Solved Computer freezes when loading certain sites

[Solved] Computer freezes when loading certain sites

Hi, Evan Omo has been helping me with the above thread in the Internet Explorer Section. The problem was kind of solved by adding Ad Block Plus to the IE browser. We both felt that there could still be some malware so Evan suggested I open a thread here.

 

Thanks Evan for pointing to the correct position.

The FRST log Part 1:


Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-03-2016 01
Ran by Colin (administrator) on EMPIRE (16-03-2016 23:08:40)
Running from C:\Users\Colin\Desktop
Loaded Profiles: Colin (Available Profiles: Colin & Julie & Main User)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Creative Technology Ltd) C:\Program Files\Creative\Shared Files\CTAudSvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore.exe
(Amazon Inc.) C:\Program Files\Amazon\Amazon1ButtonApp\Amazon1ButtonService.Exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Allway Sync\Bin\SyncService.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
(Smart Link) C:\Windows\System32\slserv.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(DeskSoft) C:\Program Files\WindowManager\WindowManager.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Dropbox, Inc.) C:\Program Files\Dropbox\Client\Dropbox.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Ruiware) C:\Program Files\Ruiware\WinPatrol\WinPatrol.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Siber Systems) C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(HP) C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Eyeo GmbH) C:\Program Files\Adblock Plus for IE\AdblockPlusEngine.exe
(Dropbox, Inc.) C:\Program Files\Dropbox\Update\DropboxUpdate.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NPSStartup] => [X]
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [986872 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [Dropbox] => C:\Program Files\Dropbox\Client\Dropbox.exe [25577864 2016-03-12] (Dropbox, Inc.)
HKLM\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [54072 2015-10-05] (Malwarebytes)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Run: [WinPatrol] => C:\Program Files\Ruiware\WinPatrol\winpatrol.exe [1216648 2015-07-27] (Ruiware)
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [110376 2016-03-15] (Siber Systems)
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Run: [Microsoft Office Document Cache] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [721504 2015-09-02] (Microsoft Corporation)
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [721504 2015-09-02] (Microsoft Corporation)
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Policies\Explorer: [NoStartMenuMorePrograms] 0
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Policies\Explorer: [ForceRunOnStartMenu] 1
HKU\S-1-5-18\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [110376 2016-03-15] (Siber Systems)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
Startup: C:\Users\Colin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Outlook 2010.lnk [2016-03-16]
ShortcutTarget: Microsoft Outlook 2010.lnk -> C:\Windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\outicon.exe ()
Startup: C:\Users\Colin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowManager.lnk [2016-03-16]
ShortcutTarget: WindowManager.lnk -> C:\Program Files\WindowManager\WindowManager.exe (DeskSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{9242017B-5EBE-49F1-90E3-5C5C77017F87}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bbc.co.uk/news
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://www.google.co.uk/?gws_rd=ssl
SearchScopes: HKLM -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001 -> DefaultScope {75F2D7D1-E886-4156-8FB2-4A4502DA0961} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001 -> {75F2D7D1-E886-4156-8FB2-4A4502DA0961} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: RoboForm Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2016-03-15] (Siber Systems Inc.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_73\bin\ssv.dll [2016-03-16] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-03-16] (Oracle Corporation)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2015-09-22] (Eyeo GmbH)
Toolbar: HKLM - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2016-03-15] (Siber Systems Inc.)
Toolbar: HKU\.DEFAULT -> &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2016-03-15] (Siber Systems Inc.)
Toolbar: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001 -> &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2016-03-15] (Siber Systems Inc.)
Toolbar: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001 -> No Name - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab

FireFox:
========
FF ProfilePath: C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114
FF DefaultSearchEngine: Yahoo!
FF SelectedSearchEngine: Yahoo!
FF Homepage: hxxp://www.bbc.co.uk/news
hxxp://www.windowsbbs.com/
hxxps://www.google.co.uk/
FF Keyword.URL: hxxps://uk.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=888596&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_21_0_0_182.dll [2016-03-15] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2015-10-14] ()
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll [2015-12-29] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll [2015-12-29] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll [2015-12-29] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll [2015-12-29] (Foxit Corporation)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-03-16] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-03-16] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-01-10] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-01-10] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-01-10] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-01-10] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3522.0110 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-01-10] (Microsoft Corporation)
FF Plugin: @nullsoft.com/winampDetector;version=1 -> C:\Program Files\Winamp Detect\npwachk.dll [No File]
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-02-26] (Adobe Systems Inc.)
FF Extension: Double-click To Reload Tab - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\doubleclick2reloadtab@linhph.com.xpi [2015-05-29]
FF Extension: Reload Tab On Double-Click - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{aede9b05-c23c-479b-a90e-9146ed62d377}.xpi [2015-05-29]
FF Extension: Print/Print Preview - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{19EB90DC-A456-458b-8AAC-616D91AAFCE1}.xpi [2015-06-28]
FF Extension: Add-on Update Checker - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{891f0410-aaa2-11e0-9f1c-0800200c9a66}.xpi [2015-10-14]
FF Extension: BetterPrivacy - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2015-11-28]
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} [2016-03-09]
FF Extension: ColorfulTabs - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2016-03-09]
FF Extension: ReloadEvery - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi [2016-03-12]
FF Extension: FEBE - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2016-03-15]
FF Extension: Multirow Bookmarks Toolbar Plus - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi [2016-03-16]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\elemhidehelper@adblockplus.org.xpi [2016-02-17]
FF Extension: British English Dictionary - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\en-GB@dictionaries.addons.mozilla.org [2015-12-18] [not signed]
FF Extension: British English Dictionary (Updated) - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\en-gb@flyingtophat.co.uk [2015-12-16] [not signed]
FF Extension: British English Dictionary (Forked by Marco Pinto) - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\marcoagpinto@mail.telepac.pt [2016-02-29]
FF Extension: The Addon Bar (restored) - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\the-addon-bar@GeekInTraining-GiT.xpi [2016-01-28]
FF Extension: Session Manager - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2016-02-07]
FF Extension: Download Status Bar - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\{6c28e999-e900-4635-a39d-b1ec90ba0c0f}.xpi [2016-03-11]
FF Extension: Adblock Plus - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-03-09]
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-03-04] [not signed]
FF HKLM\...\Firefox\Extensions: [{22119944-ED35-4ab1-910B-E619EA06A115}] - C:\Program Files\Siber Systems\AI RoboForm\Firefox\roboform.xpi
FF Extension: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\Firefox\roboform.xpi [2016-03-15]
FF HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Firefox\Extensions: [{22119944-ED35-4ab1-910B-E619EA06A115}] - C:\Program Files\Siber Systems\AI RoboForm\Firefox\roboform.xpi
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-11-16]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - <no Path\update_url>

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [142648 2014-07-22] (SUPERAntiSpyware.com)
R2 Amazon 1Button App Service; C:\Program Files\Amazon\Amazon1ButtonApp\Amazon1ButtonService.Exe [409376 2016-02-17] (Amazon Inc.)
R2 BotkindSyncService; C:\Program Files\Allway Sync\Bin\SyncService.exe [182784 2015-10-29] () [File not signed]
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2011-07-20] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2010-06-01] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [307200 2008-11-18] (Creative Technology Ltd) [File not signed]
S2 dbupdate; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-03-15] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-03-15] (Dropbox, Inc.)
S2 gupdate1ca22f353ab90dc; C:\Program Files\Google\Update\GoogleUpdate.exe [144200 2015-08-29] (Google Inc.)
R2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [File not signed]
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2016-01-29] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [292816 2016-01-29] (Microsoft Corporation)
R2 SLService; C:\Windows\system32\slserv.exe [73796 2004-01-08] (Smart Link)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S2 BlueSoleilCS; C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [26112 2010-04-29] (Google Inc)
R2 Aspi32; C:\Windows\system32\Drivers\Aspi32.sys [25244 1999-09-10] (Adaptec)
R0 BtHidBus; C:\Windows\System32\Drivers\BtHidBus.sys [20616 2008-07-31] (IVT Corporation.)
S3 btnetBUs; C:\Windows\System32\Drivers\btnetBus.sys [29192 2009-06-17] ()
R0 cfadisk; C:\Windows\System32\DRIVERS\cfadisk.sys [3712 2002-12-24] (Hitachi Global Storage Technologies) [File not signed]
U0 cqvfb; C:\Windows\System32\drivers\ygwwpaxw.sys [52440 2016-03-16] (Malwarebytes)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2016-03-15] (Disc Soft Ltd)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed]
S3 IvtBtBUs; C:\Windows\System32\Drivers\IvtBtBus.sys [26248 2008-07-02] (IVT Corporation.)
S3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-10-05] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [170200 2016-03-16] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-10-05] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [253704 2015-11-13] (Microsoft Corporation)
S3 MREMP50; C:\Program Files\Common Files\Motive\MREMP50.sys [21248 2009-12-07] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MRESP50; C:\Program Files\Common Files\Motive\MRESP50.sys [20096 2009-12-07] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
R3 Mtlmnt5; C:\Windows\System32\DRIVERS\Mtlmnt5.sys [126686 2004-04-01] (Smart Link)
S3 Mtlstrm; C:\Windows\System32\DRIVERS\Mtlstrm.sys [1309184 2004-01-28] (Smart Link)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
S3 NtMtlFax; C:\Windows\System32\DRIVERS\NtMtlFax.sys [180360 2004-01-28] (Smart Link)
R3 P17; C:\Windows\System32\drivers\P17.sys [1168896 2009-10-16] (Creative Technology Ltd.)
S3 PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] (B-phreaks) [File not signed]
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [16472 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [11104 2010-08-16] ()
R0 RecAgent; C:\Windows\System32\DRIVERS\RecAgent.sys [13776 2004-01-13] (Smart Link)
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [86824 2008-10-21] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-10-21] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [114600 2008-10-21] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [108328 2008-10-21] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [26024 2008-10-21] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [104616 2008-10-21] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [109736 2008-10-21] (MCCI Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 Slntamr; C:\Windows\System32\DRIVERS\slntamr.sys [404990 2004-04-01] (Smart Link)
S3 SlNtHal; C:\Windows\System32\DRIVERS\Slnthal.sys [95424 2004-01-28] (Smart Link)
R3 SlWdmSup; C:\Windows\System32\DRIVERS\SlWdmSup.sys [13240 2004-01-28] (Smart Link)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [324152 2016-03-15] (Duplex Secure Ltd.)
R2 STEC3; C:\Windows\system32\STEC3.sys [2368 2010-08-10] (AntiCracking) [File not signed]
S3 BT; system32\DRIVERS\btnetdrv.sys [X]
S3 btaudio; system32\drivers\btaudio.sys [X]
S3 Btcsrusb; System32\Drivers\btcusb.sys [X]
S3 BTKRNL; system32\DRIVERS\btkrnl.sys [X]
S3 cpuz134; \??\C:\Users\Colin\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [X]
S3 RTL2832UBDA; system32\drivers\RTL2832UBDA.sys [X]
S3 RTL2832UUSB; System32\Drivers\RTL2832UUSB.sys [X]
S3 RTL2832U_IRHID; system32\DRIVERS\RTL2832U_IRHID.sys [X]
S3 StarOpen; no ImagePath
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] () [File not signed]
S3 VComm; system32\DRIVERS\VComm.sys [X]
S3 VcommMgr; System32\Drivers\VcommMgr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

The FRST log Part 2:

