service failed to start due to the following error:
    The system cannot find the file specified.

    Error: (09/18/2016 08:48:32 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error:
    The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

    Error: (09/18/2016 08:48:12 PM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT AUTHORITY)
    Description: The password notification DLL ACGina failed to load with error 126. Please verify that the notification DLL path defined in the registry, HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages, refers to a correct and absolute path (<drive>:\<path>\<filename>.<ext>) and not a relative or invalid path. If the DLL path is correct, please validate that any supporting files are located in the same directory, and that the system account has read access to both the DLL path and any supporting files. Contact the provider of the notification DLL for additional support. Further details can be found on the web at Learn to Develop with Microsoft Developer Network | MSDN.

    Error: (09/18/2016 08:47:27 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: A timeout was reached (30000 milliseconds) while waiting for the User Data Storage_7b46a service to connect.

    Error: (09/18/2016 08:47:25 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The User Data Access_7b46a service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

    Error: (09/18/2016 08:47:25 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The User Data Storage_7b46a service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

    Error: (09/18/2016 08:47:25 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The Contact Data_7b46a service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

    Error: (09/18/2016 08:47:25 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The Sync Host_7b46a service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

    Error: (09/18/2016 08:47:25 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The NPEService service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (09/18/2016 08:45:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Intel(R) Small Business Advantage service failed to start due to the following error:
    The service did not respond to the start or control request in a timely fashion.


    CodeIntegrity:
    ===================================
    Date: 2016-09-18 19:34:12.675
    Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2016-09-18 19:34:12.658
    Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2016-09-18 19:34:12.631
    Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2016-09-18 19:34:12.614
    Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2016-09-18 19:34:12.588
    Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2016-09-18 19:34:12.572
    Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2016-09-18 19:34:12.440
    Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2016-09-18 19:34:12.333
    Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2016-09-18 19:34:12.250
    Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2016-09-18 19:34:12.155
    Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
    Percentage of memory in use: 59%
    Total physical RAM: 3689.96 MB
    Available physical RAM: 1482.93 MB
    Total Virtual: 7657.96 MB
    Available Virtual: 5064.03 MB

    ==================== Drives ================================

    Drive c: (Windows7_OS) (Fixed) (Total:278.27 GB) (Free:209.2 GB) NTFS ==>[system with boot components (obtained from drive)]
    Drive e: (Lexar) (Removable) (Total:14.9 GB) (Free:1.05 GB) FAT32
    Drive q: (Lenovo_Recovery) (Fixed) (Total:17.58 GB) (Free:6.49 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 298.1 GB) (Disk ID: 912A6DC2)
    Partition 1: (Active) - (Size=1.5 GB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=278.3 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=797 MB) - (Type=27)
    Partition 4: (Not Active) - (Size=17.6 GB) - (Type=07 NTFS)g

    ========================================================
    Disk: 1 (MBR Code: Windows XP) (Size: 14.9 GB) (Disk ID: C3072E18)
    Partition 1: (Not Active) - (Size=14.9 GB) - (Type=0C)

    ==================== End of Addition.txt ==
     
    Joe L,
    #4
  6. 2016/09/18
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    Thank you for your help. I am new to this forum and have never faced a problem like this before. I am trying to follow your directions. P;lease forgive me if I slip up and just tell me what to do.

    My computer is running well. I ran the Farbar Tool as you suggested and posted the results in the preceding two replies. Here is the FRST notepad results

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-09-2016
    Ran by JLL-NEW THINKPAD (administrator) on JLL-NEWTHINKPAD (18-09-2016 23:37:40)
    Running from C:\Users\JLL-NEW THINKPAD\Downloads
    Loaded Profiles: JLL-NEW THINKPAD (Available Profiles: JLL-NEW THINKPAD & LogMeInRemoteUser)
    Platform: Windows 10 Pro Version 1511 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe
    (IObit) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe
    (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
    (Lenovo.) C:\Windows\System32\ibmpmsvc.exe
    (Intel Corporation) C:\Windows\System32\igfxCUIService.exe
    (Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
    (Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
    (HP) C:\Windows\System32\HPSIsvc.exe
    (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
    () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
    (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
    (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
    (Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
    (Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
    (Microsoft Corporation) C:\Windows\System32\mqsvc.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
    (SuperBoost Software) C:\Program Files (x86)\SuperBoost\SuperBoost Software Updater\SuperBoostUpdater.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
    (Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\mkrmsg.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
    (Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    (Intel Corporation) C:\Windows\System32\igfxEM.exe
    (Intel Corporation) C:\Windows\System32\igfxHK.exe
    (Intel Corporation) C:\Windows\System32\igfxTray.exe
    () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
    (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
    (Lenovo.) C:\Windows\System32\TpShocks.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
    (Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe
    (Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (SuperBoost Software) C:\Program Files (x86)\SuperBoost\Superb Game Boost\SuperbGameBoostMain.exe
    () C:\Program Files (x86)\Lenovo\System Update\SUService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe
    (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
    (Symantec Corporation) C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
    () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
    (Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe
    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Farbar) C:\Users\JLL-NEW THINKPAD\Downloads\FRST64 (1).exe


    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
    HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [935104 2014-11-25] (Conexant Systems, Inc.)
    HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
    HKLM\...\Run: [TpShocks] => C:\WINDOWS\system32\TpShocks.exe [384344 2014-02-17] (Lenovo.)
    HKLM\...\Run: [ResetACGauge] => C:\Program Files (x86)\Lenovo\Access Connections\smbhlpr.exe [153840 2015-06-08] (Lenovo)
    HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63728 2015-06-08] (Lenovo)
    HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-03-06] (Intel Corporation)
    HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-04-13] (Intel Corporation)
    HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [1091376 2012-01-17] (Lenovo)
    HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
    HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe /boot
    HKLM-x32\...\Run: [IntelSBA] => C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe [4277000 2012-11-08] (Intel Corporation)
    HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [44128 2013-05-08] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [HPUsageTrackingLEDM] => c:\program files (x86)\hp\hp ut ledm\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)
    HKLM-x32\...\Run: [ControlCenter3] => c:\program files (x86)\brother\controlcenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
    HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508656 2012-08-31] (Dolby Laboratories Inc.)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
    HKLM-x32\...\Run: [IObit Malware Fighter] => C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe [5976864 2016-06-28] (IObit)
    Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [Google Update] => C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-28] (Google Inc.)
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [Dropbox Update] => C:\Users\JLL-NEW THINKPAD\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-26] (Dropbox, Inc.)
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [Advanced SystemCare 9] => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe [2022688 2016-04-26] (IObit)
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8912088 2016-08-26] (Piriform Ltd)
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\amd64 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\MountPoints2: {71f7110c-89f4-11e4-a15c-b888e339af76} - "F:\SISetup.exe"
    AppInit_DLLs: acaptuser64.dll => C:\WINDOWS\system32\acaptuser64.dll [119160 2008-06-11] (Adobe Systems, Inc.)
    Lsa: [Notification Packages] scecli ACGina
    ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
    ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
    ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
    ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
    ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt.43.dll [2016-09-12] (Dropbox, Inc.)
    Startup: C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-11-09]
    ShortcutTarget: Dropbox.lnk -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    BootExecute: RegistryDefragBootTime.exeautocheck autochk *

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.5.1 192.168.5.1 192.168.1.1
    Tcpip\..\Interfaces\{72821754-f317-425a-a783-9b1ec9ac53ce}: [DhcpNameServer] 192.168.5.1 192.168.5.1 192.168.1.1

    Internet Explorer:
    ==================
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://www.google.com/
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
    SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-601027151-1453584952-853886390-1000 -> {70D46D94-BF1E-45ED-B567-48701376298E} URL = hxxp://127.0.0.1:4664/search&s=dxjF8fmw03vvLuTUsjqpb6JRI-s?q={searchTerms}
    BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2015-11-12] (IObit)
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_65\bin\ssv.dll [2015-10-30] (Oracle Corporation)
    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
    BHO: Symantec VIP Access Add-On -> {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} -> C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll [2012-04-19] (Symantec Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-10-30] (Oracle Corporation)
    BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
    BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)
    BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    BHO-x32: Symantec VIP Access Add-On -> {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} -> C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll [2012-04-19] (Symantec Corporation)
    BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
    Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)
    Toolbar: HKU\S-1-5-21-601027151-1453584952-853886390-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
    Toolbar: HKU\S-1-5-21-601027151-1453584952-853886390-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
    DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab

    FireFox:
    ========
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_23_0_0_162.dll [2016-09-13] ()
    FF Plugin: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-10-30] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-10-30] (Oracle Corporation)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50709.0\npctrl.dll [2016-07-11] ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_162.dll [2016-09-13] ()
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50709.0\npctrl.dll [2016-07-11] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro PDF\Professional 7\npnitromozilla.dll [2012-05-24] ( )
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
    FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @citrixonline.com/appdetectorplugin -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2016-04-26] (Citrix Online)
    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @talk.google.com/O1DPlugin -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @tools.google.com/Google Update;version=3 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @tools.google.com/Google Update;version=9 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Users\JLL-NEW THINKPAD\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
    FF Plugin ProgramFiles/Appdata: C:\Users\JLL-NEW THINKPAD\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)
    FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
    FF Extension: (SmartPrintButton) - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011-01-26] [not signed]
    FF HKLM-x32\...\Firefox\Extensions: [VIP5X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access Client
    FF Extension: (Symantec VIP Access Add-On) - C:\Program Files (x86)\Symantec\VIP Access Client [2013-03-21] [not signed]

    Chrome:
    =======
    CHR Plugin: (Widevine Content Decryption Module) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.823\_platform_specific\win_x86\widevinecdmadapter.dll => No File
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\53.0.2785.116\PepperFlash\pepflashplayer.dll ()
    CHR Profile: C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default [2016-09-18]
    CHR Extension: (Google Drive) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-11]
    CHR Extension: (Google Search) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
    CHR Extension: (Full Screen Weather) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkkaebihfmbofclegkcfkkemepfehibg [2015-05-12]
    CHR Extension: (Google Docs Offline) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-11]
    CHR Extension: (AdBlock) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-09-17]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-01]
    CHR Extension: (Gmail) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
    CHR Extension: (Chrome Media Router) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-30]

    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AdvancedSystemCareService9; C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe [446240 2016-01-05] (IObit)
    R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [169776 2012-01-17] (Lenovo)
    S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2012-10-01] (Macrovision Europe Ltd.) [File not signed]
    S3 GoogleDesktopManager-051210-111108; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2012-10-11] (Google)
    R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [330136 2015-10-30] (Intel Corporation)
    S3 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
    R2 IMFservice; C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [1597728 2016-06-13] (IObit)
    R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-03-06] ()
    R2 intelsba; C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [50440 2012-11-08] (Intel Corporation)
    R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [163608 2012-03-06] (Intel Corporation)
    R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [136288 2012-08-10] (Lenovo Group Limited)
    S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093944 2011-02-07] (Symantec Corporation)
    R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [419336 2016-09-15] (LogMeIn, Inc.)
    R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [509448 2016-09-15] (LogMeIn, Inc.)
    R3 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-06-08] (LogMeIn, Inc.)
    R2 NitroDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe [216072 2012-05-24] (Nitro PDF Software)
    R2 sgbupt; C:\Program Files (x86)\SuperBoost\SuperBoost Software Updater\SuperBoostUpdater.exe [2600256 2016-04-21] (SuperBoost Software)
    S3 ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [31176 2016-01-20] (SHAREit Technologies Co.Ltd)
    R3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [28544 2016-07-07] ()
    R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [255608 2016-04-21] (Synaptics Incorporated)
    R2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84080 2012-04-19] (Symantec Corporation)
    S3 vmicvss; C:\Windows\System32\ICSvc.dll [511488 2016-09-07] (Microsoft Corporation)
    R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364456 2016-09-07] (Microsoft Corporation)
    R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-09-07] (Microsoft Corporation)

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R1 adgnetworkwfpdrv; C:\Windows\System32\drivers\adgnetworkwfpdrv.sys [55800 2015-06-02] ()
    S3 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70416 2012-01-17] (Windows (R) Win 7 DDK provider)
    R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-05-23] (REALiX(tm))
    S3 IMFFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\IMFFilter.sys [22208 2016-04-01] (IObit)
    R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-06-04] (LogMeIn, Inc.)
    S4 LMIRfsClientNP; no ImagePath
    R3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)
    S3 RegFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [34848 2016-01-11] (IObit.com)
    R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [328920 2016-04-14] (Realtek Semiconductor Corp.)
    R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [936192 2016-06-15] (Realtek )
    R3 rtwlane_13; C:\Windows\System32\drivers\rtwlane_13.sys [3749888 2015-10-30] (Realtek Semiconductor Corporation )
    R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [51320 2016-04-21] (Synaptics Incorporated)
    S3 Trufos; C:\Windows\System32\DRIVERS\TRUFOS.sys [452040 2016-03-31] (BitDefender S.R.L.)
    R3 Tvti2c; C:\Windows\system32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)
    S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
    R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
    R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
    R1 WiseUnlock; C:\WINDOWS\WiseUnlock64.sys [12240 2015-05-19] (WiseCleaner.com)
    U3 idsvc; no ImagePath

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2016-09-18 23:10 - 2016-09-18 23:11 - 00063723 _____ C:\Users\JLL-NEW THINKPAD\Downloads\Addition.txt
    2016-09-18 23:09 - 2016-09-18 23:37 - 00030840 _____ C:\Users\JLL-NEW THINKPAD\Downloads\FRST.txt
    2016-09-18 23:09 - 2016-09-18 23:37 - 00000000 ____D C:\FRST
    2016-09-18 23:09 - 2016-09-18 23:09 - 02400256 _____ (Farbar) C:\Users\JLL-NEW THINKPAD\Downloads\FRST64 (1).exe
    2016-09-18 23:07 - 2016-09-18 23:07 - 02400256 _____ (Farbar) C:\Users\JLL-NEW THINKPAD\Downloads\FRST64.exe
    2016-09-18 22:58 - 2016-09-18 22:58 - 01089816 _____ (Emsisoft Ltd) C:\Users\JLL-NEW THINKPAD\Downloads\decrypt_nemucod.exe
    2016-09-18 22:12 - 2016-09-18 22:12 - 00000114 _____ C:\WINDOWS\ntbtlog.txt
    2016-09-18 21:30 - 2016-09-18 21:30 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Roaming\ProductData
    2016-09-18 21:02 - 2016-09-18 21:02 - 00003220 _____ C:\WINDOWS\System32\Tasks\BDAntiCryptoWallTask
    2016-09-18 20:42 - 2016-09-18 20:47 - 00000000 ____D C:\ProgramData\ProductData
    2016-09-18 19:43 - 2016-09-18 19:43 - 00048206 _____ C:\Users\JLL-NEW THINKPAD\Documents\cc_20160918_194334.reg
    2016-09-18 18:25 - 2016-09-18 18:25 - 00002892 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
    2016-09-18 18:24 - 2016-09-18 18:24 - 00000876 _____ C:\Users\Public\Desktop\CCleaner.lnk
    2016-09-18 18:24 - 2016-09-18 18:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
    2016-09-18 18:24 - 2016-09-18 18:24 - 00000000 ____D C:\Program Files\CCleaner
    2016-09-18 18:23 - 2016-09-18 18:24 - 08244656 _____ (Piriform Ltd) C:\Users\JLL-NEW THINKPAD\Desktop\ccsetup522.exe
    2016-09-18 16:08 - 2016-09-18 19:44 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\CrashDumps
    2016-09-18 14:13 - 2016-09-18 19:50 - 00000000 ____D C:\Program Files\Plumbytes Software
    2016-09-18 01:05 - 2016-09-18 01:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BDAntiRansomware
    2016-09-18 01:05 - 2016-09-18 01:05 - 00000000 ____D C:\Program Files\Bitdefender
    2016-09-18 01:04 - 2016-09-18 01:05 - 04703248 _____ (Bitdefender ) C:\Users\JLL-NEW THINKPAD\Desktop\BDAntiRansomwareSetup.exe
    2016-09-18 00:49 - 2016-09-18 00:49 - 01089816 _____ (Emsisoft Ltd) C:\Users\JLL-NEW THINKPAD\Desktop\decrypt_nemucod (1).exe
    2016-09-18 00:47 - 2016-09-18 00:47 - 01089816 _____ (Emsisoft Ltd) C:\Users\JLL-NEW THINKPAD\Desktop\decrypt_nemucod.exe
    2016-09-18 00:12 - 2016-09-18 20:50 - 00000000 ____D C:\NPE
    2016-09-17 23:56 - 2016-09-18 22:18 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\NPE
    2016-09-17 23:55 - 2016-09-17 23:56 - 03423928 _____ (Symantec Corporation) C:\Users\JLL-NEW THINKPAD\Desktop\NPE.exe
    2016-09-17 18:52 - 2016-09-17 18:52 - 00001362 _____ C:\Users\JLL-NEW THINKPAD\Desktop\a.txt
    2016-09-17 18:15 - 2016-09-18 20:18 - 00000712 _____ C:\Users\JLL-NEW THINKPAD\Desktop\JRT.txt
    2016-09-17 18:12 - 2016-09-17 18:12 - 01610560 _____ (Malwarebytes) C:\Users\JLL-NEW THINKPAD\Desktop\JRT.exe
    2016-09-17 17:38 - 2016-09-17 17:38 - 03861056 _____ C:\Users\JLL-NEW THINKPAD\Desktop\adwcleaner_6.020.exe
    2016-09-17 16:58 - 2016-09-17 22:18 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\YdPack
    2016-09-17 15:51 - 2016-09-18 22:05 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\f28b4
    2016-09-17 15:51 - 2016-09-17 22:18 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\Insoft
    2016-09-17 15:51 - 2016-09-17 15:51 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Roaming\9373f
    2016-09-17 15:50 - 2016-09-17 15:50 - 00001362 _____ C:\Users\JLL-NEW THINKPAD\Desktop\DECRYPT.txt
    2016-09-16 20:21 - 2016-09-16 20:21 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
    2016-09-14 11:44 - 2016-09-15 11:44 - 00122400 _____ (LogMeIn, Inc.) C:\WINDOWS\system32\LMIRfsClientNP.dll
    2016-09-14 11:44 - 2012-06-08 12:06 - 00072216 _____ (LogMeIn, Inc.) C:\WINDOWS\system32\Drivers\LMIRfsDriver.sys
    2016-09-13 15:18 - 2016-09-07 01:39 - 02656952 _____ C:\WINDOWS\system32\CoreUIComponents.dll
    2016-09-13 15:18 - 2016-09-07 01:39 - 01098640 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
    2016-09-13 15:18 - 2016-09-07 01:26 - 02544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
    2016-09-13 15:18 - 2016-09-07 01:26 - 01299504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
    2016-09-13 15:18 - 2016-09-07 01:26 - 01152320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
    2016-09-13 15:18 - 2016-09-07 01:26 - 00588320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmdrmdev.dll
    2016-09-13 15:18 - 2016-09-07 01:25 - 02607336 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
    2016-09-13 15:18 - 2016-09-07 01:23 - 01750440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe
    2016-09-13 15:18 - 2016-09-07 01:19 - 00294752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
    2016-09-13 15:18 - 2016-09-07 00:48 - 22379520 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
    2016-09-13 15:18 - 2016-09-07 00:43 - 16985600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
    2016-09-13 15:18 - 2016-09-07 00:39 - 01567744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
    2016-09-13 15:18 - 2016-09-07 00:35 - 24611840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
    2016-09-13 15:18 - 2016-09-07 00:35 - 00383488 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
    2016-09-13 15:18 - 2016-09-07 00:32 - 00787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\cscui.dll
    2016-09-13 15:18 - 2016-09-07 00:32 - 00581632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apphelp.dll
    2016-09-13 15:18 - 2016-09-07 00:31 - 00794624 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
    2016-09-13 15:18 - 2016-09-07 00:31 - 00610304 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmdrmsdk.dll
    2016-09-13 15:18 - 2016-09-07 00:31 - 00335872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
    2016-09-13 15:18 - 2016-09-07 00:30 - 18676224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
    2016-09-13 15:18 - 2016-09-07 00:30 - 02127360 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
    2016-09-13 15:18 - 2016-09-07 00:30 - 01707520 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
    2016-09-13 15:18 - 2016-09-07 00:30 - 00904704 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
    2016-09-13 15:18 - 2016-09-07 00:30 - 00784384 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
    2016-09-13 15:18 - 2016-09-07 00:30 - 00602624 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
    2016-09-13 15:18 - 2016-09-07 00:29 - 19350016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
    2016-09-13 15:18 - 2016-09-07 00:28 - 00938496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
    2016-09-13 15:18 - 2016-09-07 00:27 - 01743872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
    2016-09-13 15:18 - 2016-09-07 00:27 - 00963072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
    2016-09-13 15:18 - 2016-09-07 00:27 - 00552960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll
    2016-09-13 15:18 - 2016-09-07 00:26 - 13392384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
    2016-09-13 15:18 - 2016-09-07 00:26 - 02050048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
    2016-09-13 15:18 - 2016-09-07 00:26 - 01508352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmsipc.dll
    2016-09-13 15:18 - 2016-09-07 00:26 - 00687616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
    2016-09-13 15:18 - 2016-09-07 00:25 - 01526272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
    2016-09-13 15:18 - 2016-09-07 00:25 - 01166848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Pimstore.dll
    2016-09-13 15:18 - 2016-09-07 00:25 - 00769536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll
    2016-09-13 15:18 - 2016-09-07 00:24 - 03428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
    2016-09-13 15:18 - 2016-09-07 00:23 - 00980480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winipcsecproc.dll
    2016-09-13 15:18 - 2016-09-07 00:23 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
    2016-09-13 15:18 - 2016-09-07 00:22 - 12134400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
    2016-09-13 15:18 - 2016-09-07 00:21 - 03046400 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll
    2016-09-13 15:18 - 2016-09-07 00:21 - 01797120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
    2016-09-13 15:18 - 2016-09-07 00:20 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
    2016-09-13 15:18 - 2016-09-07 00:19 - 03663360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
    2016-09-13 15:18 - 2016-09-07 00:19 - 02102272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsservices.dll
    2016-09-13 15:18 - 2016-09-07 00:18 - 03577344 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
    2016-09-13 15:18 - 2016-09-07 00:18 - 02876928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wpc.dll
    2016-09-13 15:18 - 2016-09-07 00:17 - 02285568 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebSync.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 04412928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 03671040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 02911744 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 02746368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 02597888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 02280960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 02217984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wpc.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 01676800 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 01194496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 01123328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
    2016-09-13 15:18 - 2016-09-07 00:15 - 07831552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
    2016-09-13 15:18 - 2016-09-07 00:15 - 05659136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
    2016-09-13 15:18 - 2016-09-07 00:15 - 02604032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
    2016-09-13 15:18 - 2016-09-07 00:15 - 02055168 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
    2016-09-13 15:18 - 2016-09-07 00:15 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hnetcfg.dll
    2016-09-13 15:18 - 2016-09-07 00:14 - 06743040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
    2016-09-13 15:18 - 2016-09-07 00:14 - 04895232 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
    2016-09-13 15:18 - 2016-09-07 00:14 - 01946112 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
    2016-09-13 15:18 - 2016-09-07 00:13 - 04171264 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
    2016-09-13 15:18 - 2016-09-07 00:13 - 02874880 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmcndmgr.dll
    2016-09-13 15:18 - 2016-09-07 00:11 - 03065344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
    2016-09-13 15:17 - 2016-09-07 01:39 - 00845568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
    2016-09-13 15:17 - 2016-09-07 01:39 - 00754664 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
    2016-09-13 15:17 - 2016-09-07 01:39 - 00620176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
    2016-09-13 15:17 - 2016-09-07 01:39 - 00277848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
    2016-09-13 15:17 - 2016-09-07 01:37 - 00572272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\taskschd.dll
    2016-09-13 15:17 - 2016-09-07 01:34 - 02587696 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
    2016-09-13 15:17 - 2016-09-07 01:33 - 01297760 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
    2016-09-13 15:17 - 2016-09-07 01:33 - 00986976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
    2016-09-13 15:17 - 2016-09-07 01:33 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
    2016-09-13 15:17 - 2016-09-07 01:27 - 00538632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
    2016-09-13 15:17 - 2016-09-07 01:27 - 00413536 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
    2016-09-13 15:17 - 2016-09-07 01:26 - 01092464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
    2016-09-13 15:17 - 2016-09-07 01:26 - 00858952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
    2016-09-13 15:17 - 2016-09-07 01:26 - 00847648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
    2016-09-13 15:17 - 2016-09-07 01:26 - 00785088 _____ (Microsoft Corporation) C:\WINDOWS\system32\evr.dll
    2016-09-13 15:17 - 2016-09-07 01:26 - 00586200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
    2016-09-13 15:17 - 2016-09-07 01:26 - 00245840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
    2016-09-13 15:17 - 2016-09-07 01:25 - 01447776 _____ (Microsoft Corporation) C:\WINDOWS\system32\webservices.dll
    2016-09-13 15:17 - 2016-09-07 01:25 - 01322248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
    2016-09-13 15:17 - 2016-09-07 01:25 - 01270064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 03693064 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 01349632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 00808288 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
    2016-09-13 15:17 - 2016-09-07 01:24 - 00511312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 00501600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 00496360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmdrmdev.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 00355672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll
    2016-09-13 15:17 - 2016-09-07 01:23 - 22561256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
    2016-09-13 15:17 - 2016-09-07 01:23 - 06605544 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
    2016-09-13 15:17 - 2016-09-07 01:23 - 06536248 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
    2016-09-13 15:17 - 2016-09-07 01:23 - 01603224 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
    2016-09-13 15:17 - 2016-09-07 01:23 - 01040792 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
    2016-09-13 15:17 - 2016-09-07 01:23 - 00725776 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
    2016-09-13 15:17 - 2016-09-07 01:22 - 02937384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
    2016-09-13 15:17 - 2016-09-07 01:22 - 01128096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
    2016-09-13 15:17 - 2016-09-07 01:22 - 01085728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webservices.dll
    2016-09-13 15:17 - 2016-09-07 01:22 - 00604920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
    2016-09-13 15:17 - 2016-09-07 01:20 - 00569744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
    2016-09-13 15:17 - 2016-09-07 01:15 - 00911640 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
    2016-09-13 15:17 - 2016-09-07 01:12 - 02195632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
    2016-09-13 15:17 - 2016-09-07 01:12 - 01174008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
    2016-09-13 15:17 - 2016-09-07 01:08 - 00116216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
    2016-09-13 15:17 - 2016-09-07 00:52 - 01035776 _____ (Microsoft Corporation) C:\WINDOWS\system32\XboxNetApiSvc.dll
    2016-09-13 15:17 - 2016-09-07 00:52 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
    2016-09-13 15:17 - 2016-09-07 00:49 - 00649216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
    2016-09-13 15:17 - 2016-09-07 00:48 - 00957952 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
    2016-09-13 15:17 - 2016-09-07 00:47 - 00824320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
    2016-09-13 15:17 - 2016-09-07 00:46 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
    2016-09-13 15:17 - 2016-09-07 00:46 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
    2016-09-13 15:17 - 2016-09-07 00:44 - 00134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
    2016-09-13 15:17 - 2016-09-07 00:44 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\pngfilt.dll
    2016-09-13 15:17 - 2016-09-07 00:42 - 00572928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
    2016-09-13 15:17 - 2016-09-07 00:42 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosHostClient.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\system32\DictationManager.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\shsetup.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\OnDemandConnRouteHelper.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00056832 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwcfg.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceassociation.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll
    2016-09-13 15:17 - 2016-09-07 00:40 - 00361472 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdechangepin.exe
    2016-09-13 15:17 - 2016-09-07 00:40 - 00027648 _____ (Microsoft Corporation) C:\WINDOWS\system32\CheckNetIsolation.exe
    2016-09-13 15:17 - 2016-09-07 00:39 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiarpc.dll
    2016-09-13 15:17 - 2016-09-07 00:39 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\udhisapi.dll
    2016-09-13 15:17 - 2016-09-07 00:38 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
    2016-09-13 15:17 - 2016-09-07 00:38 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\LegacyNetUXHost.exe
    2016-09-13 15:17 - 2016-09-07 00:38 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosStorage.dll
    2016-09-13 15:17 - 2016-09-07 00:38 - 00038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsmprovhost.exe
    2016-09-13 15:17 - 2016-09-07 00:38 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\upnpcont.exe
    2016-09-13 15:17 - 2016-09-07 00:37 - 00617984 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00435712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.AllJoyn.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepsync.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAuto.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapsBtSvc.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceassociation.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAgent.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 01568768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdt.exe
    2016-09-13 15:17 - 2016-09-07 00:36 - 01051136 _____ (Microsoft Corporation) C:\WINDOWS\system32\DiagCpl.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00489984 _____ (Microsoft Corporation) C:\WINDOWS\system32\authfwcfg.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00457216 _____ (Microsoft Corporation) C:\WINDOWS\system32\azroleui.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00319488 _____ (Microsoft Corporation) C:\WINDOWS\system32\dot3ui.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepapi.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFPlatform.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shsetup.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00814592 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctfuimanager.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00704000 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00591872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmsRouterSvc.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00577536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Wallet.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00394240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00393216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wbemcomn.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00256512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unimdm.tsp
    2016-09-13 15:17 - 2016-09-07 00:35 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExecModelClient.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModelShim.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.ps.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vsstrace.dll
    2016-09-13 15:17 - 2016-09-07 00:34 - 00952320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.PointOfService.dll
    2016-09-13 15:17 - 2016-09-07 00:34 - 00727040 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
    2016-09-13 15:17 - 2016-09-07 00:34 - 00387072 _____ (Microsoft Corporation) C:\WINDOWS\system32\qdvd.dll
    2016-09-13 15:17 - 2016-09-07 00:34 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDEServer.exe
     
    Joe L,
    #5
  7. 2016/09/18
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-09-2016
    Ran by JLL-NEW THINKPAD (administrator) on JLL-NEWTHINKPAD (18-09-2016 23:37:40)
    Running from C:\Users\JLL-NEW THINKPAD\Downloads
    Loaded Profiles: JLL-NEW THINKPAD (Available Profiles: JLL-NEW THINKPAD & LogMeInRemoteUser)
    Platform: Windows 10 Pro Version 1511 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe
    (IObit) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe
    (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
    (Lenovo.) C:\Windows\System32\ibmpmsvc.exe
    (Intel Corporation) C:\Windows\System32\igfxCUIService.exe
    (Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
    (Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
    (HP) C:\Windows\System32\HPSIsvc.exe
    (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
    () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
    (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
    (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
    (Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
    (Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
    (Microsoft Corporation) C:\Windows\System32\mqsvc.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
    (SuperBoost Software) C:\Program Files (x86)\SuperBoost\SuperBoost Software Updater\SuperBoostUpdater.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
    (Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\mkrmsg.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
    (Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    (Intel Corporation) C:\Windows\System32\igfxEM.exe
    (Intel Corporation) C:\Windows\System32\igfxHK.exe
    (Intel Corporation) C:\Windows\System32\igfxTray.exe
    () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
    (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
    (Lenovo.) C:\Windows\System32\TpShocks.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
    (Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe
    (Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (SuperBoost Software) C:\Program Files (x86)\SuperBoost\Superb Game Boost\SuperbGameBoostMain.exe
    () C:\Program Files (x86)\Lenovo\System Update\SUService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe
    (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
    (Symantec Corporation) C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
    () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
    (Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe
    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Farbar) C:\Users\JLL-NEW THINKPAD\Downloads\FRST64 (1).exe