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-16 23:08 - 2016-03-16 23:09 - 00028009 _____ C:\Users\Colin\Desktop\FRST.txt
2016-03-16 23:08 - 2016-03-16 23:08 - 00000000 ____D C:\FRST
2016-03-16 23:07 - 2016-03-16 23:07 - 01725440 _____ (Farbar) C:\Users\Colin\Desktop\FRST.exe
2016-03-16 22:57 - 2016-03-16 22:57 - 00052440 _____ (Malwarebytes) C:\Windows\system32\Drivers\ygwwpaxw.sys
2016-03-16 22:29 - 2016-03-16 22:29 - 00000000 ____D C:\Program Files\Alex Feinman
2016-03-16 16:14 - 2016-03-16 16:14 - 00000000 ____D C:\Users\Julie\AppData\LocalLow\Adblock Plus for IE
2016-03-16 14:10 - 2016-03-16 14:10 - 00001931 _____ C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk
2016-03-16 14:10 - 2016-03-16 14:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
2016-03-16 13:45 - 2016-03-16 13:51 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WindowManager
2016-03-16 12:26 - 2016-03-16 14:09 - 00000000 ____D C:\Program Files\WinZip
2016-03-16 12:18 - 2016-03-16 12:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2016-03-16 12:18 - 2016-03-16 12:18 - 00000000 ____D C:\Program Files\TomTom HOME 2
2016-03-16 12:17 - 2016-03-16 12:17 - 00000000 ____D C:\Program Files\TomTom International B.V
2016-03-16 11:43 - 2016-03-16 11:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-03-16 11:42 - 2016-03-16 11:48 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-03-16 11:39 - 2016-03-16 11:39 - 00095840 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2016-03-16 11:39 - 2016-03-16 11:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-03-16 11:38 - 2016-03-16 11:38 - 00000000 ____D C:\Program Files\Java
2016-03-16 11:35 - 2016-03-16 11:35 - 00000000 ____D C:\Program Files\ieSpell
2016-03-16 11:29 - 2016-03-16 11:29 - 00000000 ____D C:\Windows\system32\Adobe
2016-03-16 11:27 - 2016-03-16 11:28 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2016-03-16 11:27 - 2016-03-16 11:27 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2016-03-16 11:27 - 2016-03-16 11:27 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2016-03-16 11:07 - 2016-03-16 11:10 - 00000000 ____D C:\Users\Colin\AppData\LocalLow\Adblock Plus for IE
2016-03-16 11:06 - 2016-03-16 11:06 - 00000000 ____D C:\Program Files\Adblock Plus for IE
2016-03-16 09:28 - 2016-03-16 09:26 - 00001865 _____ C:\Users\Colin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-03-16 09:12 - 2016-03-16 09:12 - 00001103 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-03-15 19:36 - 2016-02-02 18:48 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2016-03-15 19:36 - 2016-02-01 19:02 - 00105408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-03-15 19:36 - 2016-02-01 18:49 - 02364928 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-03-15 19:36 - 2016-02-01 18:49 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2016-03-15 19:36 - 2016-02-01 18:49 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2016-03-15 19:36 - 2016-02-01 18:45 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-03-15 19:36 - 2016-02-01 18:44 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-03-15 19:35 - 2016-02-05 18:44 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2016-03-15 19:35 - 2016-02-05 17:33 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\tbs.dll
2016-03-15 19:35 - 2016-01-21 00:51 - 00057280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2016-03-15 19:35 - 2015-06-03 20:22 - 00355456 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2016-03-15 18:39 - 2016-03-15 18:39 - 00000000 ____D C:\Users\Julie\AppData\Local\Dropbox
2016-03-15 18:05 - 2016-03-15 18:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
2016-03-15 18:04 - 2016-03-15 18:04 - 00243128 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2016-03-15 18:04 - 2016-03-15 18:04 - 00000000 ____D C:\Program Files\DAEMON Tools Lite
2016-03-15 16:48 - 2016-03-15 16:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2016-03-15 16:47 - 2016-03-15 16:47 - 00000000 ____D C:\Program Files\iPod
2016-03-15 16:46 - 2016-03-15 16:46 - 00000000 ____D C:\Program Files\Bonjour
2016-03-15 16:32 - 2016-03-15 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2016-03-15 16:32 - 2016-03-15 16:33 - 00000000 ____D C:\Program Files\QuickTime
2016-03-15 16:13 - 2016-01-08 08:51 - 00191200 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2016-03-15 16:13 - 2016-01-08 08:51 - 00099296 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys
2016-03-15 16:06 - 2016-03-15 16:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-03-15 16:03 - 2016-03-16 23:08 - 00000894 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2016-03-15 16:03 - 2016-03-16 21:48 - 00000890 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2016-03-15 16:03 - 2016-03-15 16:06 - 00000000 ____D C:\Program Files\Dropbox
2016-03-15 15:47 - 2016-03-15 15:47 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-03-15 15:47 - 2016-03-15 15:47 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-03-15 14:39 - 2016-03-15 14:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2016-03-15 09:05 - 2016-03-15 09:05 - 00000000 ____D C:\Users\Colin\AppData\Local\{3225C812-5FB8-41CE-B15F-997F80151000}
2016-03-15 08:55 - 2016-03-15 09:28 - 00000000 ____D C:\Program Files\Microsoft Security Client
2016-03-15 08:36 - 2016-03-15 08:40 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2016-03-15 08:04 - 2016-03-16 13:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WindowManager
2016-03-15 08:04 - 2016-03-15 18:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2016-03-15 08:04 - 2016-03-15 16:01 - 00001831 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2016-03-15 08:04 - 2016-03-15 15:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sim AQUARIUM 2
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Show Desktop
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PrimoPDF
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PoiEdit
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoFiltre
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Printer & Scanner
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GetDiz
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BurnAware Free
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Allway Sync
2016-03-15 08:04 - 2013-11-19 14:59 - 00001444 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elevated Command Prompt.lnk
2016-03-15 08:04 - 2011-06-24 19:58 - 00001112 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SB Audigy Audio Manager.lnk
2016-03-15 08:04 - 2010-06-02 09:31 - 00001617 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Realtek Audio Manager.lnk
2016-03-15 02:55 - 2016-03-15 02:55 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Sync App Settings
2016-03-15 00:52 - 2016-03-15 00:52 - 00000020 _____ C:\Windows\ø
2016-03-14 13:27 - 2016-03-14 13:27 - 00002057 _____ C:\Users\Julie\Desktop\Colin's Music.lnk
2016-03-14 13:24 - 2016-03-14 13:24 - 00000817 _____ C:\Users\Julie\Desktop\My Pictures.lnk
2016-03-14 13:23 - 2016-03-14 13:23 - 00000939 _____ C:\Users\Julie\Desktop\My Documents.lnk
2016-03-14 13:23 - 2016-03-14 13:23 - 00000754 _____ C:\Users\Julie\Desktop\Colin's Documents.lnk
2016-03-14 13:22 - 2016-03-14 13:22 - 00003029 _____ C:\Users\Julie\Desktop\Microsoft Outlook 2010.lnk
2016-03-14 13:21 - 2016-03-14 13:21 - 00001296 _____ C:\Users\Julie\Desktop\HP PrecisionScan LTX.lnk
2016-03-14 01:33 - 2016-03-14 01:01 - 00024064 _____ C:\Windows\zoek-delete.exe
2016-03-13 21:54 - 2016-03-13 22:15 - 00000000 ____D C:\Users\Colin\AppData\Roaming\ZHP
2016-03-13 21:30 - 2016-03-13 21:30 - 00290304 _____ (Microsoft Corporation) C:\Windows\system32\subinacl.exe
2016-03-13 21:30 - 2016-03-13 21:30 - 00000000 ____D C:\Program Files\Adware Removal Tool by TSA
2016-03-13 21:08 - 2016-03-13 21:14 - 00000000 ____D C:\Program Files\AdwCleaner
2016-03-13 13:41 - 2016-03-13 13:41 - 00000000 ____D C:\Users\Julie\AppData\Roaming\Foxit Software
2016-03-13 10:26 - 2016-03-15 07:32 - 00002027 _____ C:\Users\Colin\Desktop\My Setup Programs.lnk
2016-03-11 18:05 - 2016-03-11 18:05 - 00000000 ____D C:\Users\Julie\AppData\Local\CEF
2016-03-11 08:30 - 2016-03-11 08:30 - 00000000 ____D C:\ProgramData\Intel
2016-03-11 08:29 - 2016-03-11 08:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel Driver Update Utility
2016-03-10 08:06 - 2016-03-16 09:11 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-03-08 20:25 - 2016-02-11 18:44 - 03994560 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2016-03-08 20:25 - 2016-02-11 18:44 - 03938240 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-03-08 20:25 - 2016-02-11 18:44 - 00138176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-03-08 20:25 - 2016-02-11 18:44 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-03-08 20:25 - 2016-02-11 18:41 - 01310232 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-03-08 20:25 - 2016-02-11 18:38 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-03-08 20:25 - 2016-02-11 18:38 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-03-08 20:25 - 2016-02-11 18:35 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-03-08 20:25 - 2016-02-11 18:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-03-08 20:25 - 2016-02-11 18:35 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-03-08 20:25 - 2016-02-11 18:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-03-08 20:25 - 2016-02-11 18:33 - 01060864 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-03-08 20:25 - 2016-02-11 18:33 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-03-08 20:25 - 2016-02-11 18:31 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-03-08 20:25 - 2016-02-11 18:31 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-03-08 20:25 - 2016-02-11 18:30 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-03-08 20:25 - 2016-02-11 18:30 - 00642560 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-03-08 20:25 - 2016-02-11 18:30 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-03-08 20:25 - 2016-02-11 17:43 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-03-08 20:25 - 2016-02-11 17:37 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-03-08 20:25 - 2016-02-11 17:32 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-03-08 20:25 - 2016-02-11 17:32 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-03-08 20:25 - 2016-02-11 17:32 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-03-08 20:25 - 2016-02-11 17:31 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-03-08 20:25 - 2016-02-11 17:30 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-03-08 20:25 - 2016-02-11 17:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-03-08 20:25 - 2016-02-11 17:30 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-03-08 20:25 - 2016-02-09 09:50 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2016-03-08 20:25 - 2016-02-09 06:10 - 00341200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-03-08 20:25 - 2016-02-08 21:05 - 20352512 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-03-08 20:25 - 2016-02-08 20:51 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-03-08 20:25 - 2016-02-08 20:51 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-03-08 20:25 - 2016-02-08 20:39 - 00496640 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-03-08 20:25 - 2016-02-08 20:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-03-08 20:25 - 2016-02-08 20:38 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-03-08 20:25 - 2016-02-08 20:38 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-03-08 20:25 - 2016-02-08 20:37 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-03-08 20:25 - 2016-02-08 20:34 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-03-08 20:25 - 2016-02-08 20:32 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-03-08 20:25 - 2016-02-08 20:31 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-03-08 20:25 - 2016-02-08 20:30 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-03-08 20:25 - 2016-02-08 20:28 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-03-08 20:25 - 2016-02-08 20:28 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-03-08 20:25 - 2016-02-08 20:28 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-03-08 20:25 - 2016-02-08 20:28 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-03-08 20:25 - 2016-02-08 20:23 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-03-08 20:25 - 2016-02-08 20:20 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-03-08 20:25 - 2016-02-08 20:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-03-08 20:25 - 2016-02-08 20:15 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-03-08 20:25 - 2016-02-08 20:13 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-03-08 20:25 - 2016-02-08 20:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-03-08 20:25 - 2016-02-08 20:11 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-03-08 20:25 - 2016-02-08 20:10 - 04611072 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-03-08 20:25 - 2016-02-08 20:10 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-03-08 20:25 - 2016-02-08 20:03 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-03-08 20:25 - 2016-02-08 20:02 - 13012480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-03-08 20:25 - 2016-02-08 20:02 - 00687104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-03-08 20:25 - 2016-02-08 20:02 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-03-08 20:25 - 2016-02-08 20:01 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-03-08 20:25 - 2016-02-08 20:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-03-08 20:25 - 2016-02-08 19:43 - 02121216 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-03-08 20:25 - 2016-02-08 19:39 - 01311744 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-03-08 20:25 - 2016-02-08 19:38 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-03-08 20:25 - 2016-02-04 18:41 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2016-03-08 20:25 - 2016-02-04 17:46 - 02387456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-03-08 20:25 - 2016-02-03 18:49 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2016-03-08 20:25 - 2016-02-03 18:49 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\olepro32.dll
2016-03-08 20:25 - 2016-02-03 18:43 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-03-08 20:25 - 2016-02-03 17:59 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2016-03-08 20:22 - 2016-02-09 09:51 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2016-03-08 20:22 - 2016-02-09 09:51 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2016-03-08 20:22 - 2016-02-09 09:13 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2016-03-08 20:22 - 2016-02-09 09:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2016-03-08 20:22 - 2016-02-09 09:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2016-03-08 20:22 - 2016-02-05 18:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-03-08 20:22 - 2016-02-05 18:44 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-03-08 20:22 - 2016-02-05 18:42 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-03-08 20:22 - 2016-02-05 17:43 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-03-08 20:22 - 2016-02-05 17:43 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-03-02 14:23 - 2016-02-19 18:50 - 00034240 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-03-02 14:23 - 2016-02-19 18:41 - 00958464 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-03-02 14:23 - 2016-02-19 14:07 - 01206784 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-03-02 14:23 - 2016-02-12 18:39 - 02956288 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-03-02 14:23 - 2016-02-12 18:39 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-03-02 14:23 - 2016-02-12 18:26 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2016-03-02 14:23 - 2016-02-12 18:07 - 02062848 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-03-02 14:23 - 2016-02-12 18:06 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-03-02 14:23 - 2016-02-12 18:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-03-02 14:23 - 2016-02-12 18:05 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-03-02 14:23 - 2016-02-12 18:05 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-03-02 14:23 - 2016-02-12 18:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-03-02 14:23 - 2016-02-12 18:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-03-02 14:23 - 2016-02-12 18:05 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2016-03-02 14:23 - 2016-02-11 14:07 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-03-02 14:23 - 2016-02-05 14:07 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-03-02 14:23 - 2016-02-05 14:07 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-03-02 14:23 - 2016-02-05 14:07 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-02-26 11:22 - 2016-02-26 11:22 - 00000000 ____D C:\Program Files\Amazon
2016-02-26 11:15 - 2016-03-15 02:02 - 00000000 ___HD C:\Users\Colin\.oracle_jre_usage
2016-02-18 13:09 - 2016-01-11 18:54 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2016-02-18 13:09 - 2015-11-19 14:06 - 00922432 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00066400 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00022368 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-16 22:57 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-03-16 22:20 - 2009-08-22 06:53 - 00000886 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-16 22:11 - 2014-03-29 10:46 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-03-16 21:56 - 2009-07-14 04:34 - 00025552 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-16 21:56 - 2009-07-14 04:34 - 00025552 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-16 21:49 - 2014-11-09 10:34 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Dropbox
2016-03-16 21:48 - 2009-08-22 06:53 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-16 21:48 - 2009-07-14 04:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-16 14:10 - 2010-03-31 12:37 - 00000000 ___RD C:\Users\Colin
2016-03-16 14:10 - 2009-08-24 10:14 - 00000000 ____D C:\ProgramData\WinZip
2016-03-16 13:52 - 2010-03-31 12:37 - 00000000 ___RD C:\Users\Julie
2016-03-16 13:52 - 2010-03-31 12:36 - 00000000 ___HD C:\Users\Main User
2016-03-16 13:51 - 2011-03-24 18:35 - 00000000 ____D C:\Program Files\WindowManager
2016-03-16 13:51 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\registration
2016-03-16 11:54 - 2009-09-15 06:51 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2016-03-16 11:40 - 2013-09-15 15:49 - 00000000 ____D C:\ProgramData\Oracle
2016-03-16 11:39 - 2010-05-01 11:06 - 00000000 ____D C:\Users\Colin\AppData\LocalLow\Sun
2016-03-16 11:33 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\system32\NDF
2016-03-16 11:27 - 2009-08-25 19:47 - 00000000 ____D C:\Program Files\Adobe
2016-03-16 11:09 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\ModemLogs
2016-03-16 10:00 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\inf
2016-03-16 09:37 - 2010-04-07 07:01 - 00000000 ____D C:\Windows\system32\Atheros_L1
2016-03-16 09:26 - 2011-06-20 15:01 - 00000000 ____D C:\Program Files\Common Files\Adobe
2016-03-16 09:20 - 2012-04-24 17:36 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-03-16 09:09 - 2009-07-14 04:53 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-03-16 08:00 - 2010-03-31 11:29 - 00000000 ____D C:\Windows\pss
2016-03-15 20:50 - 2012-12-11 21:50 - 00000000 ____D C:\Windows\rescache
2016-03-15 18:29 - 2013-06-21 17:25 - 00000000 ____D C:\Users\Colin\AppData\Local\Samsung
2016-03-15 18:27 - 2010-07-11 19:21 - 00000000 ____D C:\ProgramData\Samsung
2016-03-15 18:26 - 2010-10-22 19:05 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Samsung
2016-03-15 18:25 - 2011-05-13 07:52 - 00000000 ____D C:\Users\Colin\AppData\Local\Downloaded Installations
2016-03-15 18:24 - 2013-06-21 17:12 - 00000000 ____D C:\Program Files\Samsung
2016-03-15 18:24 - 2009-08-22 07:40 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2016-03-15 18:08 - 2010-03-31 13:16 - 00812350 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-15 18:01 - 2015-06-13 08:49 - 00000000 ____D C:\Users\Colin\AppData\Local\Dropbox
2016-03-15 17:18 - 2013-06-30 16:42 - 00000000 ____D C:\Program Files\iTunes
2016-03-15 16:47 - 2014-01-27 17:44 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-03-15 16:25 - 2014-12-22 13:17 - 00002086 _____ C:\Users\Colin\Desktop\Dropbox.lnk
2016-03-15 16:23 - 2009-08-24 18:35 - 00324152 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys
2016-03-15 16:21 - 2011-09-21 17:14 - 00000000 ____D C:\Users\Colin\AppData\Roaming\vlc
2016-03-15 16:05 - 2009-08-27 07:54 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Notepad++
2016-03-15 16:01 - 2012-02-23 08:49 - 00000000 ____D C:\Program Files\CDBurnerXP
2016-03-15 15:42 - 2012-12-03 20:26 - 00000000 ____D C:\Users\Colin\AppData\Local\Adobe
2016-03-15 13:24 - 2009-08-24 13:51 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Applications
2016-03-15 13:24 - 2009-08-22 08:56 - 00000000 ____D C:\Program Files\Nitro PDF
2016-03-15 09:28 - 2010-12-28 09:36 - 00002155 _____ C:\Windows\epplauncher.mif
2016-03-15 08:48 - 2011-05-03 17:21 - 00002629 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ultimate Windows Tweaker.lnk
2016-03-15 08:42 - 2012-09-25 14:48 - 00000000 ____D C:\Program Files\Windows Live
2016-03-15 08:42 - 2010-10-20 07:44 - 00000000 ____D C:\Users\Colin\AppData\Local\Windows Live
2016-03-15 08:39 - 2009-07-14 02:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-03-15 08:10 - 2009-08-22 11:56 - 00000000 ____D C:\ProgramData\TEMP
2016-03-15 07:48 - 2009-08-22 12:56 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Audacity
2016-03-15 02:51 - 2009-08-22 10:01 - 00000000 ____D C:\Program Files\Allway Sync
2016-03-15 00:55 - 2009-12-18 19:11 - 00000000 ____D C:\ProgramData\Nokia
2016-03-15 00:55 - 2009-12-16 19:22 - 00000000 ____D C:\Program Files\Nokia
2016-03-15 00:54 - 2009-12-16 19:22 - 00000000 ____D C:\Program Files\Common Files\Nokia
2016-03-15 00:54 - 2009-08-26 23:02 - 00000000 ____D C:\ProgramData\Installations
2016-03-14 08:53 - 2010-03-31 14:55 - 00000008 __RSH C:\Users\Julie\ntuser.pol
2016-03-14 00:09 - 2009-08-22 11:51 - 00000008 __RSH C:\ProgramData\ntuser.pol
2016-03-13 23:48 - 2010-03-31 13:13 - 00000008 __RSH C:\Users\Colin\ntuser.pol
2016-03-13 23:03 - 2009-07-14 02:37 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2016-03-13 22:22 - 2013-12-02 12:41 - 00000000 ____D C:\ProgramData\HitmanPro
2016-03-13 13:35 - 2013-10-09 14:13 - 00000000 ____D C:\Users\Colin\AppData\Local\ElevatedDiagnostics
2016-03-13 11:46 - 2010-05-01 11:06 - 00000000 ____D C:\Users\Colin\AppData\LocalLow\Adobe
2016-03-11 18:05 - 2013-07-13 09:21 - 00000000 ____D C:\Users\Julie\AppData\Local\Adobe
2016-03-11 08:29 - 2015-06-11 10:17 - 00000000 ____D C:\Program Files\Intel Driver Update Utility
2016-03-10 19:02 - 2010-04-10 15:40 - 00007599 _____ C:\Users\Colin\AppData\Local\resmon.resmoncfg
2016-03-08 20:56 - 2009-07-14 04:33 - 00412456 _____ C:\Windows\system32\FNTCACHE.DAT
2016-03-08 20:40 - 2013-07-09 17:59 - 00000000 ____D C:\Windows\system32\MRT
2016-03-08 20:28 - 2010-04-13 18:49 - 141270216 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-03-07 18:42 - 2014-12-31 11:06 - 00000000 ____D C:\Program Files\BurnAware Free
2016-03-05 08:28 - 2010-01-27 07:19 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2016-03-02 14:23 - 2015-04-12 09:41 - 00000000 ____D C:\Windows\system32\appraiser
2016-02-19 15:35 - 2009-08-25 10:17 - 00000000 ____D C:\Program Files\SpywareBlaster
2016-02-16 11:53 - 2014-06-17 19:20 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Foxit Software
2016-02-16 11:46 - 2009-10-17 12:51 - 00000000 ____D C:\Users\Colin\AppData\Roaming\PrimoPDF