    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
    HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [935104 2014-11-25] (Conexant Systems, Inc.)
    HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
    HKLM\...\Run: [TpShocks] => C:\WINDOWS\system32\TpShocks.exe [384344 2014-02-17] (Lenovo.)
    HKLM\...\Run: [ResetACGauge] => C:\Program Files (x86)\Lenovo\Access Connections\smbhlpr.exe [153840 2015-06-08] (Lenovo)
    HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63728 2015-06-08] (Lenovo)
    HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-03-06] (Intel Corporation)
    HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-04-13] (Intel Corporation)
    HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [1091376 2012-01-17] (Lenovo)
    HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
    HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe /boot
    HKLM-x32\...\Run: [IntelSBA] => C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe [4277000 2012-11-08] (Intel Corporation)
    HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [44128 2013-05-08] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [HPUsageTrackingLEDM] => c:\program files (x86)\hp\hp ut ledm\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)
    HKLM-x32\...\Run: [ControlCenter3] => c:\program files (x86)\brother\controlcenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
    HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508656 2012-08-31] (Dolby Laboratories Inc.)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
    HKLM-x32\...\Run: [IObit Malware Fighter] => C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe [5976864 2016-06-28] (IObit)
    Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [Google Update] => C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-28] (Google Inc.)
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [Dropbox Update] => C:\Users\JLL-NEW THINKPAD\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-26] (Dropbox, Inc.)
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [Advanced SystemCare 9] => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe [2022688 2016-04-26] (IObit)
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8912088 2016-08-26] (Piriform Ltd)
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\amd64 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509 "
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\MountPoints2: {71f7110c-89f4-11e4-a15c-b888e339af76} - "F:\SISetup.exe"
    AppInit_DLLs: acaptuser64.dll => C:\WINDOWS\system32\acaptuser64.dll [119160 2008-06-11] (Adobe Systems, Inc.)
    Lsa: [Notification Packages] scecli ACGina
    ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
    ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
    ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
    ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
    ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt.43.dll [2016-09-12] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt.43.dll [2016-09-12] (Dropbox, Inc.)
    Startup: C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-11-09]
    ShortcutTarget: Dropbox.lnk -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    BootExecute: RegistryDefragBootTime.exeautocheck autochk *

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.5.1 192.168.5.1 192.168.1.1
    Tcpip\..\Interfaces\{72821754-f317-425a-a783-9b1ec9ac53ce}: [DhcpNameServer] 192.168.5.1 192.168.5.1 192.168.1.1

    Internet Explorer:
    ==================
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://www.google.com/
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
    HKU\S-1-5-21-601027151-1453584952-853886390-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
    SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-601027151-1453584952-853886390-1000 -> {70D46D94-BF1E-45ED-B567-48701376298E} URL = hxxp://127.0.0.1:4664/search&s=dxjF8fmw03vvLuTUsjqpb6JRI-s?q={searchTerms}
    BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2015-11-12] (IObit)
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_65\bin\ssv.dll [2015-10-30] (Oracle Corporation)
    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
    BHO: Symantec VIP Access Add-On -> {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} -> C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll [2012-04-19] (Symantec Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-10-30] (Oracle Corporation)
    BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
    BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)
    BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    BHO-x32: Symantec VIP Access Add-On -> {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} -> C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll [2012-04-19] (Symantec Corporation)
    BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
    Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)
    Toolbar: HKU\S-1-5-21-601027151-1453584952-853886390-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
    Toolbar: HKU\S-1-5-21-601027151-1453584952-853886390-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
    DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab

    FireFox:
    ========
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_23_0_0_162.dll [2016-09-13] ()
    FF Plugin: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-10-30] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-10-30] (Oracle Corporation)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50709.0\npctrl.dll [2016-07-11] ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_162.dll [2016-09-13] ()
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50709.0\npctrl.dll [2016-07-11] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro PDF\Professional 7\npnitromozilla.dll [2012-05-24] ( )
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
    FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @citrixonline.com/appdetectorplugin -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2016-04-26] (Citrix Online)
    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @talk.google.com/O1DPlugin -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @tools.google.com/Google Update;version=3 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @tools.google.com/Google Update;version=9 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Users\JLL-NEW THINKPAD\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
    FF Plugin ProgramFiles/Appdata: C:\Users\JLL-NEW THINKPAD\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)
    FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
    FF Extension: (SmartPrintButton) - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011-01-26] [not signed]
    FF HKLM-x32\...\Firefox\Extensions: [VIP5X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access Client
    FF Extension: (Symantec VIP Access Add-On) - C:\Program Files (x86)\Symantec\VIP Access Client [2013-03-21] [not signed]

    Chrome:
    =======
    CHR Plugin: (Widevine Content Decryption Module) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.823\_platform_specific\win_x86\widevinecdmadapter.dll => No File
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\53.0.2785.116\PepperFlash\pepflashplayer.dll ()
    CHR Profile: C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default [2016-09-18]
    CHR Extension: (Google Drive) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-11]
    CHR Extension: (Google Search) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
    CHR Extension: (Full Screen Weather) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkkaebihfmbofclegkcfkkemepfehibg [2015-05-12]
    CHR Extension: (Google Docs Offline) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-11]
    CHR Extension: (AdBlock) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-09-17]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-01]
    CHR Extension: (Gmail) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
    CHR Extension: (Chrome Media Router) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-30]
     
    Joe L,
    #6
  8. 2016/09/18
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AdvancedSystemCareService9; C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe [446240 2016-01-05] (IObit)
    R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [169776 2012-01-17] (Lenovo)
    S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2012-10-01] (Macrovision Europe Ltd.) [File not signed]
    S3 GoogleDesktopManager-051210-111108; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2012-10-11] (Google)
    R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [330136 2015-10-30] (Intel Corporation)
    S3 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
    R2 IMFservice; C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [1597728 2016-06-13] (IObit)
    R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-03-06] ()
    R2 intelsba; C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [50440 2012-11-08] (Intel Corporation)
    R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [163608 2012-03-06] (Intel Corporation)
    R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [136288 2012-08-10] (Lenovo Group Limited)
    S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093944 2011-02-07] (Symantec Corporation)
    R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [419336 2016-09-15] (LogMeIn, Inc.)
    R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [509448 2016-09-15] (LogMeIn, Inc.)
    R3 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-06-08] (LogMeIn, Inc.)
    R2 NitroDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe [216072 2012-05-24] (Nitro PDF Software)
    R2 sgbupt; C:\Program Files (x86)\SuperBoost\SuperBoost Software Updater\SuperBoostUpdater.exe [2600256 2016-04-21] (SuperBoost Software)
    S3 ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [31176 2016-01-20] (SHAREit Technologies Co.Ltd)
    R3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [28544 2016-07-07] ()
    R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [255608 2016-04-21] (Synaptics Incorporated)
    R2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84080 2012-04-19] (Symantec Corporation)
    S3 vmicvss; C:\Windows\System32\ICSvc.dll [511488 2016-09-07] (Microsoft Corporation)
    R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364456 2016-09-07] (Microsoft Corporation)
    R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-09-07] (Microsoft Corporation)

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R1 adgnetworkwfpdrv; C:\Windows\System32\drivers\adgnetworkwfpdrv.sys [55800 2015-06-02] ()
    S3 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70416 2012-01-17] (Windows (R) Win 7 DDK provider)
    R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-05-23] (REALiX(tm))
    S3 IMFFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\IMFFilter.sys [22208 2016-04-01] (IObit)
    R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-06-04] (LogMeIn, Inc.)
    S4 LMIRfsClientNP; no ImagePath
    R3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)
    S3 RegFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [34848 2016-01-11] (IObit.com)
    R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [328920 2016-04-14] (Realtek Semiconductor Corp.)
    R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [936192 2016-06-15] (Realtek )
    R3 rtwlane_13; C:\Windows\System32\drivers\rtwlane_13.sys [3749888 2015-10-30] (Realtek Semiconductor Corporation )
    R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [51320 2016-04-21] (Synaptics Incorporated)
    S3 Trufos; C:\Windows\System32\DRIVERS\TRUFOS.sys [452040 2016-03-31] (BitDefender S.R.L.)
    R3 Tvti2c; C:\Windows\system32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)
    S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
    R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
    R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
    R1 WiseUnlock; C:\WINDOWS\WiseUnlock64.sys [12240 2015-05-19] (WiseCleaner.com)
    U3 idsvc; no ImagePath

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2016-09-18 23:10 - 2016-09-18 23:11 - 00063723 _____ C:\Users\JLL-NEW THINKPAD\Downloads\Addition.txt
    2016-09-18 23:09 - 2016-09-18 23:37 - 00030840 _____ C:\Users\JLL-NEW THINKPAD\Downloads\FRST.txt
    2016-09-18 23:09 - 2016-09-18 23:37 - 00000000 ____D C:\FRST
    2016-09-18 23:09 - 2016-09-18 23:09 - 02400256 _____ (Farbar) C:\Users\JLL-NEW THINKPAD\Downloads\FRST64 (1).exe
    2016-09-18 23:07 - 2016-09-18 23:07 - 02400256 _____ (Farbar) C:\Users\JLL-NEW THINKPAD\Downloads\FRST64.exe
    2016-09-18 22:58 - 2016-09-18 22:58 - 01089816 _____ (Emsisoft Ltd) C:\Users\JLL-NEW THINKPAD\Downloads\decrypt_nemucod.exe
    2016-09-18 22:12 - 2016-09-18 22:12 - 00000114 _____ C:\WINDOWS\ntbtlog.txt
    2016-09-18 21:30 - 2016-09-18 21:30 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Roaming\ProductData
    2016-09-18 21:02 - 2016-09-18 21:02 - 00003220 _____ C:\WINDOWS\System32\Tasks\BDAntiCryptoWallTask
    2016-09-18 20:42 - 2016-09-18 20:47 - 00000000 ____D C:\ProgramData\ProductData
    2016-09-18 19:43 - 2016-09-18 19:43 - 00048206 _____ C:\Users\JLL-NEW THINKPAD\Documents\cc_20160918_194334.reg
    2016-09-18 18:25 - 2016-09-18 18:25 - 00002892 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
    2016-09-18 18:24 - 2016-09-18 18:24 - 00000876 _____ C:\Users\Public\Desktop\CCleaner.lnk
    2016-09-18 18:24 - 2016-09-18 18:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
    2016-09-18 18:24 - 2016-09-18 18:24 - 00000000 ____D C:\Program Files\CCleaner
    2016-09-18 18:23 - 2016-09-18 18:24 - 08244656 _____ (Piriform Ltd) C:\Users\JLL-NEW THINKPAD\Desktop\ccsetup522.exe
    2016-09-18 16:08 - 2016-09-18 19:44 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\CrashDumps
    2016-09-18 14:13 - 2016-09-18 19:50 - 00000000 ____D C:\Program Files\Plumbytes Software
    2016-09-18 01:05 - 2016-09-18 01:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BDAntiRansomware
    2016-09-18 01:05 - 2016-09-18 01:05 - 00000000 ____D C:\Program Files\Bitdefender
    2016-09-18 01:04 - 2016-09-18 01:05 - 04703248 _____ (Bitdefender ) C:\Users\JLL-NEW THINKPAD\Desktop\BDAntiRansomwareSetup.exe
    2016-09-18 00:49 - 2016-09-18 00:49 - 01089816 _____ (Emsisoft Ltd) C:\Users\JLL-NEW THINKPAD\Desktop\decrypt_nemucod (1).exe
    2016-09-18 00:47 - 2016-09-18 00:47 - 01089816 _____ (Emsisoft Ltd) C:\Users\JLL-NEW THINKPAD\Desktop\decrypt_nemucod.exe
    2016-09-18 00:12 - 2016-09-18 20:50 - 00000000 ____D C:\NPE
    2016-09-17 23:56 - 2016-09-18 22:18 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\NPE
    2016-09-17 23:55 - 2016-09-17 23:56 - 03423928 _____ (Symantec Corporation) C:\Users\JLL-NEW THINKPAD\Desktop\NPE.exe
    2016-09-17 18:52 - 2016-09-17 18:52 - 00001362 _____ C:\Users\JLL-NEW THINKPAD\Desktop\a.txt
    2016-09-17 18:15 - 2016-09-18 20:18 - 00000712 _____ C:\Users\JLL-NEW THINKPAD\Desktop\JRT.txt
    2016-09-17 18:12 - 2016-09-17 18:12 - 01610560 _____ (Malwarebytes) C:\Users\JLL-NEW THINKPAD\Desktop\JRT.exe
    2016-09-17 17:38 - 2016-09-17 17:38 - 03861056 _____ C:\Users\JLL-NEW THINKPAD\Desktop\adwcleaner_6.020.exe
    2016-09-17 16:58 - 2016-09-17 22:18 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\YdPack
    2016-09-17 15:51 - 2016-09-18 22:05 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\f28b4
    2016-09-17 15:51 - 2016-09-17 22:18 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\Insoft
    2016-09-17 15:51 - 2016-09-17 15:51 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Roaming\9373f
    2016-09-17 15:50 - 2016-09-17 15:50 - 00001362 _____ C:\Users\JLL-NEW THINKPAD\Desktop\DECRYPT.txt
    2016-09-16 20:21 - 2016-09-16 20:21 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
    2016-09-14 11:44 - 2016-09-15 11:44 - 00122400 _____ (LogMeIn, Inc.) C:\WINDOWS\system32\LMIRfsClientNP.dll
    2016-09-14 11:44 - 2012-06-08 12:06 - 00072216 _____ (LogMeIn, Inc.) C:\WINDOWS\system32\Drivers\LMIRfsDriver.sys
    2016-09-13 15:18 - 2016-09-07 01:39 - 02656952 _____ C:\WINDOWS\system32\CoreUIComponents.dll
    2016-09-13 15:18 - 2016-09-07 01:39 - 01098640 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
    2016-09-13 15:18 - 2016-09-07 01:26 - 02544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
    2016-09-13 15:18 - 2016-09-07 01:26 - 01299504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
    2016-09-13 15:18 - 2016-09-07 01:26 - 01152320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
    2016-09-13 15:18 - 2016-09-07 01:26 - 00588320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmdrmdev.dll
    2016-09-13 15:18 - 2016-09-07 01:25 - 02607336 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
    2016-09-13 15:18 - 2016-09-07 01:23 - 01750440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe
    2016-09-13 15:18 - 2016-09-07 01:19 - 00294752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
    2016-09-13 15:18 - 2016-09-07 00:48 - 22379520 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
    2016-09-13 15:18 - 2016-09-07 00:43 - 16985600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
    2016-09-13 15:18 - 2016-09-07 00:39 - 01567744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
    2016-09-13 15:18 - 2016-09-07 00:35 - 24611840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
    2016-09-13 15:18 - 2016-09-07 00:35 - 00383488 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
    2016-09-13 15:18 - 2016-09-07 00:32 - 00787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\cscui.dll
    2016-09-13 15:18 - 2016-09-07 00:32 - 00581632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apphelp.dll
    2016-09-13 15:18 - 2016-09-07 00:31 - 00794624 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
    2016-09-13 15:18 - 2016-09-07 00:31 - 00610304 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmdrmsdk.dll
    2016-09-13 15:18 - 2016-09-07 00:31 - 00335872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
    2016-09-13 15:18 - 2016-09-07 00:30 - 18676224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
    2016-09-13 15:18 - 2016-09-07 00:30 - 02127360 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
    2016-09-13 15:18 - 2016-09-07 00:30 - 01707520 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
    2016-09-13 15:18 - 2016-09-07 00:30 - 00904704 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
    2016-09-13 15:18 - 2016-09-07 00:30 - 00784384 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
    2016-09-13 15:18 - 2016-09-07 00:30 - 00602624 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
    2016-09-13 15:18 - 2016-09-07 00:29 - 19350016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
    2016-09-13 15:18 - 2016-09-07 00:28 - 00938496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
    2016-09-13 15:18 - 2016-09-07 00:27 - 01743872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
    2016-09-13 15:18 - 2016-09-07 00:27 - 00963072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
    2016-09-13 15:18 - 2016-09-07 00:27 - 00552960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll
    2016-09-13 15:18 - 2016-09-07 00:26 - 13392384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
    2016-09-13 15:18 - 2016-09-07 00:26 - 02050048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
    2016-09-13 15:18 - 2016-09-07 00:26 - 01508352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmsipc.dll
    2016-09-13 15:18 - 2016-09-07 00:26 - 00687616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
    2016-09-13 15:18 - 2016-09-07 00:25 - 01526272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
    2016-09-13 15:18 - 2016-09-07 00:25 - 01166848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Pimstore.dll
    2016-09-13 15:18 - 2016-09-07 00:25 - 00769536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll
    2016-09-13 15:18 - 2016-09-07 00:24 - 03428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
    2016-09-13 15:18 - 2016-09-07 00:23 - 00980480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winipcsecproc.dll
    2016-09-13 15:18 - 2016-09-07 00:23 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
    2016-09-13 15:18 - 2016-09-07 00:22 - 12134400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
    2016-09-13 15:18 - 2016-09-07 00:21 - 03046400 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll
    2016-09-13 15:18 - 2016-09-07 00:21 - 01797120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
    2016-09-13 15:18 - 2016-09-07 00:20 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
    2016-09-13 15:18 - 2016-09-07 00:19 - 03663360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
    2016-09-13 15:18 - 2016-09-07 00:19 - 02102272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsservices.dll
    2016-09-13 15:18 - 2016-09-07 00:18 - 03577344 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
    2016-09-13 15:18 - 2016-09-07 00:18 - 02876928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wpc.dll
    2016-09-13 15:18 - 2016-09-07 00:17 - 02285568 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebSync.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 04412928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 03671040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 02911744 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 02746368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 02597888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 02280960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 02217984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wpc.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 01676800 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 01194496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll
    2016-09-13 15:18 - 2016-09-07 00:16 - 01123328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
    2016-09-13 15:18 - 2016-09-07 00:15 - 07831552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
    2016-09-13 15:18 - 2016-09-07 00:15 - 05659136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
    2016-09-13 15:18 - 2016-09-07 00:15 - 02604032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
    2016-09-13 15:18 - 2016-09-07 00:15 - 02055168 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
    2016-09-13 15:18 - 2016-09-07 00:15 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hnetcfg.dll
    2016-09-13 15:18 - 2016-09-07 00:14 - 06743040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
    2016-09-13 15:18 - 2016-09-07 00:14 - 04895232 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
    2016-09-13 15:18 - 2016-09-07 00:14 - 01946112 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
    2016-09-13 15:18 - 2016-09-07 00:13 - 04171264 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
    2016-09-13 15:18 - 2016-09-07 00:13 - 02874880 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmcndmgr.dll
    2016-09-13 15:18 - 2016-09-07 00:11 - 03065344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
    2016-09-13 15:17 - 2016-09-07 01:39 - 00845568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
    2016-09-13 15:17 - 2016-09-07 01:39 - 00754664 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
    2016-09-13 15:17 - 2016-09-07 01:39 - 00620176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
    2016-09-13 15:17 - 2016-09-07 01:39 - 00277848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
    2016-09-13 15:17 - 2016-09-07 01:37 - 00572272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\taskschd.dll
    2016-09-13 15:17 - 2016-09-07 01:34 - 02587696 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
    2016-09-13 15:17 - 2016-09-07 01:33 - 01297760 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
    2016-09-13 15:17 - 2016-09-07 01:33 - 00986976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
    2016-09-13 15:17 - 2016-09-07 01:33 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
    2016-09-13 15:17 - 2016-09-07 01:27 - 00538632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
    2016-09-13 15:17 - 2016-09-07 01:27 - 00413536 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
    2016-09-13 15:17 - 2016-09-07 01:26 - 01092464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
    2016-09-13 15:17 - 2016-09-07 01:26 - 00858952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
    2016-09-13 15:17 - 2016-09-07 01:26 - 00847648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
    2016-09-13 15:17 - 2016-09-07 01:26 - 00785088 _____ (Microsoft Corporation) C:\WINDOWS\system32\evr.dll
    2016-09-13 15:17 - 2016-09-07 01:26 - 00586200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
    2016-09-13 15:17 - 2016-09-07 01:26 - 00245840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
    2016-09-13 15:17 - 2016-09-07 01:25 - 01447776 _____ (Microsoft Corporation) C:\WINDOWS\system32\webservices.dll
    2016-09-13 15:17 - 2016-09-07 01:25 - 01322248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
    2016-09-13 15:17 - 2016-09-07 01:25 - 01270064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 03693064 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 01349632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 00808288 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
    2016-09-13 15:17 - 2016-09-07 01:24 - 00511312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 00501600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 00496360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmdrmdev.dll
    2016-09-13 15:17 - 2016-09-07 01:24 - 00355672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll
    2016-09-13 15:17 - 2016-09-07 01:23 - 22561256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
    2016-09-13 15:17 - 2016-09-07 01:23 - 06605544 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
    2016-09-13 15:17 - 2016-09-07 01:23 - 06536248 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
    2016-09-13 15:17 - 2016-09-07 01:23 - 01603224 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
    2016-09-13 15:17 - 2016-09-07 01:23 - 01040792 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
    2016-09-13 15:17 - 2016-09-07 01:23 - 00725776 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
    2016-09-13 15:17 - 2016-09-07 01:22 - 02937384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
    2016-09-13 15:17 - 2016-09-07 01:22 - 01128096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
    2016-09-13 15:17 - 2016-09-07 01:22 - 01085728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webservices.dll
    2016-09-13 15:17 - 2016-09-07 01:22 - 00604920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
    2016-09-13 15:17 - 2016-09-07 01:20 - 00569744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
    2016-09-13 15:17 - 2016-09-07 01:15 - 00911640 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
    2016-09-13 15:17 - 2016-09-07 01:12 - 02195632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
    2016-09-13 15:17 - 2016-09-07 01:12 - 01174008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
    2016-09-13 15:17 - 2016-09-07 01:08 - 00116216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
    2016-09-13 15:17 - 2016-09-07 00:52 - 01035776 _____ (Microsoft Corporation) C:\WINDOWS\system32\XboxNetApiSvc.dll
    2016-09-13 15:17 - 2016-09-07 00:52 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
    2016-09-13 15:17 - 2016-09-07 00:49 - 00649216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
    2016-09-13 15:17 - 2016-09-07 00:48 - 00957952 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
    2016-09-13 15:17 - 2016-09-07 00:47 - 00824320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
    2016-09-13 15:17 - 2016-09-07 00:46 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
    2016-09-13 15:17 - 2016-09-07 00:46 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
    2016-09-13 15:17 - 2016-09-07 00:44 - 00134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
    2016-09-13 15:17 - 2016-09-07 00:44 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\pngfilt.dll
    2016-09-13 15:17 - 2016-09-07 00:42 - 00572928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
    2016-09-13 15:17 - 2016-09-07 00:42 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosHostClient.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\system32\DictationManager.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\shsetup.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\OnDemandConnRouteHelper.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00056832 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwcfg.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceassociation.dll
    2016-09-13 15:17 - 2016-09-07 00:41 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll
    2016-09-13 15:17 - 2016-09-07 00:40 - 00361472 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdechangepin.exe
    2016-09-13 15:17 - 2016-09-07 00:40 - 00027648 _____ (Microsoft Corporation) C:\WINDOWS\system32\CheckNetIsolation.exe
    2016-09-13 15:17 - 2016-09-07 00:39 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiarpc.dll
    2016-09-13 15:17 - 2016-09-07 00:39 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\udhisapi.dll
    2016-09-13 15:17 - 2016-09-07 00:38 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
    2016-09-13 15:17 - 2016-09-07 00:38 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\LegacyNetUXHost.exe
    2016-09-13 15:17 - 2016-09-07 00:38 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosStorage.dll
    2016-09-13 15:17 - 2016-09-07 00:38 - 00038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsmprovhost.exe
    2016-09-13 15:17 - 2016-09-07 00:38 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\upnpcont.exe
    2016-09-13 15:17 - 2016-09-07 00:37 - 00617984 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00435712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.AllJoyn.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepsync.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAuto.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapsBtSvc.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceassociation.dll
    2016-09-13 15:17 - 2016-09-07 00:37 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAgent.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 01568768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdt.exe
    2016-09-13 15:17 - 2016-09-07 00:36 - 01051136 _____ (Microsoft Corporation) C:\WINDOWS\system32\DiagCpl.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00489984 _____ (Microsoft Corporation) C:\WINDOWS\system32\authfwcfg.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00457216 _____ (Microsoft Corporation) C:\WINDOWS\system32\azroleui.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00319488 _____ (Microsoft Corporation) C:\WINDOWS\system32\dot3ui.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepapi.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFPlatform.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
    2016-09-13 15:17 - 2016-09-07 00:36 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shsetup.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00814592 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctfuimanager.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00704000 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00591872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmsRouterSvc.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00577536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Wallet.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00394240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00393216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wbemcomn.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00256512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unimdm.tsp
    2016-09-13 15:17 - 2016-09-07 00:35 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExecModelClient.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModelShim.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.ps.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
    2016-09-13 15:17 - 2016-09-07 00:35 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vsstrace.dll
    2016-09-13 15:17 - 2016-09-07 00:34 - 00952320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.PointOfService.dll
    2016-09-13 15:17 - 2016-09-07 00:34 - 00727040 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
    2016-09-13 15:17 - 2016-09-07 00:34 - 00387072 _____ (Microsoft Corporation) C:\WINDOWS\system32\qdvd.dll
    2016-09-13 15:17 - 2016-09-07 00:34 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDEServer.exe
    2016-09-13 15:17 - 2016-09-07 00:34 - 00344064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Picker.dll
    2016-09-13 15:17 - 2016-09-07 00:34 - 00305152 _____ (Microsoft Corporation) C:\WINDOWS\system32\edputil.dll
    2016-09-13 15:17 - 2016-09-07 00:33 - 00847360 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
    2016-09-13 15:17 - 2016-09-07 00:33 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.UX.EapRequestHandler.dll
    2016-09-13 15:17 - 2016-09-07 00:33 - 00330240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
    2016-09-13 15:17 - 2016-09-07 00:33 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll
    2016-09-13 15:17 - 2016-09-07 00:33 - 00290304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WmpDui.dll
    2016-09-13 15:17 - 2016-09-07 00:33 - 00238080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmWmiPl.dll
    2016-09-13 15:17 - 2016-09-07 00:32 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebcamUi.dll
    2016-09-13 15:17 - 2016-09-07 00:32 - 00947200 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasgcw.dll
    2016-09-13 15:17 - 2016-09-07 00:32 - 00738816 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmartCardSimulator.dll
    2016-09-13 15:17 - 2016-09-07 00:32 - 00643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiaservc.dll
    2016-09-13 15:17 - 2016-09-07 00:32 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
    2016-09-13 15:17 - 2016-09-07 00:32 - 00466944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
    2016-09-13 15:17 - 2016-09-07 00:32 - 00444928 _____ (Microsoft Corporation) C:\WINDOWS\system32\das.dll
    2016-09-13 15:17 - 2016-09-07 00:32 - 00432640 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
    2016-09-13 15:17 - 2016-09-07 00:32 - 00407040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
    2016-09-13 15:17 - 2016-09-07 00:32 - 00356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll
    2016-09-13 15:17 - 2016-09-07 00:32 - 00334848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
    2016-09-13 15:17 - 2016-09-07 00:32 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\facecredentialprovider.dll
    2016-09-13 15:17 - 2016-09-07 00:31 - 01216512 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcenter.dll
    2016-09-13 15:17 - 2016-09-07 00:31 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
    2016-09-13 15:17 - 2016-09-07 00:31 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.AccountsControl.dll
    2016-09-13 15:17 - 2016-09-07 00:31 - 00821760 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmIndexer.dll
    2016-09-13 15:17 - 2016-09-07 00:31 - 00753664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctfuimanager.dll
    2016-09-13 15:17 - 2016-09-07 00:31 - 00578560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mscms.dll
    2016-09-13 15:17 - 2016-09-07 00:31 - 00541184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GamePanel.exe
    2016-09-13 15:17 - 2016-09-07 00:31 - 00538112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.Desktop.dll
    2016-09-13 15:17 - 2016-09-07 00:31 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll
    2016-09-13 15:17 - 2016-09-07 00:31 - 00435200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll
    2016-09-13 15:17 - 2016-09-07 00:31 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
    2016-09-13 15:17 - 2016-09-07 00:31 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
    2016-09-13 15:17 - 2016-09-07 00:31 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinelsa.dll
    2016-09-13 15:17 - 2016-09-07 00:30 - 02476032 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSAJApi.dll
    2016-09-13 15:17 - 2016-09-07 00:30 - 01001472 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
    2016-09-13 15:17 - 2016-09-07 00:30 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
    2016-09-13 15:17 - 2016-09-07 00:30 - 00698368 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
    2016-09-13 15:17 - 2016-09-07 00:30 - 00436224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mprdim.dll
    2016-09-13 15:17 - 2016-09-07 00:30 - 00349696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
    b
     
    Joe L,
    #7
  9. 2016/09/18
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    The FRST results are in a new thread
     
    Joe L,
    #8
  10. 2016/09/18
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-09-2016

    Ran by JLL-NEW THINKPAD (administrator) on JLL-NEWTHINKPAD (18-09-2016 23:37:40)

    Running from C:\Users\JLL-NEW THINKPAD\Downloads

    Loaded Profiles: JLL-NEW THINKPAD (Available Profiles: JLL-NEW THINKPAD & LogMeInRemoteUser)

    Platform: Windows 10 Pro Version 1511 (X64) Language: English (United States)

    Internet Explorer Version 11 (Default browser: Chrome)

    Boot Mode: Normal

    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials


    ==================== Processes (Whitelisted) =================


    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)


    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe

    (IObit) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe

    (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe

    (Lenovo.) C:\Windows\System32\ibmpmsvc.exe

    (Intel Corporation) C:\Windows\System32\igfxCUIService.exe

    (Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe

    (Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe

    (HP) C:\Windows\System32\HPSIsvc.exe

    (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

    () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

    (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe

    (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe

    (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe

    (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe

    (Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe

    (Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe

    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe

    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe

    (Microsoft Corporation) C:\Windows\System32\mqsvc.exe

    (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe

    (SuperBoost Software) C:\Program Files (x86)\SuperBoost\SuperBoost Software Updater\SuperBoostUpdater.exe

    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe

    (Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe

    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe

    (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

    (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe

    (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe

    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe

    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\mkrmsg.exe

    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe

    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe

    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe

    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

    (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe

    (Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe

    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

    (Intel Corporation) C:\Windows\System32\igfxEM.exe

    (Intel Corporation) C:\Windows\System32\igfxHK.exe

    (Intel Corporation) C:\Windows\System32\igfxTray.exe

    () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe

    (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe

    (Lenovo.) C:\Windows\System32\TpShocks.exe

    (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

    (Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe

    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

    (Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe

    (Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe

    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

    (SuperBoost Software) C:\Program Files (x86)\SuperBoost\Superb Game Boost\SuperbGameBoostMain.exe

    () C:\Program Files (x86)\Lenovo\System Update\SUService.exe

    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

    (Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe

    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe

    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe

    (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

    (Symantec Corporation) C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe

    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe

    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

    (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

    () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe

    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

    (Microsoft Corporation) C:\Windows\System32\Taskmgr.exe

    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe

    (IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe

    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    (Farbar) C:\Users\JLL-NEW THINKPAD\Downloads\FRST64 (1).exe



    ==================== Registry (Whitelisted) ===========================


    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)


    HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()

    HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [935104 2014-11-25] (Conexant Systems, Inc.)

    HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)

    HKLM\...\Run: [TpShocks] => C:\WINDOWS\system32\TpShocks.exe [384344 2014-02-17] (Lenovo.)

    HKLM\...\Run: [ResetACGauge] => C:\Program Files (x86)\Lenovo\Access Connections\smbhlpr.exe [153840 2015-06-08] (Lenovo)

    HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63728 2015-06-08] (Lenovo)

    HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-03-06] (Intel Corporation)

    HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-04-13] (Intel Corporation)

    HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [1091376 2012-01-17] (Lenovo)

    HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)

    HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe /boot

    HKLM-x32\...\Run: [IntelSBA] => C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe [4277000 2012-11-08] (Intel Corporation)

    HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [44128 2013-05-08] (Adobe Systems Incorporated)

    HKLM-x32\...\Run: [HPUsageTrackingLEDM] => c:\program files (x86)\hp\hp ut ledm\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)

    HKLM-x32\...\Run: [ControlCenter3] => c:\program files (x86)\brother\controlcenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)

    HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508656 2012-08-31] (Dolby Laboratories Inc.)

    HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "

    HKLM-x32\...\Run: [IObit Malware Fighter] => C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe [5976864 2016-06-28] (IObit)

    Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [Google Update] => C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-28] (Google Inc.)

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [Dropbox Update] => C:\Users\JLL-NEW THINKPAD\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-26] (Dropbox, Inc.)

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [Advanced SystemCare 9] => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe [2022688 2016-04-26] (IObit)

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8912088 2016-08-26] (Piriform Ltd)

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64 "

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1 "

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64 "

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6301.0127 "

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\amd64 "

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6302.0225 "

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64 "

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6386.0412 "

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64 "

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\RunOnce: [Uninstall C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6390.0509 "

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\MountPoints2: {71f7110c-89f4-11e4-a15c-b888e339af76} - "F:\SISetup.exe "

    AppInit_DLLs: acaptuser64.dll => C:\WINDOWS\system32\acaptuser64.dll [119160 2008-06-11] (Adobe Systems, Inc.)

    Lsa: [Notification Packages] scecli ACGina

    ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)

    ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)

    ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)

    ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll [2016-09-12] (Dropbox, Inc.)

    ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)

    ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)

    ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)

    ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)

    ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt.43.dll [2016-09-12] (Dropbox, Inc.)

    ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt.43.dll [2016-09-12] (Dropbox, Inc.)

    ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt.43.dll [2016-09-12] (Dropbox, Inc.)

    Startup: C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-11-09]

    ShortcutTarget: Dropbox.lnk -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

    BootExecute: RegistryDefragBootTime.exeautocheck autochk *


    ==================== Internet (Whitelisted) ====================


    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)


    Tcpip\Parameters: [DhcpNameServer] 192.168.5.1 192.168.5.1 192.168.1.1

    Tcpip\..\Interfaces\{72821754-f317-425a-a783-9b1ec9ac53ce}: [DhcpNameServer] 192.168.5.1 192.168.5.1 192.168.1.1


    Internet Explorer:

    ==================

    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://www.google.com/

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP

    HKU\S-1-5-21-601027151-1453584952-853886390-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad

    SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

    SearchScopes: HKU\S-1-5-21-601027151-1453584952-853886390-1000 -> {70D46D94-BF1E-45ED-B567-48701376298E} URL = hxxp://127.0.0.1:4664/search&s=dxjF8fmw03vvLuTUsjqpb6JRI-s?q={searchTerms}

    BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2015-11-12] (IObit)

    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_65\bin\ssv.dll [2015-10-30] (Oracle Corporation)

    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)

    BHO: Symantec VIP Access Add-On -> {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} -> C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll [2012-04-19] (Symantec Corporation)

    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-10-30] (Oracle Corporation)

    BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)

    BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)

    BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)

    BHO-x32: Symantec VIP Access Add-On -> {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} -> C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll [2012-04-19] (Symantec Corporation)

    BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)

    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)

    Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)

    Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)

    Toolbar: HKU\S-1-5-21-601027151-1453584952-853886390-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)

    Toolbar: HKU\S-1-5-21-601027151-1453584952-853886390-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

    DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab


    FireFox:

    ========

    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_23_0_0_162.dll [2016-09-13] ()

    FF Plugin: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-10-30] (Oracle Corporation)

    FF Plugin: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-10-30] (Oracle Corporation)

    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50709.0\npctrl.dll [2016-07-11] ( Microsoft Corporation)

    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_162.dll [2016-09-13] ()

    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.)

    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)

    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)

    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50709.0\npctrl.dll [2016-07-11] ( Microsoft Corporation)

    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)

    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)

    FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro PDF\Professional 7\npnitromozilla.dll [2012-05-24] ( )

    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)

    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)

    FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)

    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)

    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @citrixonline.com/appdetectorplugin -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2016-04-26] (Citrix Online)

    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)

    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @talk.google.com/O1DPlugin -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)

    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @tools.google.com/Google Update;version=3 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)

    FF Plugin HKU\S-1-5-21-601027151-1453584952-853886390-1000: @tools.google.com/Google Update;version=9 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)

    FF Plugin ProgramFiles/Appdata: C:\Users\JLL-NEW THINKPAD\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)

    FF Plugin ProgramFiles/Appdata: C:\Users\JLL-NEW THINKPAD\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)

    FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension

    FF Extension: (SmartPrintButton) - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011-01-26] [not signed]

    FF HKLM-x32\...\Firefox\Extensions: [VIP5X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access Client

    FF Extension: (Symantec VIP Access Add-On) - C:\Program Files (x86)\Symantec\VIP Access Client [2013-03-21] [not signed]


    Chrome:

    =======

    CHR Plugin: (Widevine Content Decryption Module) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.823\_platform_specific\win_x86\widevinecdmadapter.dll => No File

    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\53.0.2785.116\PepperFlash\pepflashplayer.dll ()

    CHR Profile: C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default [2016-09-18]

    CHR Extension: (Google Drive) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-11]

    CHR Extension: (Google Search) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]

    CHR Extension: (Full Screen Weather) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkkaebihfmbofclegkcfkkemepfehibg [2015-05-12]

    CHR Extension: (Google Docs Offline) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-11]

    CHR Extension: (AdBlock) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-09-17]

    CHR Extension: (Chrome Web Store Payments) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-01]

    CHR Extension: (Gmail) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]

    CHR Extension: (Chrome Media Router) - C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-30]


    ==================== Services (Whitelisted) ========================


    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    R2 AdvancedSystemCareService9; C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe [446240 2016-01-05] (IObit)

    R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [169776 2012-01-17] (Lenovo)

    S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2012-10-01] (Macrovision Europe Ltd.) [File not signed]

    S3 GoogleDesktopManager-051210-111108; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2012-10-11] (Google)

    R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [330136 2015-10-30] (Intel Corporation)

    S3 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()

    R2 IMFservice; C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [1597728 2016-06-13] (IObit)

    R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-03-06] ()

    R2 intelsba; C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [50440 2012-11-08] (Intel Corporation)

    R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [163608 2012-03-06] (Intel Corporation)

    R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [136288 2012-08-10] (Lenovo Group Limited)

    S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093944 2011-02-07] (Symantec Corporation)

    R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [419336 2016-09-15] (LogMeIn, Inc.)

    R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [509448 2016-09-15] (LogMeIn, Inc.)

    R3 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-06-08] (LogMeIn, Inc.)

    R2 NitroDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe [216072 2012-05-24] (Nitro PDF Software)

    R2 sgbupt; C:\Program Files (x86)\SuperBoost\SuperBoost Software Updater\SuperBoostUpdater.exe [2600256 2016-04-21] (SuperBoost Software)

    S3 ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [31176 2016-01-20] (SHAREit Technologies Co.Ltd)

    R3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [28544 2016-07-07] ()

    R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [255608 2016-04-21] (Synaptics Incorporated)

    R2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84080 2012-04-19] (Symantec Corporation)

    S3 vmicvss; C:\Windows\System32\ICSvc.dll [511488 2016-09-07] (Microsoft Corporation)

    R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364456 2016-09-07] (Microsoft Corporation)

    R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-09-07] (Microsoft Corporation)


    ===================== Drivers (Whitelisted) ==========================


    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    R1 adgnetworkwfpdrv; C:\Windows\System32\drivers\adgnetworkwfpdrv.sys [55800 2015-06-02] ()

    S3 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70416 2012-01-17] (Windows (R) Win 7 DDK provider)

    R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-05-23] (REALiX(tm))

    S3 IMFFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\IMFFilter.sys [22208 2016-04-01] (IObit)

    R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-06-04] (LogMeIn, Inc.)

    S4 LMIRfsClientNP; no ImagePath

    R3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)

    S3 RegFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [34848 2016-01-11] (IObit.com)

    R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [328920 2016-04-14] (Realtek Semiconductor Corp.)

    R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [936192 2016-06-15] (Realtek )

    R3 rtwlane_13; C:\Windows\System32\drivers\rtwlane_13.sys [3749888 2015-10-30] (Realtek Semiconductor Corporation )

    R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [51320 2016-04-21] (Synaptics Incorporated)

    S3 Trufos; C:\Windows\System32\DRIVERS\TRUFOS.sys [452040 2016-03-31] (BitDefender S.R.L.)

    R3 Tvti2c; C:\Windows\system32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)

    S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)

    R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)

    R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

    R1 WiseUnlock; C:\WINDOWS\WiseUnlock64.sys [12240 2015-05-19] (WiseCleaner.com)

    U3 idsvc; no ImagePath


    ==================== NetSvcs (Whitelisted) ===================


    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)



    ==================== One Month Created files and folders ========


    (If an entry is included in the fixlist, the file/folder will be moved.)


    2016-09-18 23:10 - 2016-09-18 23:11 - 00063723 _____ C:\Users\JLL-NEW THINKPAD\Downloads\Addition.txt

    2016-09-18 23:09 - 2016-09-18 23:37 - 00030840 _____ C:\Users\JLL-NEW THINKPAD\Downloads\FRST.txt

    2016-09-18 23:09 - 2016-09-18 23:37 - 00000000 ____D C:\FRST

    2016-09-18 23:09 - 2016-09-18 23:09 - 02400256 _____ (Farbar) C:\Users\JLL-NEW THINKPAD\Downloads\FRST64 (1).exe

    2016-09-18 23:07 - 2016-09-18 23:07 - 02400256 _____ (Farbar) C:\Users\JLL-NEW THINKPAD\Downloads\FRST64.exe

    2016-09-18 22:58 - 2016-09-18 22:58 - 01089816 _____ (Emsisoft Ltd) C:\Users\JLL-NEW THINKPAD\Downloads\decrypt_nemucod.exe

    2016-09-18 22:12 - 2016-09-18 22:12 - 00000114 _____ C:\WINDOWS\ntbtlog.txt

    2016-09-18 21:30 - 2016-09-18 21:30 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Roaming\ProductData

    2016-09-18 21:02 - 2016-09-18 21:02 - 00003220 _____ C:\WINDOWS\System32\Tasks\BDAntiCryptoWallTask

    2016-09-18 20:42 - 2016-09-18 20:47 - 00000000 ____D C:\ProgramData\ProductData

    2016-09-18 19:43 - 2016-09-18 19:43 - 00048206 _____ C:\Users\JLL-NEW THINKPAD\Documents\cc_20160918_194334.reg

    2016-09-18 18:25 - 2016-09-18 18:25 - 00002892 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC

    2016-09-18 18:24 - 2016-09-18 18:24 - 00000876 _____ C:\Users\Public\Desktop\CCleaner.lnk
     
    Joe L,
    #9
  11. 2016/09/18
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    2016-09-18 18:24 - 2016-09-18 18:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

    2016-09-18 18:24 - 2016-09-18 18:24 - 00000000 ____D C:\Program Files\CCleaner

    2016-09-18 18:23 - 2016-09-18 18:24 - 08244656 _____ (Piriform Ltd) C:\Users\JLL-NEW THINKPAD\Desktop\ccsetup522.exe

    2016-09-18 16:08 - 2016-09-18 19:44 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\CrashDumps

    2016-09-18 14:13 - 2016-09-18 19:50 - 00000000 ____D C:\Program Files\Plumbytes Software

    2016-09-18 01:05 - 2016-09-18 01:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BDAntiRansomware

    2016-09-18 01:05 - 2016-09-18 01:05 - 00000000 ____D C:\Program Files\Bitdefender

    2016-09-18 01:04 - 2016-09-18 01:05 - 04703248 _____ (Bitdefender ) C:\Users\JLL-NEW THINKPAD\Desktop\BDAntiRansomwareSetup.exe

    2016-09-18 00:49 - 2016-09-18 00:49 - 01089816 _____ (Emsisoft Ltd) C:\Users\JLL-NEW THINKPAD\Desktop\decrypt_nemucod (1).exe

    2016-09-18 00:47 - 2016-09-18 00:47 - 01089816 _____ (Emsisoft Ltd) C:\Users\JLL-NEW THINKPAD\Desktop\decrypt_nemucod.exe

    2016-09-18 00:12 - 2016-09-18 20:50 - 00000000 ____D C:\NPE

    2016-09-17 23:56 - 2016-09-18 22:18 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\NPE

    2016-09-17 23:55 - 2016-09-17 23:56 - 03423928 _____ (Symantec Corporation) C:\Users\JLL-NEW THINKPAD\Desktop\NPE.exe

    2016-09-17 18:52 - 2016-09-17 18:52 - 00001362 _____ C:\Users\JLL-NEW THINKPAD\Desktop\a.txt

    2016-09-17 18:15 - 2016-09-18 20:18 - 00000712 _____ C:\Users\JLL-NEW THINKPAD\Desktop\JRT.txt

    2016-09-17 18:12 - 2016-09-17 18:12 - 01610560 _____ (Malwarebytes) C:\Users\JLL-NEW THINKPAD\Desktop\JRT.exe

    2016-09-17 17:38 - 2016-09-17 17:38 - 03861056 _____ C:\Users\JLL-NEW THINKPAD\Desktop\adwcleaner_6.020.exe

    2016-09-17 16:58 - 2016-09-17 22:18 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\YdPack

    2016-09-17 15:51 - 2016-09-18 22:05 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\f28b4

    2016-09-17 15:51 - 2016-09-17 22:18 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Local\Insoft

    2016-09-17 15:51 - 2016-09-17 15:51 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Roaming\9373f

    2016-09-17 15:50 - 2016-09-17 15:50 - 00001362 _____ C:\Users\JLL-NEW THINKPAD\Desktop\DECRYPT.txt

    2016-09-16 20:21 - 2016-09-16 20:21 - 00000000 ____D C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

    2016-09-14 11:44 - 2016-09-15 11:44 - 00122400 _____ (LogMeIn, Inc.) C:\WINDOWS\system32\LMIRfsClientNP.dll

    2016-09-14 11:44 - 2012-06-08 12:06 - 00072216 _____ (LogMeIn, Inc.) C:\WINDOWS\system32\Drivers\LMIRfsDriver.sys

    2016-09-13 15:18 - 2016-09-07 01:39 - 02656952 _____ C:\WINDOWS\system32\CoreUIComponents.dll

    2016-09-13 15:18 - 2016-09-07 01:39 - 01098640 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll

    2016-09-13 15:18 - 2016-09-07 01:26 - 02544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

    2016-09-13 15:18 - 2016-09-07 01:26 - 01299504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll

    2016-09-13 15:18 - 2016-09-07 01:26 - 01152320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll

    2016-09-13 15:18 - 2016-09-07 01:26 - 00588320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmdrmdev.dll

    2016-09-13 15:18 - 2016-09-07 01:25 - 02607336 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll

    2016-09-13 15:18 - 2016-09-07 01:23 - 01750440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe

    2016-09-13 15:18 - 2016-09-07 01:19 - 00294752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll

    2016-09-13 15:18 - 2016-09-07 00:48 - 22379520 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

    2016-09-13 15:18 - 2016-09-07 00:43 - 16985600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

    2016-09-13 15:18 - 2016-09-07 00:39 - 01567744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll

    2016-09-13 15:18 - 2016-09-07 00:35 - 24611840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

    2016-09-13 15:18 - 2016-09-07 00:35 - 00383488 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

    2016-09-13 15:18 - 2016-09-07 00:32 - 00787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\cscui.dll

    2016-09-13 15:18 - 2016-09-07 00:32 - 00581632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apphelp.dll

    2016-09-13 15:18 - 2016-09-07 00:31 - 00794624 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll

    2016-09-13 15:18 - 2016-09-07 00:31 - 00610304 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmdrmsdk.dll

    2016-09-13 15:18 - 2016-09-07 00:31 - 00335872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

    2016-09-13 15:18 - 2016-09-07 00:30 - 18676224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

    2016-09-13 15:18 - 2016-09-07 00:30 - 02127360 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

    2016-09-13 15:18 - 2016-09-07 00:30 - 01707520 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll

    2016-09-13 15:18 - 2016-09-07 00:30 - 00904704 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll

    2016-09-13 15:18 - 2016-09-07 00:30 - 00784384 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

    2016-09-13 15:18 - 2016-09-07 00:30 - 00602624 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