==================== Files in the root of some directories =======

2009-08-22 11:55 - 2014-05-09 11:04 - 0000063 _____ () C:\Users\Colin\AppData\Roaming\AVSDVDPlayer.m3u
2011-03-29 16:19 - 2011-03-29 16:20 - 0000066 _____ () C:\Users\Colin\AppData\Roaming\AVSMediaPlayer.m3u
2014-04-27 19:16 - 2014-04-27 19:16 - 0038423 _____ () C:\Users\Colin\AppData\Roaming\Comma Separated Values (DOS).ADR
2010-02-27 08:31 - 2013-11-26 15:19 - 0038429 _____ () C:\Users\Colin\AppData\Roaming\Comma Separated Values (Windows).ADR
2009-09-09 12:03 - 2009-09-09 12:22 - 0000113 _____ () C:\Users\Colin\AppData\Roaming\default.pls
2009-08-30 20:24 - 2009-10-17 12:47 - 0006900 _____ () C:\Users\Colin\AppData\Roaming\PrimoPDFSet.xml
2011-03-18 20:04 - 2015-03-04 12:15 - 0012800 ___SH () C:\Users\Colin\AppData\Roaming\Thumbs.db
2011-03-13 10:25 - 2011-03-13 10:25 - 0007142 _____ () C:\Users\Colin\AppData\Roaming\UserTile.png
2014-12-31 11:35 - 2014-12-31 11:35 - 0000031 _____ () C:\Users\Colin\AppData\Local\burnaware.ini
2010-04-12 08:50 - 2012-07-05 17:35 - 0046080 _____ () C:\Users\Colin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-04-10 15:40 - 2016-03-10 19:02 - 0007599 _____ () C:\Users\Colin\AppData\Local\resmon.resmoncfg
2010-10-17 15:24 - 2010-10-17 15:52 - 0001356 _____ () C:\ProgramData\hpzinstall.log

Some files in TEMP:
====================
C:\Users\Colin\AppData\Local\Temp\Execute2App.exe
C:\Users\Colin\AppData\Local\Temp\Kies2RemoveAll.exe
C:\Users\Colin\AppData\Local\Temp\msvcp90.dll
C:\Users\Colin\AppData\Local\Temp\msvcr90.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-03-09 10:57

==================== End of FRST.txt ============================

 

The Addition log Part 1:

Additional scan result of Farbar Recovery Scan Tool (x86) Version:05-03-2016 01
Ran by Colin (2016-03-16 23:09:40)
Running from C:\Users\Colin\Desktop
Microsoft Windows 7 Professional Service Pack 1 (X86) (2010-03-31 13:13:29)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Colin (S-1-5-21-2548019330-3924178630-1638020567-1001 - Administrator - Enabled) => C:\Users\Colin
Guest (S-1-5-21-2548019330-3924178630-1638020567-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-2548019330-3924178630-1638020567-1011 - Limited - Enabled)
Julie (S-1-5-21-2548019330-3924178630-1638020567-1003 - Limited - Enabled) => C:\Users\Julie
Main User (S-1-5-21-2548019330-3924178630-1638020567-500 - Administrator - Enabled) => C:\Users\Main User

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adblock Plus for IE (32-bit) (HKLM\...\{E93152F1-E3AE-4B2A-9BAC-F770203F67E5}) (Version: 1.5 - Eyeo GmbH)
Adobe Acrobat Reader DC (HKLM\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.010.20060 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 21.0.0.176 - Adobe Systems Incorporated)
Adobe Flash Player 21 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 21.0.0.182 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 21.0.0.182 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.2 (HKLM\...\Adobe Shockwave Player) (Version: 12.2.4.194 - Adobe Systems, Inc.)
Allway Sync version 15.3.1 (HKLM\...\Allway Sync_is1) (Version: - Botkind Inc)
Apple Application Support (32-bit) (HKLM\...\{7FA9ECCF-A2DE-4DA1-BFF3-81260DBDA68F}) (Version: 4.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{9A629DCB-415D-4A50-85B9-5C2E4F8F74A8}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Arcade Classic Pack 5.10 (HKLM\...\Arcade Classic Pack_is1) (Version: - Arcade Classic Pack)
Atheros Communications Inc.(R) L1 Gigabit Ethernet Driver (HKLM\...\{6E19F210-3813-4002-B561-94D66AA182B6}) (Version: 2.4.7.29 - Atheros Communications Inc.)
Audacity 2.1.0 (HKLM\...\Audacity_is1) (Version: 2.1.0 - Audacity Team)
BBC iPlayer Downloads (HKLM\...\{C3794B09-6C43-4B93-9CA8-F10BECCF2971}) (Version: 1.11.1 - BBC)
Bonjour (HKLM\...\{D168AAD0-6686-47C1-B599-CDD4888B9D1A}) (Version: 3.1.0.1 - Apple Inc.)
BurnAware Free 8.9 (HKLM\...\BurnAware Free_is1) (Version: - Burnaware)
CCleaner (HKLM\...\CCleaner) (Version: 5.15 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.6.6053 - CDBurnerXP)
Creative ALchemy (HKLM\...\ALchemy) (Version: 1.41 - Creative Technology Limited)
Creative Audio Control Panel (HKLM\...\AudioCS) (Version: 2.56 - Creative Technology Limited)
Creative Software AutoUpdate (HKLM\...\Creative Software AutoUpdate) (Version: 1.40 - Creative Technology Limited)
Creative Sound Blaster Properties (HKLM\...\Creative Sound Blaster Properties) (Version: 1.02 - Creative Technology Limited)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Defraggler (HKLM\...\Defraggler) (Version: 2.20 - Piriform)
Dropbox (HKLM\...\Dropbox) (Version: 3.16.1 - Dropbox, Inc.)
Dropbox Update Helper (Version: 1.3.35.1 - Dropbox, Inc.) Hidden
FFmpeg for Audacity on Windows (HKLM\...\FFmpeg for Audacity on Windows_is1) (Version: - )
Foxit PhantomPDF Standard (HKLM\...\{C82148DF-556D-472D-B3F5-5EF85512CDB6}) (Version: 7.2.0.722 - Foxit Software Inc.)
Foxit Reader (HKLM\...\Foxit Reader_is1) (Version: 7.3.0.118 - Foxit Software Inc.)
GetDiz (HKLM\...\GetDiz) (Version: 4.8 - Outertech)
Google Advertising Cookie Opt-out (HKLM\...\{291820D0-A626-40F9-BDFF-8D5CEAB04243}) (Version: 1.0.1.0 - Google Inc)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.29.5 - Google Inc.) Hidden
HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )
HP PrecisionScan LTX (HKLM\...\HP PrecisionScan LTX) (Version: - )
HP Scan-to-Web Wizard (HKLM\...\Scan-To-Web) (Version: - )
hppLaserJetService (Version: 001.001.0.0 - Hewlett-Packard) Hidden
hppP1100P1560P1600SeriesLaserJetService (Version: 001.001.0.0 - Hewlett-Packard) Hidden
hppusgP1100P1560P1600Series (Version: 1.0.0.1 - Hewlett-Packard) Hidden
HPSSupply (HKLM\...\{7902E313-FF0F-4493-ACB1-A8147B78DCD0}) (Version: 2.1.1.0000 - Hewlett Packard Development Company L.P.)
ieSpell (HKLM\...\ieSpell) (Version: 2.6.4 (build 573) - Red Egg Software)
ImgBurn (HKLM\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Intel® Driver Update Utility (HKLM\...\{561b5fb5-1d4d-40e8-b3e4-ad52858b217c}) (Version: 2.4.0.7 - Intel)
Internet TV for Windows Media Center (HKLM\...\{9D318C86-AF4C-409F-A6AC-7183FF4CF424}) (Version: 3.2.0.0 - Microsoft Corporation)
ISO Recorder (HKLM\...\{1235083F-52F9-44CC-9DF5-F9B7802BB9B7}) (Version: 3.0.0 - Alex Feinman)
iTunes (HKLM\...\{2C741651-87E0-4479-9703-6DD0D7988B84}) (Version: 12.3.2.35 - Apple Inc.)
Java 8 Update 73 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218073F0}) (Version: 8.0.730.2 - Oracle Corporation)
Lyrics Plugin for Windows Media Player (HKLM\...\{43002AE2-4093-49E0-A03D-990EE184C568}) (Version: 0.4 - Lyrics Plugin)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office FrontPage 2003 (HKLM\...\{90170409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM\...\{95140000-0081-0409-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Outlook Personal Folders Backup (HKLM\...\{C63E7C60-25EB-11D3-8EDA-00A0C911E8E5}) (Version: 1.10.0.0 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 45.0 (x86 en-GB) (HKLM\...\Mozilla Firefox 45.0 (x86 en-GB)) (Version: 45.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 45.0 - Mozilla)
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
NirSoft ShellExView (HKLM\...\NirSoft ShellExView) (Version: - )
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
PhotoFiltre (HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\PhotoFiltre) (Version: - )
PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
PoiEdit (HKLM\...\PoiEdit) (Version: - )
PrimoPDF -- brought to you by Nitro PDF Software (HKLM\...\PrimoPDF) (Version: 5 - Nitro PDF Software)
QuickTime 7 (HKLM\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5936 - Realtek Semiconductor Corp.)
RoboForm 7-9-18-0 (All Users) (HKLM\...\AI RoboForm) (Version: 7-9-18-0 - Siber Systems)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.16011.2 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.3.16011.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
SeaTools for Windows (HKLM\...\{98613C99-1399-416C-A07C-1EE1C585D872}) (Version: 1.2.0.0 - Seagate Technology)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
ShellExView (HKLM\...\ShellExView) (Version: 1.37 - NirSoft)
Show Desktop (HKLM\...\{A7EC7775-06C1-4394-830D-240367AF93BF}_is1) (Version: 1.1 - Green Point Software LTD)
Sim AQUARIUM 2 (HKLM\...\Sim AQUARIUM 2_is1) (Version: 2.32 - Digital Illusions Software)
SpywareBlaster 5.4 (HKLM\...\SpywareBlaster_is1) (Version: 5.4.0 - BrightFort LLC)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1200 - SUPERAntiSpyware.com)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TomTom HOME (HKLM\...\{5DCB2EB3-87AD-426E-8D74-8B92C9D731C4}) (Version: 2.9.8 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TrueCrypt (HKLM\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
VC 9.0 Runtime (Version: 1.0.0 - Check Point Software Technologies Ltd) Hidden
Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.2 - VideoLAN)
WindowManager (HKLM\...\WindowManager) (Version: 1.6.0 - DeskSoft)
Windows Installer Clean Up (HKLM\...\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}) (Version: 3.00.00.0000 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR 4.00 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
WinZip 12.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}) (Version: 12.0.8252 - WinZip Computing, S.L. )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0785F436-5405-4E7A-A7D2-CB98A7C7E345} - System32\Tasks\{CF582DF5-477F-48C1-B391-72CAA4AD0476} => pcalua.exe -a "C:\Program Files\Windows Installer Clean Up\msicuu.exe" -d C:\Windows\system32
Task: {0876E36C-37CA-457A-B81F-5899542E9BB0} - System32\Tasks\{03A790EC-EC3B-47C5-A031-44046A2C33F1} => C:\Program Files\PhotoFiltre\PhotoFiltre.exe [2012-01-05] (Antonio Da Cruz)
Task: {0FF9FE0E-4B10-4646-A77E-8BAF19DA9C30} - System32\Tasks\{C1B3AE18-E47C-4438-95C1-DB8EE710AF14} => pcalua.exe -a "C:\Users\Colin\Desktop\QRM Plus\QRM Menu Setup.exe" -d "C:\Users\Colin\Desktop\QRM Plus "
Task: {113DC3ED-A3A3-4EC6-80EE-44F579F0FE0B} - System32\Tasks\{69417E0F-05A8-472A-9BE6-DA655783F349} => D:\Colin's Documents\Setup Programs\My Setup Programs\java3d-1_5_1-windows-i586.exe
Task: {1322D0A8-A04A-4BE2-AA0E-7CEE3F974039} - System32\Tasks\{F77CB2F2-7098-40A6-B2AB-903401B44F5D} => msiexec.exe /package "C:\Users\Colin\Desktop\LS_HSI.msi "
Task: {14AB694E-26B2-451E-929F-9D5928DFD910} - System32\Tasks\{7735F762-A23A-43AC-920B-8E9BA03BB1B6} => msiexec.exe /package "C:\Users\Colin\Desktop\LS_HSI.msi "
Task: {175898BE-3031-4037-AAA2-F7A851B76C16} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {19F4148E-F2C4-4960-97DD-7283D90C08D9} - System32\Tasks\{58D99967-91D6-4A2D-82D3-A1AE02E76EE1} => pcalua.exe -a C:\Users\Colin\Desktop\Shockwave_Installer_Full.exe -d C:\Users\Colin\Desktop
Task: {1A154D49-CC14-4E85-AEFB-6A91D481EC64} - System32\Tasks\{DEFF112B-F4E3-4431-AA25-F592A189F635} => pcalua.exe -a C:\Users\Colin\Desktop\allwaysync-9-4-5.exe -d C:\Users\Colin\Desktop
Task: {1A5FD17D-6604-4BA0-AB62-0C2A955C8C30} - System32\Tasks\{8C450E87-935C-49CA-91A0-1A3AEFA01C8D} => D:\Colin's Documents\Setup Programs\My Setup Programs\Your Uninstaller! 2010\yusetup2010.exe
Task: {1A66D327-E00E-4CB8-89A1-CB9D2EFA8F88} - System32\Tasks\{75D7F88B-0161-479E-856F-BF8EAA20C49F} => pcalua.exe -a Z:\WIN2K-XP\Setup.exe -d Z:\WIN2K-XP
Task: {1AFDEFA5-B9D0-4FDA-9780-4055B1EF7473} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-03-15] (Dropbox, Inc.)
Task: {1B87966F-532E-40F3-8792-0E4286CBED40} - System32\Tasks\{2EBD832E-B165-4605-99BE-C3047B9E66E9} => pcalua.exe -a "F:\Program Files\ChromePortable\ChromiumPortable.exe" -d "F:\Program Files\ChromePortable "
Task: {1E18F2E3-6C3C-4F0A-806F-A5949744C193} - System32\Tasks\{4CAF8F24-B038-42A4-B654-BE53B56C8429} => pcalua.exe -a "C:\Program Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files\VS Revo Group\Revo Uninstaller "
Task: {1E338357-6F62-4A1B-8FD0-ACF2EE20287D} - System32\Tasks\{F6A0126B-F95F-4E79-ADB5-D57ED4BD672E} => C:\Program Files\WindowManager\WindowManager.exe [2015-05-27] (DeskSoft)
Task: {229017B1-67AC-4D9C-BA79-13EBB9E46B71} - System32\Tasks\{BB59D284-B2E6-48D6-890E-B0EC78520273} => msiexec.exe /package "Z:\Installation\Data\Redist\LS_HSI.msi "
Task: {2367F253-FA9D-43F3-B715-23407A789144} - System32\Tasks\{AC279307-945D-494C-9298-1794E8B2DF04} => C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
Task: {247DECD3-A859-4FFE-A6F7-3952745EBE20} - System32\Tasks\{1109FBF4-06C0-4231-ACDB-38E9317C2F24} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\AdobeAIRInstaller.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {2794C284-D81D-40D8-B412-6BBCB67D6DB7} - System32\Tasks\{D05477AE-9774-46A2-A99A-6C616B605CF2} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\FreeMPGtoMP4Converter.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {2A2D4E13-EBDF-4E4D-86F1-4E19FCC7DAE9} - System32\Tasks\Run RoboForm TaskBar Icon => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [2016-03-15] (Siber Systems)
Task: {2C7760EC-E445-4A6E-8B84-FD3394CEF2F0} - System32\Tasks\{038C6F08-DEDD-47D3-A9E3-A948F7C6301B} => pcalua.exe -a C:\Users\Colin\Desktop\TweakUiPowertoySetup.exe -d "C:\Program Files\Mozilla Firefox "
Task: {31530688-AE66-4D7D-BE39-C5224B77A4AB} - System32\Tasks\{B32F2BFB-A1B1-4439-ACD9-1B06680AD7E7} => C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe
Task: {31BA5170-5428-442D-81DD-0AEF7794C3E6} - System32\Tasks\{A787AFED-216B-47E0-B790-A8E5EF39F868} => pcalua.exe -a C:\Users\Colin\Desktop\allwaysync-10-0-5.exe -d C:\Users\Colin\Desktop
Task: {330214B5-5750-40A6-A7AA-35688F63BF47} - System32\Tasks\{6F5F16A1-C629-4A4F-995F-6F5715B23A18} => C:\Program Files\WindowManager\WindowManager.exe [2015-05-27] (DeskSoft)
Task: {3512D505-F05C-47FA-A110-3D150ACCFCDB} - System32\Tasks\{07BAB270-CD7C-424D-A9AD-53CBA9AE7A13} => C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
Task: {35633F77-05FA-4AF6-BD78-1FD5404E6410} - System32\Tasks\{C7453ED2-482B-43E3-A8F7-1CB1508FA08D} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Via Rhine II Fast Ethernet Adapter Update\WinSetup.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\Via Rhine II Fast Ethernet Adapter Update "
Task: {380948F5-1E7D-42E7-A345-671172019321} - System32\Tasks\{CA32DA8F-1324-4CA1-85FC-8C3A806F03A1} => pcalua.exe -a "C:\Users\Colin\Desktop\Your Uninstaller! Pro v7.0.2010.30 + Crack-Serials [ChattChitto RG].exe" -d C:\Users\Colin\Desktop
Task: {38CE43F6-EAE3-4D8F-BA63-E8E217D1ACD9} - System32\Tasks\{A014501B-7890-4BBC-B9F1-14682AF975E1} => C:\Users\Colin\Desktop\wlsetup-web.exe
Task: {3D67E7C1-EA0F-4FFE-8346-1947A47A9B63} - System32\Tasks\{D7371013-4CD5-4C06-ACA7-A52E6A67FED2} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\New_PC_Studio_1.5.1.10064_2.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {3EEFF83D-5D7E-4A8E-B13B-2423140B1BEC} - System32\Tasks\{7BD8310F-A417-4F43-8D21-32611D67A872} => C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
Task: {426E0E19-6ABE-4405-80D7-B2801D01FE5D} - System32\Tasks\{B4D2EDA0-BB3E-425B-89BB-E08B7CE83260} => C:\Program Files\AVStoDVD\AVStoDVD.exe
Task: {44BC2BC8-536F-4AAB-8F7A-58623F067D72} - System32\Tasks\WindowManager => C:\Program Files\WindowManager\WindowManager.exe [2015-05-27] (DeskSoft)
Task: {4581988B-6519-4004-8266-31D1C0BACBA0} - System32\Tasks\{AB00ECE6-8515-49E4-AD51-27999B95C0B5} => C:\Program Files\Allway Sync\Bin\syncappw.exe [2015-10-29] ()
Task: {4712879E-F98C-4E9F-B720-16EA77B11FA4} - System32\Tasks\{4DE99E70-2843-490A-90FB-76DCA8A4CF16} => pcalua.exe -a C:\Users\Colin\Desktop\HostsMan_Setup.exe -d C:\Users\Colin\Desktop
Task: {49C966E2-1588-4403-8654-64497ECB3465} - System32\Tasks\{58213922-0F1D-43C7-A16A-91BF42D14F0A} => C:\Program Files\AVStoDVD\AVStoDVD.exe
Task: {4B7245DA-0AC1-4F70-8FC3-A325B6F85F57} - System32\Tasks\{46E09E7C-AB3E-4E80-A1C7-4BCE2C42CDA8} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\msicuu2.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {4B8EA06D-B384-447C-AFFA-34276B5DAB73} - System32\Tasks\{B1D1AD4A-1393-4DB9-ADF2-9AECD403E0D4} => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
Task: {4BD576CB-5AE5-4677-A7E7-1111ECF86F7C} - System32\Tasks\{CF961957-F336-4135-B2BB-3FB436B3FA4D} => C:\Program Files\Allway Sync\Bin\syncappw.exe [2015-10-29] ()
Task: {4BE8B553-EDEB-45CA-AADD-C9E9CB779AF3} - System32\Tasks\{16600099-B373-4554-9634-38091BFA34E6} => C:\Program Files\iTunes\iTunes.exe [2015-12-17] (Apple Inc.)