    2016-09-13 15:18 - 2016-09-07 00:29 - 19350016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

    2016-09-13 15:18 - 2016-09-07 00:28 - 00938496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe

    2016-09-13 15:18 - 2016-09-07 00:27 - 01743872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll

    2016-09-13 15:18 - 2016-09-07 00:27 - 00963072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll

    2016-09-13 15:18 - 2016-09-07 00:27 - 00552960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll

    2016-09-13 15:18 - 2016-09-07 00:26 - 13392384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

    2016-09-13 15:18 - 2016-09-07 00:26 - 02050048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

    2016-09-13 15:18 - 2016-09-07 00:26 - 01508352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmsipc.dll

    2016-09-13 15:18 - 2016-09-07 00:26 - 00687616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

    2016-09-13 15:18 - 2016-09-07 00:25 - 01526272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

    2016-09-13 15:18 - 2016-09-07 00:25 - 01166848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Pimstore.dll

    2016-09-13 15:18 - 2016-09-07 00:25 - 00769536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll

    2016-09-13 15:18 - 2016-09-07 00:24 - 03428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

    2016-09-13 15:18 - 2016-09-07 00:23 - 00980480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winipcsecproc.dll

    2016-09-13 15:18 - 2016-09-07 00:23 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll

    2016-09-13 15:18 - 2016-09-07 00:22 - 12134400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

    2016-09-13 15:18 - 2016-09-07 00:21 - 03046400 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll

    2016-09-13 15:18 - 2016-09-07 00:21 - 01797120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll

    2016-09-13 15:18 - 2016-09-07 00:20 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll

    2016-09-13 15:18 - 2016-09-07 00:19 - 03663360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

    2016-09-13 15:18 - 2016-09-07 00:19 - 02102272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsservices.dll

    2016-09-13 15:18 - 2016-09-07 00:18 - 03577344 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll

    2016-09-13 15:18 - 2016-09-07 00:18 - 02876928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wpc.dll

    2016-09-13 15:18 - 2016-09-07 00:17 - 02285568 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebSync.dll

    2016-09-13 15:18 - 2016-09-07 00:16 - 04412928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll

    2016-09-13 15:18 - 2016-09-07 00:16 - 03671040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll

    2016-09-13 15:18 - 2016-09-07 00:16 - 02911744 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll

    2016-09-13 15:18 - 2016-09-07 00:16 - 02746368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll

    2016-09-13 15:18 - 2016-09-07 00:16 - 02597888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll

    2016-09-13 15:18 - 2016-09-07 00:16 - 02280960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

    2016-09-13 15:18 - 2016-09-07 00:16 - 02217984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wpc.dll

    2016-09-13 15:18 - 2016-09-07 00:16 - 01676800 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll

    2016-09-13 15:18 - 2016-09-07 00:16 - 01194496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll

    2016-09-13 15:18 - 2016-09-07 00:16 - 01123328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll

    2016-09-13 15:18 - 2016-09-07 00:15 - 07831552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

    2016-09-13 15:18 - 2016-09-07 00:15 - 05659136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

    2016-09-13 15:18 - 2016-09-07 00:15 - 02604032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll

    2016-09-13 15:18 - 2016-09-07 00:15 - 02055168 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll

    2016-09-13 15:18 - 2016-09-07 00:15 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hnetcfg.dll

    2016-09-13 15:18 - 2016-09-07 00:14 - 06743040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll

    2016-09-13 15:18 - 2016-09-07 00:14 - 04895232 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

    2016-09-13 15:18 - 2016-09-07 00:14 - 01946112 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll

    2016-09-13 15:18 - 2016-09-07 00:13 - 04171264 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll

    2016-09-13 15:18 - 2016-09-07 00:13 - 02874880 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmcndmgr.dll

    2016-09-13 15:18 - 2016-09-07 00:11 - 03065344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe

    2016-09-13 15:17 - 2016-09-07 01:39 - 00845568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll

    2016-09-13 15:17 - 2016-09-07 01:39 - 00754664 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll

    2016-09-13 15:17 - 2016-09-07 01:39 - 00620176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll

    2016-09-13 15:17 - 2016-09-07 01:39 - 00277848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

    2016-09-13 15:17 - 2016-09-07 01:37 - 00572272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\taskschd.dll

    2016-09-13 15:17 - 2016-09-07 01:34 - 02587696 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll

    2016-09-13 15:17 - 2016-09-07 01:33 - 01297760 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll

    2016-09-13 15:17 - 2016-09-07 01:33 - 00986976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll

    2016-09-13 15:17 - 2016-09-07 01:33 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

    2016-09-13 15:17 - 2016-09-07 01:27 - 00538632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll

    2016-09-13 15:17 - 2016-09-07 01:27 - 00413536 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe

    2016-09-13 15:17 - 2016-09-07 01:26 - 01092464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll

    2016-09-13 15:17 - 2016-09-07 01:26 - 00858952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll

    2016-09-13 15:17 - 2016-09-07 01:26 - 00847648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll

    2016-09-13 15:17 - 2016-09-07 01:26 - 00785088 _____ (Microsoft Corporation) C:\WINDOWS\system32\evr.dll

    2016-09-13 15:17 - 2016-09-07 01:26 - 00586200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll

    2016-09-13 15:17 - 2016-09-07 01:26 - 00245840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll

    2016-09-13 15:17 - 2016-09-07 01:25 - 01447776 _____ (Microsoft Corporation) C:\WINDOWS\system32\webservices.dll

    2016-09-13 15:17 - 2016-09-07 01:25 - 01322248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll

    2016-09-13 15:17 - 2016-09-07 01:25 - 01270064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll

    2016-09-13 15:17 - 2016-09-07 01:24 - 03693064 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

    2016-09-13 15:17 - 2016-09-07 01:24 - 01349632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll

    2016-09-13 15:17 - 2016-09-07 01:24 - 00808288 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe

    2016-09-13 15:17 - 2016-09-07 01:24 - 00511312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll

    2016-09-13 15:17 - 2016-09-07 01:24 - 00501600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll

    2016-09-13 15:17 - 2016-09-07 01:24 - 00496360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmdrmdev.dll

    2016-09-13 15:17 - 2016-09-07 01:24 - 00355672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll

    2016-09-13 15:17 - 2016-09-07 01:23 - 22561256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

    2016-09-13 15:17 - 2016-09-07 01:23 - 06605544 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll

    2016-09-13 15:17 - 2016-09-07 01:23 - 06536248 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

    2016-09-13 15:17 - 2016-09-07 01:23 - 01603224 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll

    2016-09-13 15:17 - 2016-09-07 01:23 - 01040792 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll

    2016-09-13 15:17 - 2016-09-07 01:23 - 00725776 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll

    2016-09-13 15:17 - 2016-09-07 01:22 - 02937384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

    2016-09-13 15:17 - 2016-09-07 01:22 - 01128096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe

    2016-09-13 15:17 - 2016-09-07 01:22 - 01085728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webservices.dll

    2016-09-13 15:17 - 2016-09-07 01:22 - 00604920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

    2016-09-13 15:17 - 2016-09-07 01:20 - 00569744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll

    2016-09-13 15:17 - 2016-09-07 01:15 - 00911640 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll

    2016-09-13 15:17 - 2016-09-07 01:12 - 02195632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll

    2016-09-13 15:17 - 2016-09-07 01:12 - 01174008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll

    2016-09-13 15:17 - 2016-09-07 01:08 - 00116216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll

    2016-09-13 15:17 - 2016-09-07 00:52 - 01035776 _____ (Microsoft Corporation) C:\WINDOWS\system32\XboxNetApiSvc.dll

    2016-09-13 15:17 - 2016-09-07 00:52 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll

    2016-09-13 15:17 - 2016-09-07 00:49 - 00649216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll

    2016-09-13 15:17 - 2016-09-07 00:48 - 00957952 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL

    2016-09-13 15:17 - 2016-09-07 00:47 - 00824320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll

    2016-09-13 15:17 - 2016-09-07 00:46 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll

    2016-09-13 15:17 - 2016-09-07 00:46 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll

    2016-09-13 15:17 - 2016-09-07 00:44 - 00134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll

    2016-09-13 15:17 - 2016-09-07 00:44 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\pngfilt.dll

    2016-09-13 15:17 - 2016-09-07 00:42 - 00572928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll

    2016-09-13 15:17 - 2016-09-07 00:42 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosHostClient.dll

    2016-09-13 15:17 - 2016-09-07 00:41 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\system32\DictationManager.dll

    2016-09-13 15:17 - 2016-09-07 00:41 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\shsetup.dll

    2016-09-13 15:17 - 2016-09-07 00:41 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll

    2016-09-13 15:17 - 2016-09-07 00:41 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\OnDemandConnRouteHelper.dll

    2016-09-13 15:17 - 2016-09-07 00:41 - 00056832 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwcfg.dll

    2016-09-13 15:17 - 2016-09-07 00:41 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceassociation.dll

    2016-09-13 15:17 - 2016-09-07 00:41 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll

    2016-09-13 15:17 - 2016-09-07 00:40 - 00361472 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdechangepin.exe

    2016-09-13 15:17 - 2016-09-07 00:40 - 00027648 _____ (Microsoft Corporation) C:\WINDOWS\system32\CheckNetIsolation.exe

    2016-09-13 15:17 - 2016-09-07 00:39 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiarpc.dll

    2016-09-13 15:17 - 2016-09-07 00:39 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\udhisapi.dll

    2016-09-13 15:17 - 2016-09-07 00:38 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll

    2016-09-13 15:17 - 2016-09-07 00:38 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\LegacyNetUXHost.exe

    2016-09-13 15:17 - 2016-09-07 00:38 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosStorage.dll

    2016-09-13 15:17 - 2016-09-07 00:38 - 00038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsmprovhost.exe

    2016-09-13 15:17 - 2016-09-07 00:38 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\upnpcont.exe

    2016-09-13 15:17 - 2016-09-07 00:37 - 00617984 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll

    2016-09-13 15:17 - 2016-09-07 00:37 - 00435712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.AllJoyn.dll

    2016-09-13 15:17 - 2016-09-07 00:37 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepsync.dll

    2016-09-13 15:17 - 2016-09-07 00:37 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAuto.dll

    2016-09-13 15:17 - 2016-09-07 00:37 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll

    2016-09-13 15:17 - 2016-09-07 00:37 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapsBtSvc.dll

    2016-09-13 15:17 - 2016-09-07 00:37 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceassociation.dll

    2016-09-13 15:17 - 2016-09-07 00:37 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAgent.dll

    2016-09-13 15:17 - 2016-09-07 00:36 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll

    2016-09-13 15:17 - 2016-09-07 00:36 - 01568768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdt.exe

    2016-09-13 15:17 - 2016-09-07 00:36 - 01051136 _____ (Microsoft Corporation) C:\WINDOWS\system32\DiagCpl.dll

    2016-09-13 15:17 - 2016-09-07 00:36 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll

    2016-09-13 15:17 - 2016-09-07 00:36 - 00489984 _____ (Microsoft Corporation) C:\WINDOWS\system32\authfwcfg.dll

    2016-09-13 15:17 - 2016-09-07 00:36 - 00457216 _____ (Microsoft Corporation) C:\WINDOWS\system32\azroleui.dll

    2016-09-13 15:17 - 2016-09-07 00:36 - 00319488 _____ (Microsoft Corporation) C:\WINDOWS\system32\dot3ui.dll

    2016-09-13 15:17 - 2016-09-07 00:36 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepapi.dll

    2016-09-13 15:17 - 2016-09-07 00:36 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFPlatform.dll

    2016-09-13 15:17 - 2016-09-07 00:36 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll

    2016-09-13 15:17 - 2016-09-07 00:36 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shsetup.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00814592 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctfuimanager.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00704000 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00591872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmsRouterSvc.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00577536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Wallet.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00394240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00393216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wbemcomn.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00256512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unimdm.tsp

    2016-09-13 15:17 - 2016-09-07 00:35 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExecModelClient.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModelShim.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.ps.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll

    2016-09-13 15:17 - 2016-09-07 00:35 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vsstrace.dll

    2016-09-13 15:17 - 2016-09-07 00:34 - 00952320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.PointOfService.dll

    2016-09-13 15:17 - 2016-09-07 00:34 - 00727040 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll

    2016-09-13 15:17 - 2016-09-07 00:34 - 00387072 _____ (Microsoft Corporation) C:\WINDOWS\system32\qdvd.dll

    2016-09-13 15:17 - 2016-09-07 00:34 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDEServer.exe

    2016-09-13 15:17 - 2016-09-07 00:34 - 00344064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Picker.dll

    2016-09-13 15:17 - 2016-09-07 00:34 - 00305152 _____ (Microsoft Corporation) C:\WINDOWS\system32\edputil.dll

    2016-09-13 15:17 - 2016-09-07 00:33 - 00847360 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll

    2016-09-13 15:17 - 2016-09-07 00:33 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.UX.EapRequestHandler.dll

    2016-09-13 15:17 - 2016-09-07 00:33 - 00330240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

    2016-09-13 15:17 - 2016-09-07 00:33 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll

    2016-09-13 15:17 - 2016-09-07 00:33 - 00290304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WmpDui.dll

    2016-09-13 15:17 - 2016-09-07 00:33 - 00238080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmWmiPl.dll

    2016-09-13 15:17 - 2016-09-07 00:32 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebcamUi.dll

    2016-09-13 15:17 - 2016-09-07 00:32 - 00947200 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasgcw.dll

    2016-09-13 15:17 - 2016-09-07 00:32 - 00738816 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmartCardSimulator.dll

    2016-09-13 15:17 - 2016-09-07 00:32 - 00643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiaservc.dll

    2016-09-13 15:17 - 2016-09-07 00:32 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv

    2016-09-13 15:17 - 2016-09-07 00:32 - 00466944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll

    2016-09-13 15:17 - 2016-09-07 00:32 - 00444928 _____ (Microsoft Corporation) C:\WINDOWS\system32\das.dll

    2016-09-13 15:17 - 2016-09-07 00:32 - 00432640 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll

    2016-09-13 15:17 - 2016-09-07 00:32 - 00407040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys

    2016-09-13 15:17 - 2016-09-07 00:32 - 00356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll

    2016-09-13 15:17 - 2016-09-07 00:32 - 00334848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe

    2016-09-13 15:17 - 2016-09-07 00:32 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\facecredentialprovider.dll

    2016-09-13 15:17 - 2016-09-07 00:31 - 01216512 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcenter.dll

    2016-09-13 15:17 - 2016-09-07 00:31 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll

    2016-09-13 15:17 - 2016-09-07 00:31 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.AccountsControl.dll

    2016-09-13 15:17 - 2016-09-07 00:31 - 00821760 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmIndexer.dll

    2016-09-13 15:17 - 2016-09-07 00:31 - 00753664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctfuimanager.dll

    2016-09-13 15:17 - 2016-09-07 00:31 - 00578560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mscms.dll

    2016-09-13 15:17 - 2016-09-07 00:31 - 00541184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GamePanel.exe

    2016-09-13 15:17 - 2016-09-07 00:31 - 00538112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.Desktop.dll

    2016-09-13 15:17 - 2016-09-07 00:31 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll

    2016-09-13 15:17 - 2016-09-07 00:31 - 00435200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll

    2016-09-13 15:17 - 2016-09-07 00:31 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe

    2016-09-13 15:17 - 2016-09-07 00:31 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

    2016-09-13 15:17 - 2016-09-07 00:31 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinelsa.dll

    2016-09-13 15:17 - 2016-09-07 00:30 - 02476032 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSAJApi.dll

    2016-09-13 15:17 - 2016-09-07 00:30 - 01001472 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll

    2016-09-13 15:17 - 2016-09-07 00:30 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll

    2016-09-13 15:17 - 2016-09-07 00:30 - 00698368 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll

    2016-09-13 15:17 - 2016-09-07 00:30 - 00436224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mprdim.dll

    2016-09-13 15:17 - 2016-09-07 00:30 - 00349696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
     
    Joe L,
    #10
  12. 2016/09/18
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    For FRST pls see the last two replies. I'm sorry I ******* up on the cutting and pasting - i kept losing my place. then I Put it in word and numbered the pages. BTW after running all these programs and using the fixes (CCleaner,ADW, Windows Def, Malwarebytes,JRT and NPE) the computer reboots just fine.
     