Task: {4D07FB42-ADC6-4E9D-9E71-FCF0323B02E6} - System32\Tasks\{13A2D928-2422-468F-ACEE-A7A1AB2DABBF} => pcalua.exe -a C:\Users\Colin\Desktop\jxpiinstall.exe -d C:\Users\Colin\Desktop
Task: {4ED5714B-2D7F-41B6-8459-7372200A6122} - System32\Tasks\{2C9AB11F-E0AA-4D38-908F-EAFF6CF4A9CE} => pcalua.exe -a C:\Users\Colin\Desktop\allwaysync-9-4-11.exe -d C:\Users\Colin\Desktop
Task: {4F073F92-F27F-432B-836F-815E12EAA03A} - \Go to RoboForm Install page -> No File <==== ATTENTION
Task: {53E77B5E-2A29-47A5-B831-8A9616ECE6B4} - System32\Tasks\{361C4E9B-9FD3-4470-8F3C-AEF5E4389080} => C:\Users\Colin\Desktop\unlocker1.8.7.exe
Task: {5554DF3F-BABE-42FB-8F14-EB36BDA2C318} - System32\Tasks\{43E25CB6-1222-4B4E-B072-8D2E715EF213} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Firefox Setup 3.5.4.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {568AD41D-E2BA-4044-A295-FD6543FFC266} - System32\Tasks\{B973E61B-0BEB-48D9-95FC-3CFFBE2FC17D} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Nokia_Ovi_Suite_webinstaller_ALL.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {58098784-53B0-480F-8C35-5E20024BC7C3} - System32\Tasks\{07F57205-15C9-4910-8893-A91DF1244221} => pcalua.exe -a C:\Users\Colin\Desktop\HijackThis.exe -d C:\Users\Colin\Desktop
Task: {591A9F0F-9895-433B-9E9C-9F33DA10779B} - System32\Tasks\{AA56F886-276C-439E-9E87-58890798EF2D} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\MP4 Converter\x-mp4-converter-41214.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\MP4 Converter "
Task: {6332D835-0A82-4B4A-A8B5-BEF6016ABB0C} - System32\Tasks\{3C2E3379-5EF6-48C6-90ED-451B7C175D13} => pcalua.exe -a C:\Users\Colin\Desktop\ChromePortable\ChromiumPortable.exe -d C:\Users\Colin\Desktop\ChromePortable
Task: {65194959-FE47-4A88-BA71-62B3BED04C02} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-03-15] (Dropbox, Inc.)
Task: {6D964C7F-3108-46ED-9F7E-EFAFFD6F3A09} - System32\Tasks\{E74F8EE3-7953-43DE-A133-A2B8E134A937} => C:\Program Files\Replay Media Catcher\MediaCatcher.exe
Task: {72544F8A-D916-4906-BFA3-4ECB054846EB} - System32\Tasks\{962A8C29-ED96-4CA9-88F2-7911A521069A} => pcalua.exe -a "C:\Program Files\QuickTime\QTSystem\QuickTime.cpl "
Task: {757F3CEF-D130-4190-95D1-FAF2AFC21D28} - System32\Tasks\{3AAA116C-B562-488E-B248-37CB960B3CEE} => C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe
Task: {78F2F80A-1F87-4716-8068-C2E0DB0AB846} - System32\Tasks\Create Restore Point => C:\Scripts\createrp.vbs [2009-12-21] ()
Task: {7CBC5A8A-95D7-445A-BA95-F29C475CA874} - System32\Tasks\{9888954F-BB61-441D-850D-F240A332DE89} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Downloads\Shockwave_Installer_Slim.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\Downloads "
Task: {7E4C6D9C-C590-458B-86BA-E9D8CD2BC4FC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {7EEF4CFD-A83D-43C9-9BEC-B30C2397BF0B} - System32\Tasks\{57973835-D391-4FF3-9EB3-46BFF7F5F20D} => pcalua.exe -a "C:\Program Files\HighCriteria\TotalRecorder\setup.exe "
Task: {7F2FBF4A-C7C4-45BC-9CF5-063E16F8B776} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-02-12] (Piriform Ltd)
Task: {82F4AD07-4678-4BE8-B16C-3AA2EEEA12FC} - System32\Tasks\{31DC229D-779B-43E4-9B91-03AD122B79C1} => D:\Colin's Documents\Setup Programs\My Setup Programs\daemon4304-lite.exe
Task: {832245DB-1B42-40E0-88E2-47416B0177D1} - System32\Tasks\{0148AA39-E98A-4D5A-892C-53AFC6965379} => Firefox.exe
Task: {8A9EC68A-D864-4AB3-A804-FFCAE0B8EAA2} - System32\Tasks\{65626912-8A8A-48AB-A242-06651FBF3915} => C:\Users\Colin\Desktop\wlsetup-web.exe
Task: {8AE680AC-E30B-4096-BB39-8876A3A58FA7} - System32\Tasks\{83B52E09-77B2-423F-9377-3F124EF3CC16} => pcalua.exe -a C:\Users\Colin\Desktop\avg_free_stb_all_9_40_cnet.exe -d C:\Users\Colin\Desktop
Task: {8B2238F5-6A14-4565-AA8F-809CBF73EFE7} - System32\Tasks\{AD824A97-9169-4721-94FB-3E74D9944DF3} => pcalua.exe -a C:\Users\Colin\Desktop\Shockwave_Installer_Slim.exe -d C:\Users\Colin\Desktop
Task: {90FC20E5-EAE2-45D0-B00D-73CBA47CA8E5} - System32\Tasks\{BC22558C-D204-487E-B6B5-0854EFC88B6B} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\shexview_setup.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {91219BC7-F287-427B-BA45-78CE836DE860} - System32\Tasks\{73963FC1-883D-4E27-B244-CCB383BA03EF} => C:\Program Files\Allway Sync\unins000.exe [2016-03-15] ()
Task: {936A7471-0047-492A-B103-AD4579BF0BF5} - System32\Tasks\{C8DB57B3-5FC0-448A-B5D5-DFCBD18CC492} => pcalua.exe -a "C:\Program Files\ChromePortable\ChromiumPortable.exe" -d "C:\Program Files\ChromePortable "
Task: {9579D07B-2A0F-43DA-AA52-C8E5CB026B50} - System32\Tasks\{F1F863E1-DE47-4FDD-B481-729A74E76F25} => pcalua.exe -a C:\Users\Colin\Desktop\WMSetup.exe -d C:\Users\Colin\Desktop
Task: {975C8E9C-19E4-404C-90C9-2BFD6ADC89AF} - System32\Tasks\{B2AC841B-5294-4A9E-8DB9-A3D286DE2937} => C:\Program Files\GoogleChromePortable\GoogleChromePortable.exe
Task: {9A59471D-F706-450B-9819-18C0FBB096E8} - System32\Tasks\Open URL by RoboForm => Rundll32.exe url.dll,FileProtocolHandler "hxxp://www.roboform.com/test-pass.html?aaa=KICMKMMJLJGMJMHMKJNMCNPMGMJJOJCNLMMJMJLJCNNJNJMJMJCNMMJJPMGMGMJMOMMJLJMMNMOJJNJICMIMCNGMCNOMHMFMOMOMCNPMCNGMJMPMPMFMJMCNOMCNIMJMPMOMCNNMJNPICMOMFMEKMICNJJCKFMOMHMIMLMJNHICMMJBJKJLIMJJNBJCMMLAJDJGJBJJNKJCMJNNICMJNDJCMKJBJJNMJCMOM (the data entry has 47 more characters).
Task: {9C3CB50C-0218-4DC6-9E68-F21D4FE0A065} - System32\Tasks\{9666F58D-7ACE-40A6-B5E5-FD50DDECC94E} => C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
Task: {9D335058-F251-4DD9-88CC-691386864095} - System32\Tasks\{1450E873-B2D5-40B5-973F-367ECEF3F93C} => pcalua.exe -a Z:\AlphaAudio\AlphaPlayer.exe -d Z:\
Task: {9E1849B1-D79D-4241-AE13-AC2DCE72378A} - System32\Tasks\{1216D9F5-3681-4639-BBFC-CEB2FD6C586C} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\MP4 Converter\x-mp4-converter-41214.exe" -d "D:\Colin's Documents\Setup Programs\MP4 Converter "
Task: {9F4EC255-3217-4ABD-8FF5-66CA636C762A} - System32\Tasks\{7CA627C5-F198-464F-8824-F5ED51ED4C4B} => pcalua.exe -a C:\Users\Colin\Desktop\install_flash_player.exe -d C:\Users\Colin\Desktop
Task: {A4E955CA-3D9C-4429-86F6-BE7530EBB7A0} - System32\Tasks\{1EAAF5B0-EDF4-4206-94EF-F3A296464725} => C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe
Task: {A58E6DAC-B6A0-46F6-A385-7483B3F4CB53} - System32\Tasks\{15786B07-B0D7-458C-9958-EE8A4D9141E4} => Firefox.exe
Task: {A7468536-659C-420F-964B-94F8547C7AEA} - System32\Tasks\{02085FF6-07EF-454A-ADF5-D9EB169FD4ED} => pcalua.exe -a "C:\Program Files\DAEMON Tools Lite\uninst.exe" -d "C:\Program Files\DAEMON Tools Lite "
Task: {AAD84284-BFB6-4895-A0EA-6441F7BC95B2} - System32\Tasks\{DCB92CCB-C19D-43E5-B695-6267A9701428} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Intel Programs\ChipUtil.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\Intel Programs "
Task: {B1AA4573-9FA2-4BEC-9364-6248E827F107} - System32\Tasks\{3C0D0CDE-7BEA-4A40-B8E9-ABE96CBC0021} => C:\Program Files\Allway Sync\Bin\syncappw.exe [2015-10-29] ()
Task: {B628FFC1-95D5-4697-9645-63F1F76BEE7B} - System32\Tasks\{B02C575C-DDCE-472D-A69A-19FF0C18DB0B} => C:\Program Files\Replay Media Catcher\MediaCatcher.exe
Task: {B8BFD770-D7AF-465A-991A-2E78E8C7D1B2} - System32\Tasks\{47D3D2EB-03F6-4BDC-A2F9-6575289C74FF} => C:\Program Files\Allway Sync\Bin\syncappw.exe [2015-10-29] ()
Task: {B96492BA-72BC-4B48-944A-52C4C7982223} - System32\Tasks\{EA9A637D-3A9A-4F9B-B11D-35E854134409} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Nokia_PC_Suite_7_1_40_1_eng_web.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {BD2B58A6-7206-4BB1-AEF3-734D34167947} - System32\Tasks\{71889984-AECB-4D60-A053-76A8DF7791B1} => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
Task: {BE512007-E97F-45F1-82A8-70EAD9296AE0} - System32\Tasks\{F70474F5-6EA8-4E43-B154-15B6B8475723} => pcalua.exe -a C:\Users\Colin\Desktop\ComboFix.exe -d C:\Users\Colin\Desktop
Task: {C3F65F76-D8D5-4D5C-AED4-293636CFA7C4} - System32\Tasks\{A4F98B04-B24D-469B-B578-572E947FC5DE} => C:\Program Files\eRightSoft\SUPER\SUPER.exe
Task: {C704FD4C-8E4A-4220-8648-96EAFC3FEB1F} - System32\Tasks\{E1ED794A-7AB3-40DE-ADBA-AF44955CAC62} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Firefox Setup 3.5.3.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {CC194524-49E9-4CBC-B983-C7050A296EA4} - System32\Tasks\{320CF422-4574-45FA-B573-8A5B8191FD8B} => pcalua.exe -a C:\Users\Colin\Desktop\allwaysync-9-3-3.exe -d C:\Users\Colin\Desktop
Task: {CCE275BE-34BC-43FF-A8CF-556582AB14DA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {CD28F11A-E5CA-44AA-B696-DDE78E4247D1} - System32\Tasks\{E3FA109D-7A23-490F-AE3E-A44A2052D452} => C:\Program Files\GoogleChromePortable\GoogleChromePortable.exe
Task: {CF55C46D-CB4A-46BB-B3BF-A1A0B330B151} - System32\Tasks\{18831D3B-C26A-4DBB-8B62-A8F4BFB0005F} => C:\Program Files\AVS4YOU\AVSDVDPlayer\AVSDVDPlayer.exe
Task: {D0BC5511-A62D-447D-9B85-AD53B4225C10} - System32\Tasks\{F4BD35C7-6EAF-42B7-A54D-D2C5FCEF61EE} => C:\Program Files\Frameworkx\Vista Shortcut Manager\FxVisor.exe
Task: {D10A5BE4-8BE4-4E90-A152-93142420EB92} - System32\Tasks\{0CBB86E4-F1BE-4406-8F2F-788B1FCB6618} => pcalua.exe -a C:\Users\Colin\Desktop\SBAXVSD_PCDRV_LB_2_12_0002.exe -d C:\Users\Colin\Desktop
Task: {D1B257D9-181D-4E18-94E5-740A10E969A2} - System32\Tasks\{E52C03B8-8F0B-4B1A-92BC-272D96296EC3} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Adobe Flash Player 10\Firefox\install_flash_player.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\Adobe Flash Player 10\Firefox "
Task: {D5F98697-4F39-41F2-AF54-000C1ED5B037} - System32\Tasks\{1653B29E-9D4D-4FFA-BA80-A22B5E24D43A} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\unlocker1.8.8.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {D635FA3A-332D-47AE-AAAD-A1DC3E6F472F} - System32\Tasks\{19E45342-A564-4D1F-84A0-FD61A1DAA025} => pcalua.exe -a "C:\Users\Colin\Desktop\WMP 11 - setup for Windows 7.exe" -d C:\Users\Colin\Desktop
Task: {D6E59A7D-0DFD-4BA3-AF15-F7820E54374D} - System32\Tasks\Allway Sync_{414CB83C37CFC1ED394642E6448E2DB0} => C:\Program Files\Allway Sync\Bin\syncappw.exe [2015-10-29] ()
Task: {D9728183-F8B9-4DC3-BA43-F6AD228CB185} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2548019330-3924178630-1638020567-500 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {DAC3649B-1BCF-48F4-B6B6-2F3EEDEF0465} - System32\Tasks\{187BE5B6-38E0-4C71-8C23-2D05180CE601} => pcalua.exe -a C:\Users\Colin\Desktop\SUPERsetup.exe -d C:\Users\Colin\Desktop
Task: {DB9F5C64-7907-436F-9AF0-01F77AA13AC2} - System32\Tasks\{2E629B41-7A55-4BA5-A8A9-87480EFDB1E0} => msiexec.exe /package "C:\Users\Colin\Desktop\LS_HSI.msi "
Task: {DE4C1074-A247-4632-A368-BEEBD223B9E4} - System32\Tasks\{B7AF4550-FC7A-4542-8FD4-4E728667C301} => C:\Program Files\PhotoFiltre\PhotoFiltre.exe [2012-01-05] (Antonio Da Cruz)
Task: {DEF65B48-6E30-4CFC-AFB8-51FA0986105C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.)
Task: {DF00EFA4-A614-4466-850B-D637F41FC1A8} - System32\Tasks\{A3919EFB-CBC6-48DE-ACF9-3304D5B5FFC9} => pcalua.exe -a C:\Users\Colin\Desktop\allwaysync-9-4-1.exe -d C:\Users\Colin\Desktop
Task: {E0FF22D4-18F1-43C2-8221-DAB35B28A9D3} - System32\Tasks\{62C8B877-A94F-4C13-8998-DEB495064C5C} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\WMSetup.exe" -d "D:\Colin's Documents\Setup Programs "
Task: {E211AFF6-046E-47EC-9F68-FFD5FEF44FF4} - System32\Tasks\{A95244CF-271A-4867-BFB4-596B1AA076C5} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Portable Applications\Chromium_Portable_2.0.173.13130_MultiLang.paf.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\Portable Applications "
Task: {E2373004-E2A5-4727-A181-9F573379C968} - System32\Tasks\{AEC106E0-B4AC-4C48-8C12-8B4F039556B4} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\DTV Pro\TotalMedia\Setup.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\DTV Pro\TotalMedia "
Task: {E5FB51FD-67A2-4BCE-AF45-448FB60F8C02} - System32\Tasks\CCleaner => C:\Program Files\CCleaner\CCleaner.exe [2016-02-12] (Piriform Ltd)
Task: {E66BD936-11CB-4CDE-8058-3D641DADE382} - System32\Tasks\{94A07836-DE86-4AF3-BE2E-4101F4899B49} => pcalua.exe -a "C:\Program Files\Nokia\Nokia PC Suite 7\ApplicationInstaller.exe" -c "C:\Users\Colin\Desktop\RoboFormS60_3rd.SISX "
Task: {E9E773DB-B9F6-4B98-9004-9CE280225261} - System32\Tasks\{96DBEE80-A36D-403A-9A90-D00536723794} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\QRM Plus\QRM Menu Setup.exe" -d "D:\Colin's Documents\Setup Programs\QRM Plus "
Task: {EAB6B0B6-E537-47FE-AA59-CABCF92A34AC} - System32\Tasks\{EECCEFD5-AC87-431F-BEFD-2F8CB2FF5EC2} => pcalua.exe -a C:\Users\Colin\Desktop\VIA_Rhine_Windows7_V1.12A\x86\WinSetup.exe -d C:\Users\Colin\Desktop\VIA_Rhine_Windows7_V1.12A\x86
Task: {EED7BC18-5A1A-4302-8DE0-0C7DEBCD027B} - System32\Tasks\{1516E6F3-ADD9-4128-9026-352998B49CB8} => C:\Program Files\Unlocker\uninst.exe [2015-04-05] ()
Task: {F2833F21-55D2-49C4-9048-8F0F590D661D} - System32\Tasks\{14ACDC8F-99A1-4B23-8CB2-B46C767AC1C6} => pcalua.exe -a C:\Users\Colin\Desktop\wlsetup-web.exe -d C:\Users\Colin\Desktop
Task: {F46DF289-5A3C-4D4F-8074-F5634D91CFD8} - System32\Tasks\{CCC98C6B-32E2-42FF-BFBE-3FDFBFCA65C7} => C:\Users\Colin\Desktop\MozBackup-1.4.9_EN.exe
Task: {F5D7469D-8C76-425B-BD9A-DBDCB391F2BD} - System32\Tasks\{0B6762F0-14AE-4A37-84AF-6181249028B4} => pcalua.exe -a C:\Users\Colin\Desktop\WMSetup\WMSetup.exe -d C:\Users\Colin\Desktop\WMSetup
Task: {F70708D4-5118-4DC2-9F6C-4B32740FEB51} - System32\Tasks\{F94043AC-B335-411A-BF7D-DC0A7D5B8E86} => pcalua.exe -a Z:\WINME\Setup.exe -d Z:\WINME
Task: {F8CF9CC8-AC21-45BA-A55D-05A6C84DCCAB} - System32\Tasks\{8607D285-E116-4053-9C67-34A2E49A7526} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Shockwave_Installer_Slim.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {FAF5B02E-BA8E-4B4E-80CA-275D5C3CEBF4} - System32\Tasks\{87D991BF-C89F-41F1-9A9D-56B98E4DBDA2} => pcalua.exe -a "C:\Users\Colin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NEHLPQGU\vcredist_x86[1].exe" -d "C:\Program Files\Mozilla Firefox "
Task: {FF62897F-E00B-4404-89E3-D863FF7471F3} - System32\Tasks\{BA006039-566E-4B25-8E76-9BF7732171F2} => C:\Program Files\SIW\siw.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

 

The Addition log Part 2:

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2012-10-10 06:10 - 2012-08-31 14:01 - 00151552 _____ () C:\Windows\System32\HP1100LM.DLL
2009-08-22 09:12 - 2011-02-28 22:37 - 00180624 _____ () C:\Windows\System32\Primomonnt.dll
2010-10-17 15:19 - 2012-08-31 14:01 - 00069632 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\HP1100PP.DLL
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:46 - 2015-10-13 05:46 - 01040144 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-12-14 19:41 - 2015-10-29 12:44 - 00182784 _____ () C:\Program Files\Allway Sync\Bin\SyncService.exe
2016-03-16 13:45 - 2015-05-27 13:43 - 00046592 _____ () C:\Program Files\WindowManager\WindowManager.dll
2009-08-24 10:11 - 2011-03-02 11:40 - 00140288 _____ () C:\Program Files\WinRAR\rarext.dll
2016-03-15 16:06 - 2016-02-23 18:19 - 00034768 _____ () C:\Program Files\Dropbox\Client\_multiprocessing.pyd
2016-03-15 16:06 - 2016-02-23 18:20 - 00019408 _____ () C:\Program Files\Dropbox\Client\faulthandler.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00116688 _____ () C:\Program Files\Dropbox\Client\pywintypes27.dll
2016-03-15 16:06 - 2016-02-23 18:19 - 00093640 _____ () C:\Program Files\Dropbox\Client\_ctypes.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00018376 _____ () C:\Program Files\Dropbox\Client\select.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00019760 _____ () C:\Program Files\Dropbox\Client\tornado.speedups.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00105928 _____ () C:\Program Files\Dropbox\Client\win32api.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00392144 _____ () C:\Program Files\Dropbox\Client\pythoncom27.dll
2016-03-15 16:06 - 2016-03-12 00:18 - 00381752 _____ () C:\Program Files\Dropbox\Client\win32com.shell.shell.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00692688 _____ () C:\Program Files\Dropbox\Client\unicodedata.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020816 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2016-03-15 16:06 - 2016-02-23 18:20 - 00112592 _____ () C:\Program Files\Dropbox\Client\_cffi_backend.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 01682760 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020808 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020800 _____ () C:\Program Files\Dropbox\Client\_cffi_python_x66cf7a7cx17a72769.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00021840 _____ () C:\Program Files\Dropbox\Client\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00038696 _____ () C:\Program Files\Dropbox\Client\fastpath.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00020936 _____ () C:\Program Files\Dropbox\Client\mmapfile.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00024528 _____ () C:\Program Files\Dropbox\Client\win32event.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00114640 _____ () C:\Program Files\Dropbox\Client\win32security.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00124880 _____ () C:\Program Files\Dropbox\Client\win32file.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00021832 _____ () C:\Program Files\Dropbox\Client\_cffi_pywin_kernel32_x64d8f881xc8c369be.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32clipboard.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00175560 _____ () C:\Program Files\Dropbox\Client\win32gui.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00030160 _____ () C:\Program Files\Dropbox\Client\win32pipe.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00043472 _____ () C:\Program Files\Dropbox\Client\win32process.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00028616 _____ () C:\Program Files\Dropbox\Client\win32ts.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00048592 _____ () C:\Program Files\Dropbox\Client\win32service.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00026456 _____ () C:\Program Files\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00057808 _____ () C:\Program Files\Dropbox\Client\win32evtlog.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32profile.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00117056 _____ () C:\Program Files\Dropbox\Client\breakpad.client.windows.handler.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00024392 _____ () C:\Program Files\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00036296 _____ () C:\Program Files\Dropbox\Client\librsync.dll
2016-03-15 16:06 - 2016-03-12 00:18 - 00023376 _____ () C:\Program Files\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00134608 _____ () C:\Program Files\Dropbox\Client\_elementtree.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00134088 _____ () C:\Program Files\Dropbox\Client\pyexpat.pyd
2016-03-15 16:06 - 2016-02-23 18:20 - 00240584 _____ () C:\Program Files\Dropbox\Client\jpegtran.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00052024 _____ () C:\Program Files\Dropbox\Client\psutil._psutil_windows.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020800 _____ () C:\Program Files\Dropbox\Client\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00021824 _____ () C:\Program Files\Dropbox\Client\winffi.kernel32._winffi_kernel32.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00019776 _____ () C:\Program Files\Dropbox\Client\winffi.winerror._winffi_winerror.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020800 _____ () C:\Program Files\Dropbox\Client\winffi.wininet._winffi_wininet.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020280 _____ () C:\Program Files\Dropbox\Client\cpuid.compiled._cpuid.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00350152 _____ () C:\Program Files\Dropbox\Client\winxpgui.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00022352 _____ () C:\Program Files\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00084792 _____ () C:\Program Files\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-03-15 16:06 - 2016-03-12 00:18 - 01826096 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtCore.pyd
2016-03-15 16:06 - 2016-02-23 18:20 - 00083912 _____ () C:\Program Files\Dropbox\Client\sip.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 03928880 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWidgets.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 01971504 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtGui.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00531248 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtNetwork.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00132912 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKit.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00223544 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00207672 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00158008 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00042808 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebChannel.pyd
2016-03-15 16:06 - 2016-02-23 18:23 - 00017864 _____ () C:\Program Files\Dropbox\Client\libEGL.dll
2016-03-15 16:06 - 2016-02-23 18:23 - 01631184 _____ () C:\Program Files\Dropbox\Client\libGLESv2.dll
2016-03-15 16:06 - 2016-03-12 00:18 - 00024904 _____ () C:\Program Files\Dropbox\Client\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00546096 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtQuick.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00357680 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtQml.pyd
2016-03-15 16:06 - 2016-02-23 18:25 - 00697304 _____ () C:\Program Files\Dropbox\Client\QtQuick\Controls\qtquickcontrolsplugin.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2015-11-11 02:42 - 2015-11-11 02:42 - 01045672 _____ () C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2010-10-20 15:08 - 2010-10-20 15:08 - 00122720 _____ () C:\Program Files\Microsoft Office\Office14\OUTLCTL.DLL
2012-12-24 06:53 - 2012-12-24 06:53 - 00081920 _____ () C:\Windows\system32\mvusbews.DLL

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51 [298]
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [134]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\amazon.co.uk -> hxxps://amazon.co.uk
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7867 more sites.