    Last edited: 2016/09/18
    Joe L,
    #11
  13. 2016/09/19
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    Just got another email from the ransomware source - does that mean anything?
     
    Joe L,
    #12
  14. 2016/09/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Double click on downloaded setup.exe file to install the program.
    • Click on Start Scan button.
    • Click on another Start Scan button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    [​IMG] Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
    NOTE. If you already have MBAM 2.0 installed scroll down.
    • Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
    • Click Finish.
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.
    If you already have MBAM 2.0 installed:
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.
    How to get logs:
    (Export log to save as txt)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Export'.
    • Click 'Text file (*.txt)'
    • In the Save File dialog box which appears, click on Desktop.
    • In the File name: box type a name for your scan log.
    • A message box named 'File Saved' should appear stating "Your file has been successfully exported ".
    • Click Ok
    • Attach that saved log to your next reply.
    (Copy to clipboard for pasting into forum replies or tickets)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Copy to Clipboard'
    • Paste the contents of the clipboard into your reply.
    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.
    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator ".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
     
    broni,
    #13
  15. 2016/09/19
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 8.0.7 (07.03.2016)
    Operating System: Windows 10 Pro x64
    Ran by JLL-NEW THINKPAD (Administrator) on Mon 09/19/2016 at 22:48:44.56
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    File System: 2

    Successfully deleted: C:\ProgramData\productdata (Folder)
    Successfully deleted: C:\Users\JLL-NEW THINKPAD\AppData\Roaming\productdata (Folder)



    Registry: 0
     
    Joe L,
    #14
  16. 2016/09/19
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    Rogue Killer Report

    Website : RogueKiller Anti-Malware Free Download - Official Website
    Blog : Adlice Software

    Operating System : Windows 10 (10.0.10586) 64 bits version
    Started in : Normal mode
    User : JLL-NEW THINKPAD [Administrator]
    Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
    Mode : Delete -- Date : 09/19/2016 23:00:07 (Duration : 00:37:30)

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 4 ¤¤¤
    [PUP|VT.Application.Win32.Coupons.a] (X64) HKEY_CLASSES_ROOT\CLSID\{1A53AD8B-D0B9-4E7F-88E4-50C07A65F2DC} (C:\WINDOWS\couponprinter_x64.ocx) -> Deleted
    [PUP|VT.Application.Win32.Coupons.a] (X64) HKEY_CLASSES_ROOT\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC} (C:\WINDOWS\couponprinter_x64.ocx) -> Deleted
    [PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-601027151-1453584952-853886390-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Replaced (1)
    [PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-601027151-1453584952-853886390-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Replaced (1)

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 3 ¤¤¤
    [PUP][File] C:\Windows\couponprinter_x64.ocx -> Deleted
    [Tr.Kovter][File] C:\Users\JLL-NEW THINKPAD\AppData\Roaming\9373f\4d1a4.b71b14 -> Deleted
    [Tr.Kovter][File] C:\Users\JLL-NEW THINKPAD\AppData\Local\f28b4\bd2a0.b71b14 -> Deleted

    ¤¤¤ WMI : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: WDC WD3200BEKT-08PVMT1 +++++
    --- User ---
    [MBR] f7e699787a2ddb7fdb6119abe97767d8
    [BSP] f77c3ccdf01c22ece0f76966e31ef531 : Lenovo|VT.Unknown MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1500 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 3074048 | Size: 284945 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 586643456 | Size: 797 MB
    3 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 588275712 | Size: 18000 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    User = LL1 ... OK
    User = LL2 ... OK
     
    Joe L,
    #15
  17. 2016/09/19
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    malwarebytes found no threats

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 9/19/2016
    Scan Time: 11:43 PM
    Logfile:
    Administrator: Yes

    Version: 2.2.1.1043
    Malware Database: v2016.09.19.08
    Rootkit Database: v2016.08.15.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 10
    CPU: x64
    File System: NTFS
    User: JLL-NEW THINKPAD

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 358036
    Time Elapsed: 15 min, 33 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Warn
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 0
    (No malicious items detected)

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
    Joe L,
    #16
  18. 2016/09/19
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    ADW results
    AdwCleaner v6.020 - Logfile created 20/09/2016 at 00:06:33
    # Updated on 14/09/2016 by ToolsLib
    # Database : 2016-09-20.1 [Server]
    # Operating System : Windows 10 Pro (X64)
    # Username : JLL-NEW THINKPAD - JLL-NEWTHINKPAD
    # Running from : C:\Users\JLL-NEW THINKPAD\Desktop\adwcleaner_6.020.exe
    # Mode: Clean
    # Support : ToolsLib



    ***** [ Services ] *****



    ***** [ Folders ] *****



    ***** [ Files ] *****



    ***** [ DLL ] *****



    ***** [ WMI ] *****



    ***** [ Shortcuts ] *****



    ***** [ Scheduled Tasks ] *****



    ***** [ Registry ] *****

    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10921475-03CE-4E04-90CE-E2E7EF20C814}


    ***** [ Web browsers ] *****



    *************************

    :: "Tracing" keys deleted
    :: Winsock settings cleared

    *************************

    C:\AdwCleaner\AdwCleaner[C0].txt - [4451 Bytes] - [17/09/2016 17:41:54]
    C:\AdwCleaner\AdwCleaner[C2].txt - [1866 Bytes] - [17/09/2016 18:03:24]
    C:\AdwCleaner\AdwCleaner[C3].txt - [2373 Bytes] - [17/09/2016 22:54:50]
    C:\AdwCleaner\AdwCleaner[C4].txt - [2373 Bytes] - [18/09/2016 19:50:07]
    C:\AdwCleaner\AdwCleaner[C5].txt - [1170 Bytes] - [20/09/2016 00:06:33]
    C:\AdwCleaner\AdwCleaner[R0].txt - [5633 Bytes] - [02/08/2014 10:38:33]
    C:\AdwCleaner\AdwCleaner[R1].txt - [2940 Bytes] - [12/01/2015 21:33:21]
    C:\AdwCleaner\AdwCleaner[R2].txt - [11996 Bytes] - [06/05/2015 23:18:38]
    C:\AdwCleaner\AdwCleaner[R3].txt - [12056 Bytes] - [06/05/2015 23:21:59]
    C:\AdwCleaner\AdwCleaner[R4].txt - [3274 Bytes] - [29/07/2015 20:38:44]
    C:\AdwCleaner\AdwCleaner[R5].txt - [3333 Bytes] - [29/07/2015 20:40:50]
    C:\AdwCleaner\AdwCleaner[R6].txt - [3017 Bytes] - [27/10/2015 22:52:35]
    C:\AdwCleaner\AdwCleaner[S0].txt - [5607 Bytes] - [02/08/2014 10:40:19]
    C:\AdwCleaner\AdwCleaner[S1].txt - [2927 Bytes] - [12/01/2015 21:36:11]
    C:\AdwCleaner\AdwCleaner[S2].txt - [3269 Bytes] - [29/07/2015 20:42:09]
    C:\AdwCleaner\AdwCleaner[S3].txt - [4384 Bytes] - [17/09/2016 17:41:02]
    C:\AdwCleaner\AdwCleaner[S4].txt - [2034 Bytes] - [17/09/2016 18:03:07]
    C:\AdwCleaner\AdwCleaner[S5].txt - [2429 Bytes] - [17/09/2016 22:52:36]
    C:\AdwCleaner\AdwCleaner[S6].txt - [2463 Bytes] - [18/09/2016 19:49:06]
    C:\AdwCleaner\AdwCleaner[S7].txt - [2543 Bytes] - [20/09/2016 00:05:44]

    ########## EOF - C:\AdwCleaner\AdwCleaner[C5].txt - [2340 Bytes] ##########
     
    Joe L,
    #17
  19. 2016/09/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

    • Double click to run it.
    • Make sure you checkmark Addition.txt box.
    • Press Scan button.
    • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.
     
    broni,
    #18
  20. 2016/09/19
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    JRT Results - I will run Farbar next Thanks so much for your help!

    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 8.0.7 (07.03.2016)
    Operating System: Windows 10 Pro x64
    Ran by JLL-NEW THINKPAD (Administrator) on Tue 09/20/2016 at 0:14:08.56
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    File System: 2

    Successfully deleted: C:\ProgramData\productdata (Folder)
    Successfully deleted: C:\Users\JLL-NEW THINKPAD\AppData\Roaming\productdata (Folder)



    Registry: 0
     
    Joe L,
    #19
  21. 2016/09/19
    Joe L

    Joe L New Member Thread Starter

    Joined:
    2016/09/18
    Messages:
    28
    Likes Received:
    0
    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-09-2016

    Ran by JLL-NEW THINKPAD (20-09-2016 00:29:46)

    Running from C:\Users\JLL-NEW THINKPAD\Downloads

    Windows 10 Pro Version 1511 (X64) (2015-12-16 01:10:45)

    Boot Mode: Normal

    ==========================================================



    ==================== Accounts: =============================


    Administrator (S-1-5-21-601027151-1453584952-853886390-500 - Administrator - Disabled)

    DefaultAccount (S-1-5-21-601027151-1453584952-853886390-503 - Limited - Disabled)

    Guest (S-1-5-21-601027151-1453584952-853886390-501 - Limited - Disabled)

    HomeGroupUser$ (S-1-5-21-601027151-1453584952-853886390-1003 - Limited - Enabled)

    JLL-NEW THINKPAD (S-1-5-21-601027151-1453584952-853886390-1000 - Administrator - Enabled) => C:\Users\JLL-NEW THINKPAD

    LogMeInRemoteUser (S-1-5-21-601027151-1453584952-853886390-1001 - Administrator - Enabled) => C:\Users\LogMeInRemoteUser


    ==================== Security Center ========================


    (If an entry is included in the fixlist, it will be removed.)


    AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    AV: IObit Malware Fighter (Disabled - Out of date) {4D381C57-3C7A-6F22-07EB-639F49E836D4}

    AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    AS: IObit Malware Fighter (Disabled - Up to date) {A751AC20-3B48-5237-898A-78C4436BB78D}


    ==================== Installed Programs ======================


    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)


    Absolute Reminder (HKLM-x32\...\{40F4FF7A-B214-4453-B973-080B09CED019}) (Version: 2.0.0.19 - Absolute Software)

    Adobe Acrobat 9 Pro Extended - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}) (Version: 9.5.5 - Adobe Systems)

    Adobe Acrobat 9 Pro Extended 64-bit Add-On (HKLM\...\{AC76BA86-1033-0000-0064-0003D0000004}) (Version: 9.0.0 - Adobe Systems Incorporated)

    Adobe Acrobat 9.5.5 - CPSID_83708 (HKLM-x32\...\{AC76BA86-1033-F400-7761-000000000004}_955) (Version: - Adobe Systems Incorporated)

    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 20.0.0.233 - Adobe Systems Incorporated)

    Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.162 - Adobe Systems Incorporated)

    Adobe Reader XI (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)

    Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.4.194 - Adobe Systems, Inc.)

    Advanced SystemCare 9 (HKLM-x32\...\Advanced SystemCare_is1) (Version: 9.3.0 - IObit)

    BDAntiRansomware (HKLM\...\{BE40AB1F-558F-4434-B72F-461EF97E7796}_is1) (Version: 1.0.12.1 - Bitdefender)

    Brother MFL-Pro Suite MFC-490CW (HKLM-x32\...\{48D082B9-18F6-4426-AFAC-8B6A3E7021B1}) (Version: 1.0.1.0 - Brother Industries, Ltd.)

    Burn.Now 4.5 (x32 Version: 4.5.0 - Corel Corporation) Hidden

    Canon CanoScan LiDE 110 User Registration (HKLM-x32\...\Canon CanoScan LiDE 110 User Registration) (Version: - )

    Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - )

    Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version: - )

    Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - )

    CanoScan LiDE 110 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2414) (Version: - )

    CCleaner (HKLM\...\CCleaner) (Version: 5.22 - Piriform)

    Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

    Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)

    Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)

    Citrix Online Launcher (HKLM-x32\...\{09DA5EE2-7E46-4DC4-96F9-BFEE50D40659}) (Version: 1.0.408 - Citrix)

    Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.66.16.50 - Conexant)

    Corel Burn.Now Lenovo Edition (HKLM-x32\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - Corel Corporation)

    Corel DVD MovieFactory 7 (x32 Version: 7.0.0 - Corel Corporation) Hidden

    Corel DVD MovieFactory Lenovo Edition (HKLM-x32\...\InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}) (Version: 7.0.0 - Corel Corporation)

    Corel WinDVD (HKLM-x32\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.6.392 - Corel Inc.)

    Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)

    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

    Direct DiscRecorder (x32 Version: 1.00.0000 - Corel Corporation) Hidden

    Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.6.5.1 - Dolby Laboratories Inc)

    Dropbox (HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Dropbox) (Version: 10.4.25 - Dropbox, Inc.)

    Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.15 - Evernote Corp.)

    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 53.0.2785.116 - Google Inc.)

    Google Desktop (HKLM-x32\...\Google Desktop) (Version: 5.9.1005.12335 - Google)

    Google Talk Plugin (HKLM-x32\...\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)

    Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.7619.1252 - Google Inc.)

    Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

    Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden

    GoToMeeting 5.4.0.1082 (HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\GoToMeeting) (Version: 5.4.0.1082 - CitrixOnline)

    HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )

    hppLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) Hidden

    hppP1100P1560P1600SeriesLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) Hidden

    hppusgP1100P1560P1600Series (x32 Version: 1.0.0.1 - Hewlett-Packard) Hidden

    HPSSupply (HKLM-x32\...\{7902E313-FF0F-4493-ACB1-A8147B78DCD0}) (Version: 2.1.1.0000 - Hewlett Packard Development Company L.P.)

    Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel)

    Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

    Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.35342 - Intel Corporation)

    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.4.1441 - Intel Corporation)

    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)

    Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)

    Intel(R) Update Manager (x32 Version: 1.0.0.34813 - Intel Corporation) Hidden

    Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)

    Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)

    IObit Malware Fighter 4 (HKLM-x32\...\IObit Malware Fighter_is1) (Version: 4.2 - IObit)

    IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 5.3.0.142 - IObit)

    Java 8 Update 65 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418065F0}) (Version: 8.0.650.17 - Oracle Corporation)

    Java SE Development Kit 7 Update 7 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170070}) (Version: 1.7.0.70 - Oracle)

    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

    Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 2.11 - )

    Lenovo Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 3.1.12.0 - Lenovo)

    Lenovo Patch Utility (HKLM-x32\...\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}) (Version: 1.3.0.9 - Lenovo Group Limited)

    Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden

    Lenovo Patch Utility 64 bit (HKLM\...\{0369F866-2CE0-4EB9-B426-88FA122C6E82}) (Version: 1.3.0.9 - Lenovo Group Limited)

    Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden

    Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.10.15 - Lenovo)

    Lenovo Registration (HKLM-x32\...\{6707C034-ED6B-4B6A-B21F-969B3606FBDE}) (Version: 1.0.4 - Lenovo Inc.)

    Lenovo SimpleTap (HKLM\...\{BF601122-9F0A-41A9-BA06-3158D9FB4B80}) (Version: 3.2.0004.00 - Lenovo Group Limited)

    Lenovo Solution Center (HKLM\...\{C1FC707B-AE6B-4DC4-89A5-6628A01F8103}) (Version: 3.3.003.00 - Lenovo)

    Lenovo Solutions for Small Business (HKLM-x32\...\{6A6D86CD-B004-46b7-8951-7BB75A776F8C}) (Version: 1.1.27.5565 - Intel(R) Corporation)

    Lenovo Solutions for Small Business Customizations (HKLM-x32\...\{5B5DEF99-85E9-423D-A1A3-B83202697B09}) (Version: 1.0.0006.00 - Lenovo Group Limited)

    Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.07.0032 - Lenovo)

    Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0009.00 - Lenovo Group Limited)

    Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0005.00 - Lenovo)

    Lenovo Welcome (HKLM-x32\...\{2DC26D10-CC6A-494F-BEA3-B5BC21126D5E}) (Version: 3.1.0020.00 - Lenovo Group Limited)

    LiveUpdate 3.3 (Symantec Corporation) (HKLM-x32\...\LiveUpdate) (Version: 3.3.0.102 - Symantec Corporation)

    LogMeIn (HKLM-x32\...\{22461A1C-BD68-4D90-9897-1DB146D55ECB}) (Version: 4.1.2504 - LogMeIn, Inc.)