IE trusted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\amazon.co.uk -> hxxps://amazon.co.uk
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\1-2005-search.com -> www.1-2005-search.com

There are 12682 more sites.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-07-08 17:20 - 2016-03-15 01:23 - 00000841 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Colin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: Lavasoft Ad-Aware Service => 3
MSCONFIG\Services: NMIndexingService => 3

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [UDP Query User{7120DC0E-2BCC-41F3-9294-4B9CEBB215CC}C:\windows\system32\mmc.exe] => (Allow) C:\windows\system32\mmc.exe
FirewallRules: [TCP Query User{5CB061FD-A0BA-42CB-A4B2-220099759D6A}C:\windows\system32\mmc.exe] => (Allow) C:\windows\system32\mmc.exe
FirewallRules: [{85C0ED59-EEDC-4DE6-92E2-E55C905FCD62}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{E47B67C2-CDE5-4D79-AD67-713D1AB0DC39}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{6E298CB6-390B-464B-97A2-6E60A3C12F47}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{5247BCD2-C4C6-4203-85F2-E65AB4E91C98}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{72E27FE9-5C79-4200-8FB8-E68345DC1E00}] => (Allow) svchost.exe
FirewallRules: [UDP Query User{3507CA9E-D1C6-4999-BD68-9A68F5CC50F6}C:\program files\windows sidebar\sidebar.exe] => (Allow) C:\program files\windows sidebar\sidebar.exe
FirewallRules: [TCP Query User{2F900F9A-F346-4160-BEA2-0D947ED7F997}C:\program files\windows sidebar\sidebar.exe] => (Allow) C:\program files\windows sidebar\sidebar.exe
FirewallRules: [TCP Query User{E7052CD0-8D59-4329-97D7-4C96EE02F42E}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{19A68877-3592-4088-96D1-D2F60D73512D}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{CB70F867-AC97-43CE-8D47-7B43E63B811F}C:\windows\system32\wfs.exe] => (Allow) C:\windows\system32\wfs.exe
FirewallRules: [UDP Query User{41C55738-B45E-4259-AFC2-29E120E14F8B}C:\windows\system32\wfs.exe] => (Allow) C:\windows\system32\wfs.exe
FirewallRules: [TCP Query User{28A3DCEA-88A9-4565-91B1-04FDC35EEF5E}C:\program files\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files\google\google earth\plugin\geplugin.exe
FirewallRules: [UDP Query User{CEE640AB-CA4A-437F-9BCD-45BF79D7ABBC}C:\program files\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files\google\google earth\plugin\geplugin.exe
FirewallRules: [TCP Query User{AF8E9AC6-096C-467D-A0E6-227BD8315E6A}C:\program files\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files\google\google earth\plugin\geplugin.exe
FirewallRules: [UDP Query User{8A9CE77A-A84F-4BFC-896C-6DC2F5D95B60}C:\program files\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files\google\google earth\plugin\geplugin.exe
FirewallRules: [TCP Query User{FECEB3D4-DD95-43E8-AA0A-93AD28F396BC}C:\program files\windows sidebar\sidebar.exe] => (Allow) C:\program files\windows sidebar\sidebar.exe
FirewallRules: [UDP Query User{88F16081-90F8-4941-8CEE-536B1E561877}C:\program files\windows sidebar\sidebar.exe] => (Allow) C:\program files\windows sidebar\sidebar.exe
FirewallRules: [{2D738BC2-6D2F-4DA2-BBDD-C8059807A167}] => (Allow) C:\Windows\System32\muzapp.exe
FirewallRules: [{47C756BE-8786-4FB1-9905-7D95AC378194}] => (Allow) C:\Windows\System32\muzapp.exe
FirewallRules: [{1CD8B5CB-55A6-49A3-B594-D130FF2C3D6C}] => (Allow) LPort=7878
FirewallRules: [{D3CBAFF4-7859-4811-AF32-1814FBE1AC74}] => (Allow) LPort=20102
FirewallRules: [{7FE84580-E774-4A8E-A547-76FFA7AA01C6}] => (Allow) LPort=1900
FirewallRules: [{6480EC6E-ED4E-4684-99BC-78FD31715FB1}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{5B33FFD9-1C09-48FA-86B4-56034D239E5E}] => (Allow) C:\Program Files\Dropbox\Client\Dropbox.exe
FirewallRules: [{495E253D-E08A-4CDD-B87C-8B8A7560B1E9}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9EA88028-3C22-4B64-A79A-1F1EB58D5256}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2B956730-D7C5-45A4-A0DD-7E73EE251D20}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{BEF12B22-DB00-458B-B42B-475E09241B80}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{176029A3-0C27-4E37-BDFF-D9A3C6F5C04F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Restore Points =========================

16-03-2016 09:36:46 Installed Atheros Communications Inc.(R) L1 Gigabit Ethernet DriíPM
16-03-2016 11:06:32 Installed Adblock Plus for IE (32-bit)
16-03-2016 11:42:03 Windows Update
16-03-2016 11:45:45 Windows Update
16-03-2016 11:54:05 Installed Microsoft SQL Server 2005 Compact Edition [ENU]
16-03-2016 12:02:43 Installed Microsoft SQL Server Compact 3.5 SP2 ENU
16-03-2016 12:17:35 Installed TomTom HOME.
16-03-2016 12:26:31 Installed WinZip 12.0
16-03-2016 13:49:44 Restore Operation
16-03-2016 14:08:47 Installed WinZip 12.0
16-03-2016 22:23:46 Removed ISO Recorder
16-03-2016 22:27:22 Removed ISO Recorder
16-03-2016 22:29:31 Installed ISO Recorder

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/16/2016 11:09:23 AM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: The index cannot be initialized.

Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (03/16/2016 11:09:23 AM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: The application cannot be initialized.

Context: Windows Application

Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (03/16/2016 11:09:23 AM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: The gatherer object cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (03/16/2016 11:09:23 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: The plug-in in <Search.TripoliIndexer> cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
Element not found. (HRESULT : 0x80070490) (0x80070490)

Error: (03/16/2016 11:09:22 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: The plug-in in <Search.JetPropStore> cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (03/16/2016 11:09:22 AM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: The Windows Search Service cannot load the property store information.

Context: Windows Application, SystemIndex Catalog

Details:
The content index database is corrupt. (HRESULT : 0xc0041800) (0xc0041800)

Error: (03/16/2016 11:09:22 AM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: The Windows Search Service is being stopped because there is a problem with the indexer: The catalog is corrupt.

Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (03/16/2016 11:09:22 AM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: The search service has detected corrupted data files in the index {id=4700}. The service will attempt to automatically correct this problem by rebuilding the index.

Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error: (03/16/2016 11:09:22 AM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: The Windows Search Service cannot open the Jet property store.

Details:
0x%08x (0xc0041800 - The content index database is corrupt. (HRESULT : 0xc0041800))

Error: (03/16/2016 11:09:22 AM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows (3456) Windows: Error -1811 occurred while opening logfile C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001DD.log.


System errors:
=============
Error: (03/16/2016 09:48:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The BlueSoleilCS service failed to start due to the following error:
%%2

Error: (03/16/2016 09:48:29 PM) (Source: NETLOGON) (EventID: 3095) (User: )
Description: This computer is configured as a member of a workgroup, not as
a member of a domain. The Netlogon service does not need to run in this
configuration.

Error: (03/16/2016 05:50:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The BlueSoleilCS service failed to start due to the following error:
%%2

Error: (03/16/2016 05:50:20 PM) (Source: NETLOGON) (EventID: 3095) (User: )
Description: This computer is configured as a member of a workgroup, not as
a member of a domain. The Netlogon service does not need to run in this
configuration.

Error: (03/16/2016 04:42:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The BlueSoleilCS service failed to start due to the following error:
%%2

Error: (03/16/2016 04:42:21 PM) (Source: NETLOGON) (EventID: 3095) (User: )
Description: This computer is configured as a member of a workgroup, not as
a member of a domain. The Netlogon service does not need to run in this
configuration.

Error: (03/16/2016 03:56:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The BlueSoleilCS service failed to start due to the following error:
%%2

Error: (03/16/2016 03:56:20 PM) (Source: NETLOGON) (EventID: 3095) (User: )
Description: This computer is configured as a member of a workgroup, not as
a member of a domain. The Netlogon service does not need to run in this
configuration.

Error: (03/16/2016 02:20:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The BlueSoleilCS service failed to start due to the following error:
%%2

Error: (03/16/2016 02:20:34 PM) (Source: NETLOGON) (EventID: 3095) (User: )
Description: This computer is configured as a member of a workgroup, not as
a member of a domain. The Netlogon service does not need to run in this
configuration.


==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz
Percentage of memory in use: 59%
Total physical RAM: 2038.24 MB
Available physical RAM: 823.02 MB
Total Virtual: 5095.24 MB
Available Virtual: 3522.79 MB

==================== Drives ================================

Drive c: (Windows 7 Professional) (Fixed) (Total:99.61 GB) (Free:40.1 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:144.53 GB) (Free:58.4 GB) NTFS
Drive e: (Other Data) (Fixed) (Total:221.62 GB) (Free:94.02 GB) NTFS
Drive f: (Data Backup) (Fixed) (Total:152.67 GB) (Free:47.81 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 000D6D5B)
Partition 1: (Active) - (Size=99.6 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=144.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=221.6 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 152.7 GB) (Disk ID: 0D2D0D2C)
Partition 1: (Not Active) - (Size=152.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

 

RogueKiller V12.0.2.0 [Mar 14 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Colin [Administrator]
Started from : C:\Users\Colin\Desktop\RogueKiller.exe
Mode : Delete -- Date : 03/17/2016 00:23:54

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 9 ¤¤¤
[PUM.HomePage] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.bbc.co.uk/news -> Not selected
[PUM.SearchPage] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Not selected
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowControlPanel : 2 -> Not selected
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowDownloads : 0 -> Not selected
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 2 -> Not selected
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 0 -> Not selected
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowSetProgramAccessAndDefaults : 0 -> Not selected
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowUser : 0 -> Not selected
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowVideos : 0 -> Not selected

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 4 ¤¤¤
[Hj.Name][File] C:\Windows\System32\explorer.exe -> Deleted
[Hj.Name][File] C:\Program Files\mbam-chameleon-1.62.1.1000\rundll32.exe -> Deleted
[Hj.Name][File] C:\Program Files\mbam-chameleon-1.62.1.1000\svchost.exe -> Deleted
[Hj.Name][File] C:\Program Files\mbam-chameleon-1.62.1.1000\winlogon.exe -> Deleted

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 7 (Driver: Loaded) ¤¤¤
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_CREATE[0] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_CLOSE[2] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_DEVICE_CONTROL[14] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_INTERNAL_DEVICE_CONTROL[15] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_POWER[22] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_SYSTEM_CONTROL[23] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_PNP[27] : Unknown @ 0xffffffff852571f8

¤¤¤ Web browsers : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] veef56bw.default-1426859717114 : user_pref( "browser.startup.homepage ", "http://www.bbc.co.uk/news|http://www.windowsbbs.com/|https://www.google.co.uk/ "); -> Not selected

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST3500418AS ATA Device +++++
--- User ---
[MBR] 71292a0fd9a530faf683c740bdd5449c
[BSP] 9db2263b49144c2777ca90bdb9855809 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 101999 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 208896000 | Size: 147995 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 511991550 | Size: 226942 MB [Unknown Bootstrap | Unknown Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: Maxtor 6L160P0 ATA Device +++++
--- User ---
[MBR] 012d10f0327c1536ef861b2cb040853d
[BSP] cfdfdda80a7cbc5f3a762114d132c848 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 156332 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

 

RogueKiller (Scan) Log:

RogueKiller V12.0.2.0 [Mar 14 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Colin [Administrator]
Started from : C:\Users\Colin\Desktop\RogueKiller.exe
Mode : Scan -- Date : 03/17/2016 00:18:41

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 9 ¤¤¤
[PUM.HomePage] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.bbc.co.uk/news -> Found
[PUM.SearchPage] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowControlPanel : 2 -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowDownloads : 0 -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 2 -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 0 -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowSetProgramAccessAndDefaults : 0 -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowUser : 0 -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowVideos : 0 -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 4 ¤¤¤
[Hj.Name][File] C:\Windows\System32\explorer.exe -> Found
[Hj.Name][File] C:\Program Files\mbam-chameleon-1.62.1.1000\rundll32.exe -> Found
[Hj.Name][File] C:\Program Files\mbam-chameleon-1.62.1.1000\svchost.exe -> Found
[Hj.Name][File] C:\Program Files\mbam-chameleon-1.62.1.1000\winlogon.exe -> Found

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 7 (Driver: Loaded) ¤¤¤
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_CREATE[0] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_CLOSE[2] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_DEVICE_CONTROL[14] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_INTERNAL_DEVICE_CONTROL[15] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_POWER[22] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_SYSTEM_CONTROL[23] : Unknown @ 0xffffffff852571f8
[IRP:Addr(Hook.IRP)] \Driver\atapi - IRP_MJ_PNP[27] : Unknown @ 0xffffffff852571f8

¤¤¤ Web browsers : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] veef56bw.default-1426859717114 : user_pref( "browser.startup.homepage ", "http://www.bbc.co.uk/news|http://www.windowsbbs.com/|https://www.google.co.uk/ "); -> Found

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST3500418AS ATA Device +++++
--- User ---
[MBR] 71292a0fd9a530faf683c740bdd5449c
[BSP] 9db2263b49144c2777ca90bdb9855809 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 101999 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 208896000 | Size: 147995 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 511991550 | Size: 226942 MB [Unknown Bootstrap | Unknown Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: Maxtor 6L160P0 ATA Device +++++
--- User ---
[MBR] 012d10f0327c1536ef861b2cb040853d
[BSP] cfdfdda80a7cbc5f3a762114d132c848 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 156332 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

 

Malwarebytes Log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 17/03/2016
Scan Time: 00:31
Logfile: Malwarebytes.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.03.16.06
Rootkit Database: v2016.03.12.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Colin