    LogMeIn Client (HKLM-x32\...\{26F88B15-E5F0-47D2-8176-1A9312DD44AD}) (Version: 1.3.1648 - LogMeIn, Inc.)

    Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)

    MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden

    Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

    Message Center Plus (HKLM\...\{3849486C-FF09-4F5D-B491-3E179D58EE15}) (Version: 3.1.0004.00 - Lenovo Group Limited)

    Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden

    Metric Collection SDK 35 (x32 Version: 1.2.0011.00 - Lenovo Group Limited) Hidden

    Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)

    Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)

    Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

    Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)

    Microsoft Outlook Personal Folders Backup (HKLM-x32\...\{C63E7C60-25EB-11D3-8EDA-00A0C911E8E5}) (Version: 1.10.0.0 - Microsoft Corporation)

    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50709.0 - Microsoft Corporation)

    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

    Nalpeiron License Management (x32 Version: 6.3.9.1 - Nalpeiron) Hidden

    Nitro Pro 7 (HKLM\...\{8E0790DA-185E-4DC1-8A88-750B2A6218FD}) (Version: 7.4.1.4 - Nitro PDF Software)

    On Screen Display (HKLM\...\OnScreenDisplay) (Version: 8.42.20 - )

    Pulse Secure Setup Client (HKU\S-1-5-21-601027151-1453584952-853886390-1000\...\Juniper_Setup_Client) (Version: 8.1.6.61491 - Pulse Secure, LLC)

    Pulse Secure Setup Client 64-bit Activex Control (HKLM\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Pulse Secure, LLC)

    Pulse Secure Setup Client Activex Control (HKLM-x32\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Pulse Secure, LLC)

    Quick Bridge 3.1 (remove only) (HKLM-x32\...\Quick Bridge 3.1) (Version: - )

    RapidBoot HDD Accelerator (HKLM-x32\...\Fastboot) (Version: 1.00.0802 - Lenovo)

    RapidBoot Shield (HKLM\...\{5E2652DF-743F-482B-A593-C95F431A5769}) (Version: 1.23 - Lenovo)

    Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.29092 - Realtek Semiconduct Corp.)

    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.72.410.2013 - Realtek)

    Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.29005 - Realtek Semiconductor Corp.)

    RogueKiller version 12 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12 - Adlice Software)

    SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 3.2.0.543 - Lenovo)

    Smart Defrag 5 (HKLM-x32\...\Smart Defrag_is1) (Version: 5.0.2 - IObit)

    Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)

    SugarSync Manager (HKLM-x32\...\SugarSync) (Version: 1.9.61.90905 - SugarSync, Inc.)

    Superb Game Boost 3.0 (HKLM-x32\...\SuperbGameBoost_is1) (Version: 3.0 - )

    Surfing Protection (HKLM-x32\...\IObit Surfing Protection_is1) (Version: 1.3 - IObit)

    swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

    Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.17.85 - Synaptics Incorporated)

    ThinkPad Wireless LAN Adapter Software (HKLM-x32\...\{9D3D2C60-A55F-4fed-B2B9-17311226DF01}) (Version: 1.00.0031.2 - REALTEK Semiconductor Corp.)

    ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 6.25.65 - Lenovo)

    ThinkVantage Access Connections (HKLM-x32\...\{9C551D9B-5D36-46A2-9414-F658D934B129}) (Version: 5.93 - Lenovo)

    ThinkVantage Active Protection System (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.79.00.03 - Lenovo)

    Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)

    VIP Access (HKLM-x32\...\{E8D46836-CD55-453C-A107-A59EC51CB8DC}) (Version: 2.0.5.13 - VeriSign)

    Vz In-Home Agent (HKLM-x32\...\VzInHomeAgent) (Version: 9.0.73.0 - Verizon)

    Windows Driver Package - Intel (iaStor) hdc (11/29/2011 11.0.0.1032) (HKLM\...\64A62163FE43328D13305746CB8BCC93F2DF6545) (Version: 11/29/2011 11.0.0.1032 - Intel)

    Windows Driver Package - Lenovo 1.65.05.21 (01/11/2012 1.65.05.21) (HKLM\...\FD2ED46D31CE7DF190049D079E92DE03D347A634) (Version: 01/11/2012 1.65.05.21 - Lenovo)

    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)

    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

    WinZip Command Line Support Add-On 3.2 (HKLM-x32\...\WZCLINE) (Version: - WinZip Computing, S.L.)

    Wise Force Deleter 1.23 (HKLM-x32\...\Wise Force Deleter_is1) (Version: 1.23 - WiseCleaner.com, Inc.)


    ==================== Custom CLSID (Whitelisted): ==========================


    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileCoAuth.exe (Microsoft Corporation)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\1082\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)

    CustomCLSID: HKU\S-1-5-21-601027151-1453584952-853886390-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\JLL-NEW THINKPAD\AppData\Roaming\Dropbox\bin\DropboxExt64.43.dll (Dropbox, Inc.)


    ==================== Scheduled Tasks (Whitelisted) =============


    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    Task: {1B6472DC-7357-4751-9560-F38930998CB1} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION

    Task: {1CE74941-AC01-4789-A981-60BAC20C46A0} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe

    Task: {1E4DE038-5D30-4B6E-8BCD-446DBAAACAF8} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2016-04-20] (Lenovo)

    Task: {20B2C720-BAEB-4A9B-9384-062301F6256A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)

    Task: {227F3B0E-0ADB-42B3-A46C-ABEF8F48EF25} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe

    Task: {299106B5-6740-4049-98DC-62DDCFFA2E09} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => Rundll32.exe C:\Windows\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0) "

    Task: {29D9DF5C-A04A-483E-8AAD-38CD0C718719} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000UA => C:\Users\JLL-NEW THINKPAD\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-26] (Dropbox, Inc.)

    Task: {2E24EFA3-EB77-48C7-AF91-73A775E82670} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-07-01] (Lenovo)

    Task: {2EC03F72-4802-4AFD-928C-2F4080BE9BDD} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION

    Task: {313DAD8C-295C-4AFA-9997-C35EFEE63598} - System32\Tasks\WiseCleaner\WFDSkipUAC => C:\Program Files (x86)\Wise\Wise Force Deleter\WiseDeleter.exe [2015-09-11] (WiseCleaner.com)

    Task: {336A28DF-5114-4D0E-A594-C525C516D0A7} - System32\Tasks\{8A92669D-BC98-4135-BE5A-911B8C3C5326} => C:\Users\JLL-NEW THINKPAD\Downloads\DNA Canon LiDE50 x64 Driver\DNA Canon LiDE50 x64 Driver\LAUNCH.EXE [2006-08-03] (Canon)

    Task: {342F1C49-1EBB-44D0-8A6D-D9F170A9FD1C} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe

    Task: {3A2FF5FC-3504-4163-B20D-3E0298321644} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe

    Task: {3E7CE5CA-A498-4BBB-AC48-813206095BB7} - System32\Tasks\SmartDefrag_Update => C:\Program Files (x86)\IObit\Smart Defrag\AutoUpdate.exe [2016-04-18] (IObit)

    Task: {4B0F4B9E-892F-49B9-8775-2F96B075B7F6} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe

    Task: {4D473A4F-3F3D-4303-BA39-C088A3494861} - \Lenovo\SimpleTap\Start SimpleTap for JLL-NEWTHINKPAD.JLL-NEW THINKPAD -> No File <==== ATTENTION

    Task: {4FD8E908-C733-47CD-9FE1-6E756A76088A} - System32\Tasks\{AD384A9D-EEEA-4AC8-AABF-B95CEA8A2F8E} => pcalua.exe -a "C:\Users\JLL-NEW THINKPAD\Downloads\lide60vst6411111a_64en\SetupSG.exe" -d "C:\Users\JLL-NEW THINKPAD\Downloads\lide60vst6411111a_64en "

    Task: {55377D6E-7453-4A51-8D72-4C6A2B9A84D6} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-09-13] (Microsoft Corporation)

    Task: {58465423-F7E1-417A-A704-FF1F9DA4D9C5} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION

    Task: {5A95D58E-347E-4125-99FE-E24CB5256EEA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION

    Task: {5B650CFD-5901-425B-B43F-9CE012D9B771} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION

    Task: {63BB2C79-08BD-4AE2-8055-E9900868EFFE} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe

    Task: {679F222A-A370-4173-B818-3A5DFFE23E3E} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2016-06-02] (Lenovo)

    Task: {69BE74C0-AC9C-47A9-B4A4-A35E70918973} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\JLL-NEW THINKPAD\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe [2016-08-15] (Microsoft Corporation)

    Task: {6C18B9FB-C4B2-4664-9EAE-6F0C1C3536D3} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe

    Task: {6F5D5B84-2FBE-443E-8B08-D2E57218CC47} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe

    Task: {7083F908-7D4E-4700-8633-4F2336C8ACFC} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2016-06-02] (Lenovo)

    Task: {710C1E07-2204-4018-8C81-4BE8789F712B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-08-26] (Piriform Ltd)

    Task: {787F9623-543D-4928-9234-D7B2A54BA046} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2016-06-02] (Lenovo)

    Task: {7937AA97-3A8E-4540-A785-010C9DB4BCEB} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe

    Task: {80438DF2-09A5-4B01-9AE8-EA3FB14A897B} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe

    Task: {85059F11-BC34-4D85-9E48-EFB1060E87FB} - System32\Tasks\{F74BC110-EBF1-4453-8D3C-2C470B71FB94} => pcalua.exe -a "C:\Users\JLL-NEW THINKPAD\Downloads\LiDE30_7030WNENZ\SETUPSG.EXE" -d "C:\Users\JLL-NEW THINKPAD\Downloads\LiDE30_7030WNENZ "

    Task: {8B719BFD-A938-456D-97B9-9864274EFF00} - System32\Tasks\TVT\TVSUUpdateTask_UserLogOn => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2016-07-07] ()

    Task: {8BFCCE25-7169-403B-B94C-02F838E222FC} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION

    Task: {8D7C3DF3-B176-4C6E-8090-4BA93697EC4B} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2016-07-07] ()

    Task: {8DD3E77C-63AD-4B93-92A7-0F0826D8985C} - System32\Tasks\BDAntiCryptoWallTask => C:\Program Files\Bitdefender\Tools\BDAntiRansomware\BDAntiRansomware.exe [2016-05-16] ()

    Task: {8FFCA407-66DE-4EB9-A014-340FE1C660E7} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSC.Services.UpdateStatusService.exe [2016-06-02] ()

    Task: {91866D7B-86B2-4E27-A795-219C988EC9E0} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe

    Task: {995CA820-16A9-480B-9B9F-1B706B38F81F} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2013-05-17] (Lenovo)

    Task: {9A916928-3984-4D55-81E1-64AF8CBEE104} - System32\Tasks\{C6E8124E-92D4-40E5-BA85-4A4101771F4B} => pcalua.exe -a "C:\Users\JLL-NEW THINKPAD\Downloads\deldrvvst6424640ej.exe" -d "C:\Users\JLL-NEW THINKPAD\Downloads "

    Task: {A610B2A0-5A0D-440B-B87A-E93557092073} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)

    Task: {AB373F90-9C5E-47FE-915B-B17E41A39BC3} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe

    Task: {AF54A6EF-DBAF-4357-9103-9DD815C4F6FB} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION

    Task: {B0B805D1-38BE-48D1-AF15-8A8ED75A8955} - System32\Tasks\{AA9B6677-9D98-4EEF-9AD8-A1A9DFCF6D3B} => pcalua.exe -a "C:\Users\JLL-NEW THINKPAD\Downloads\deldrvvst6424640ej (1).exe" -d "C:\Users\JLL-NEW THINKPAD\Downloads "

    Task: {B5FC04CA-EEC8-4E37-9325-BA82FA528EF5} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION

    Task: {B82D07E5-A5B1-484C-9A83-DA0202F6B7FE} - System32\Tasks\Intel(R) Small Business Advantage\Delete Temporary Internet Files => C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\HealthCenter.CleanupTool.exe [2012-11-08] (Intel Corporation)

    Task: {B9FA8972-9000-4644-AA60-0579F4F2CAAF} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe

    Task: {BA7B2291-B947-49E4-A388-51696447F1E0} - \Safer-Networking\Spybot - Search and Destroy\Check for updates -> No File <==== ATTENTION

    Task: {BB0B69F3-C2A3-448C-B5A1-DB0683AD672E} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION

    Task: {BE85F8D1-F1FA-41B7-9265-404CCD68A5B6} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe

    Task: {C019E490-91FF-4A1F-AE84-206F33A75B01} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000UA => C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

    Task: {C0C15E23-6A43-410D-8952-AD50A59E316D} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe

    Task: {C18288D9-416E-4A7D-A955-8970D2BB644F} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe

    Task: {C9FD6C60-7924-4B97-AD7B-B88A9C21BAE5} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe

    Task: {CB2ED866-D21D-428E-97DC-1792DDD8A9A5} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe

    Task: {D45D54AE-5F31-4E5D-9C08-599E2D4A3C92} - System32\Tasks\{FC5BEC96-7DF1-40F0-8859-AB526D8B8297} => C:\Users\JLL-NEW THINKPAD\Downloads\lide60vst6411111a_64en.exe [2012-10-15] ()

    Task: {D60F33F5-C2E0-44A8-AF1D-5A8BD129F9D0} - System32\Tasks\SuperbGameBoost => C:\Program Files (x86)\SuperBoost\Superb Game Boost\SuperbGameBoostMain.exe [2016-05-12] (SuperBoost Software)

    Task: {DADA3C01-F6C6-4094-B709-C4E35C61750C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION

    Task: {E36ECE6C-6C8B-4C1E-9594-036B6DF0CC42} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-09-13] (Adobe Systems Incorporated)

    Task: {E4471D50-3291-4BD9-9CF3-442EC36732F2} - \PMTask -> No File <==== ATTENTION

    Task: {E450C898-470B-49A7-8282-01673BD1D75F} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe

    Task: {E507D3E9-F119-4E92-810A-5836C7B1D227} - System32\Tasks\ASC9_PerformanceMonitor => C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe [2016-05-06] (IObit)

    Task: {E5A5968F-09D6-4365-9E92-DE8CDC0FB1C8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000Core => C:\Users\JLL-NEW THINKPAD\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

    Task: {E681CD05-C262-48B9-8530-783625FFDBAF} - System32\Tasks\ASC9_SkipUac_JLL-NEW THINKPAD => C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe [2016-05-16] (IObit)

    Task: {E88338E9-DA52-459E-B882-DB041611C6E1} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION

    Task: {EEC1E069-E9D0-4DC1-9592-B7F84D0B9214} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-601027151-1453584952-853886390-1000Core => C:\Users\JLL-NEW THINKPAD\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-26] (Dropbox, Inc.)

    Task: {F0A5512B-B36D-44F4-B82C-246AF6D59D2A} - System32\Tasks\Lenovo\LSC\LSCTaskService => c:\program files\Lenovo\lenovo solution center\App\LSCTaskService.exe

    Task: {F110B929-5F6E-43EE-B40C-8BF85C111093} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe

    Task: {F839821F-2CBC-40F1-8E75-1F4E17E01241} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe

    Task: {FCD8B955-D473-4D4F-A110-3BBCA44370CD} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe

    Task: {FEB9FF86-74B3-47ED-A1E5-3C91EB8A574B} - System32\Tasks\DiskUpdate => C:\SWTOOLS\OSFIXES\DISKUPDT\DiskUpdate.exe [2009-02-09] ()


    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
     
    Joe L,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...