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 429602
Time Elapsed: 36 min, 29 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Deep Rootkit Scan: Enabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.Spigot, C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\prefs.js, Good: (), Bad: (user_pref( "keyword.URL ", "https://uk.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=888596&p= "), Replaced,[1f57d1b7a8f136005838b28f18edb54b]

Physical Sectors: 0
(No malicious items detected)


(end)

 

Adwcleaner Log:

# AdwCleaner v5.102 - Logfile created 17/03/2016 at 01:17:44
# Updated 13/03/2016 by Xplode
# Database : 2016-03-16.1 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x86)
# Username : Colin - EMPIRE
# Running from : C:\Users\Colin\Desktop\Tools\adwcleaner\adwcleaner_5.102.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLL ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


*************************

C:\Program Files\AdwCleaner\AdwCleaner[C1].txt - [5751 bytes] - [13/03/2016 21:14:15]
C:\Program Files\AdwCleaner\AdwCleaner[S1].txt - [5898 bytes] - [13/03/2016 21:09:04]
C:\Program Files\AdwCleaner\AdwCleaner[S2].txt - [808 bytes] - [17/03/2016 01:17:44]

########## EOF - C:\Program Files\AdwCleaner\AdwCleaner[S2].txt - [894 bytes] ##########

 

JRT Log:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.4 (03.14.2016)
Operating System: Windows 7 Professional x86
Ran by Colin (Administrator) on 17/03/2016 at 1:37:32.04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 9

Successfully deleted: C:\Program Files\mozilla firefox\defaults\pref\itms.js (File)
Successfully deleted: C:\Users\Colin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CLD4SSIF (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Colin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DXMEJJ7N (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Colin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L4IEJWGM (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Colin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SA5W7OYJ (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CLD4SSIF (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DXMEJJ7N (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L4IEJWGM (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SA5W7OYJ (Temporary Internet Files Folder)



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 17/03/2016 at 1:38:55.11
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Just to go back to where this all started I uninstalled Ad Block Plus Add on for IE and both browsers open without delay on first attempt. So Evan you were correct that there was something hidden. Broni I await your instructions.

 

ComboFix Log:

ComboFix 16-03-14.01 - Colin 17/03/2016 7:45.1.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.44.1033.18.2038.586 [GMT 0:00]
Running from: c:\users\Colin\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
SP: Microsoft Security Essentials *Disabled/Updated* {CDE0C533-D3CD-62A1-E772-AFADDF863628}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2016-02-17 to 2016-03-17 )))))))))))))))))))))))))))))))
.
.
2016-03-16 23:51 . 2016-03-16 23:51 24688 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2016-03-16 23:50 . 2016-03-17 00:31 -------- d-----w- c:\programdata\RogueKiller
2016-03-16 23:50 . 2016-03-16 23:50 62576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A3C6B1F1-660D-40A9-9E56-E367597FDDAF}\offreg.856.dll
2016-03-16 23:08 . 2016-03-16 23:12 -------- d-----w- C:\FRST
2016-03-16 22:29 . 2016-03-16 22:29 -------- d-----w- c:\program files\Alex Feinman
2016-03-16 12:18 . 2016-03-16 12:18 -------- d-----w- c:\program files\TomTom HOME 2
2016-03-16 12:17 . 2016-03-16 12:17 -------- d-----w- c:\program files\TomTom International B.V
2016-03-16 11:44 . 2016-02-18 17:31 9067696 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A3C6B1F1-660D-40A9-9E56-E367597FDDAF}\mpengine.dll
2016-03-16 11:42 . 2016-03-16 11:48 -------- d-----w- c:\program files\Microsoft Silverlight
2016-03-16 11:39 . 2016-03-16 11:39 95840 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2016-03-16 11:38 . 2016-03-16 11:38 -------- d-----w- c:\program files\Java
2016-03-16 11:35 . 2016-03-16 11:35 -------- d-----w- c:\program files\ieSpell
2016-03-16 11:29 . 2016-03-16 11:29 -------- d-----w- c:\windows\system32\Adobe
2016-03-16 11:27 . 2016-03-16 11:28 -------- d-----w- c:\program files\Common Files\Adobe AIR
2016-03-15 19:37 . 2016-02-18 17:31 9067696 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2016-03-15 19:36 . 2016-02-02 18:48 376320 ----a-w- c:\windows\system32\rpcss.dll
2016-03-15 19:36 . 2016-02-01 19:02 105408 ----a-w- c:\windows\system32\consent.exe
2016-03-15 19:36 . 2016-02-01 18:49 2364928 ----a-w- c:\windows\system32\msi.dll
2016-03-15 19:36 . 2016-02-01 18:45 1805824 ----a-w- c:\windows\system32\authui.dll
2016-03-15 19:36 . 2016-02-01 18:44 47104 ----a-w- c:\windows\system32\appinfo.dll
2016-03-15 19:36 . 2016-02-01 18:49 337408 ----a-w- c:\windows\system32\msihnd.dll
2016-03-15 19:36 . 2016-02-01 18:49 25088 ----a-w- c:\windows\system32\msimsg.dll
2016-03-15 19:35 . 2016-01-21 00:51 57280 ----a-w- c:\windows\system32\drivers\disk.sys
2016-03-15 19:35 . 2015-06-03 20:22 257864 ----a-w- c:\windows\system32\wbem\Win32_Tpm.dll
2016-03-15 19:35 . 2016-02-05 17:33 15360 ----a-w- c:\windows\system32\tbs.dll
2016-03-15 19:35 . 2015-06-03 20:22 355456 ----a-w- c:\windows\system32\fveapi.dll
2016-03-15 19:35 . 2016-02-05 18:44 97792 ----a-w- c:\windows\system32\fveapibase.dll
2016-03-15 18:39 . 2016-03-15 18:39 -------- d-----w- c:\users\Julie\AppData\Local\Dropbox
2016-03-15 18:04 . 2016-03-15 18:04 243128 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2016-03-15 18:04 . 2016-03-15 18:04 -------- d-----w- c:\program files\DAEMON Tools Lite
2016-03-15 16:47 . 2016-03-15 16:47 -------- d-----w- c:\program files\iPod
2016-03-15 16:46 . 2016-03-15 16:46 -------- d-----w- c:\program files\Bonjour
2016-03-15 16:32 . 2016-03-15 16:33 -------- d-----w- c:\program files\QuickTime
2016-03-15 16:13 . 2016-01-08 08:51 99296 ----a-w- c:\windows\system32\drivers\ssudbus.sys
2016-03-15 16:13 . 2016-01-08 08:51 191200 ----a-w- c:\windows\system32\drivers\ssudmdm.sys
2016-03-15 16:03 . 2016-03-15 16:06 -------- d-----w- c:\program files\Dropbox
2016-03-15 15:47 . 2016-03-15 15:47 797376 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2016-03-15 15:47 . 2016-03-15 15:47 142528 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2016-03-15 09:05 . 2016-03-15 09:05 -------- d-----w- c:\users\Colin\AppData\Local\{3225C812-5FB8-41CE-B15F-997F80151000}
2016-03-15 08:57 . 2016-03-15 08:57 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6CFCE272-AE26-4839-A569-38BE95140060}\gapaengine.dll
2016-03-15 08:55 . 2016-03-15 09:28 -------- d-----w- c:\program files\Microsoft Security Client
2016-03-15 08:36 . 2016-03-15 08:40 -------- d-----w- c:\program files\Common Files\Windows Live
2016-03-15 02:55 . 2016-03-15 02:55 -------- d-----w- c:\users\Colin\AppData\Roaming\Sync App Settings
2016-03-14 01:33 . 2016-03-14 01:01 24064 ----a-w- c:\windows\zoek-delete.exe
2016-03-14 01:33 . 2016-03-17 07:57 -------- d-----w- c:\users\Colin\AppData\Local\Temp
2016-03-13 21:54 . 2016-03-13 22:15 -------- d-----w- c:\users\Colin\AppData\Roaming\ZHP
2016-03-13 21:30 . 2016-03-13 21:30 290304 ----a-w- c:\windows\system32\subinacl.exe
2016-03-13 21:30 . 2016-03-13 21:30 -------- d-----w- c:\program files\Adware Removal Tool by TSA
2016-03-13 21:08 . 2016-03-17 01:17 -------- d-----w- c:\program files\AdwCleaner
2016-03-13 13:41 . 2016-03-13 13:41 -------- d-----w- c:\users\Julie\AppData\Roaming\Foxit Software
2016-03-11 18:05 . 2016-03-11 18:05 -------- d-----w- c:\users\Julie\AppData\Local\CEF
2016-03-11 08:30 . 2016-03-11 08:30 -------- d-----w- c:\programdata\Intel
2016-03-08 20:22 . 2016-02-05 18:44 26112 ----a-w- c:\windows\system32\lpk.dll
2016-03-08 20:22 . 2016-02-05 18:44 70656 ----a-w- c:\windows\system32\fontsub.dll
2016-03-08 20:22 . 2016-02-05 18:42 10240 ----a-w- c:\windows\system32\dciman32.dll
2016-03-08 20:22 . 2016-02-05 17:43 299520 ----a-w- c:\windows\system32\atmfd.dll
2016-03-08 20:22 . 2016-02-05 17:43 34304 ----a-w- c:\windows\system32\atmlib.dll
2016-03-08 20:22 . 2016-02-09 09:51 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2016-03-08 20:22 . 2016-02-09 09:13 101888 ----a-w- c:\program files\Windows Media Player\wmpconfig.exe
2016-03-08 20:22 . 2016-02-09 09:13 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2016-03-08 20:22 . 2016-02-09 09:13 4096 ----a-w- c:\windows\system32\msdxm.ocx
2016-03-08 20:22 . 2016-02-09 09:13 4096 ----a-w- c:\windows\system32\dxmasf.dll
2016-03-08 20:22 . 2016-02-09 09:13 8192 ----a-w- c:\windows\system32\spwmp.dll
2016-03-08 20:22 . 2016-02-09 09:13 102400 ----a-w- c:\program files\Windows Media Player\wmpshare.exe
2016-02-26 20:43 . 2016-02-26 20:43 225976 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2016-02-26 11:22 . 2016-02-26 11:22 -------- d-----w- c:\program files\Amazon
2016-02-26 11:15 . 2016-03-15 02:02 -------- d--h--w- c:\users\Colin\.oracle_jre_usage
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-03-17 00:30 . 2014-03-29 10:46 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2016-03-15 16:23 . 2009-08-24 18:35 324152 ----a-w- c:\windows\system32\drivers\sptd.sys
2016-02-05 18:42 . 2016-03-15 19:35 8192 ----a-w- c:\windows\system32\drivers\en-US\tpm.sys.mui
2016-01-22 06:06 . 2016-02-10 12:33 169984 ----a-w- c:\windows\system32\winsrv.dll
2016-01-22 06:04 . 2016-02-10 12:33 642048 ----a-w- c:\windows\system32\CPFilters.dll
2016-01-22 06:04 . 2016-02-10 12:33 535040 ----a-w- c:\windows\system32\EncDec.dll
2016-01-22 06:02 . 2016-02-10 12:33 114176 ----a-w- c:\windows\system32\mtxoci.dll
2016-01-22 06:02 . 2016-02-10 12:33 176128 ----a-w- c:\windows\system32\msorcl32.dll
2016-01-22 06:02 . 2016-02-10 12:33 293888 ----a-w- c:\windows\system32\KernelBase.dll
2016-01-22 06:00 . 2016-02-10 12:34 1498624 ----a-w- c:\windows\system32\ExplorerFrame.dll
2016-01-22 05:59 . 2016-02-10 12:33 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 4096 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3584 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-01-22 05:12 . 2016-02-10 12:34 2973184 ----a-w- c:\windows\explorer.exe
2016-01-22 05:01 . 2016-02-10 12:33 271360 ----a-w- c:\windows\system32\conhost.exe
2016-01-22 04:51 . 2016-02-10 12:33 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-01-22 04:51 . 2016-02-10 12:33 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-22 04:51 . 2016-02-10 12:33 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-01-22 04:51 . 2016-02-10 12:33 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-01-16 18:36 . 2016-02-10 12:34 1413632 ----a-w- c:\windows\system32\ole32.dll
2016-01-07 17:35 . 2016-02-10 12:32 116224 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2016-01-06 18:41 . 2016-02-10 12:35 216064 ----a-w- c:\windows\system32\InkEd.dll
2016-01-06 17:56 . 2016-02-10 12:35 19968 ----a-w- c:\windows\system32\jnwmon.dll
2016-01-06 17:56 . 2016-02-10 12:35 22528 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\jnwppr.dll
2015-12-20 18:45 . 2016-02-10 12:32 2745856 ----a-w- c:\windows\system32\rdpcorets.dll
2015-12-20 18:45 . 2016-02-10 12:32 13824 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
2015-12-20 16:16 . 2016-02-10 12:32 221184 ----a-w- c:\windows\system32\rdpudd.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt1]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt1"]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt2]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt2"]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt3]
@= "{FB314EDD-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt3"]
@= "{FB314EDD-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt4]
@= "{FB314EDE-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt4"]
@= "{FB314EDE-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt5]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt5"]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt6]
@= "{FB314EDF-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt6"]
@= "{FB314EDF-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt7]
@= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt7"]
@= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt8]
@= "{FB314EE0-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt8"]
@= "{FB314EE0-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt1]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt1"]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt2]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt2"]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt3]
@= "{FB314EDD-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt3"]
@= "{FB314EDD-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt4]
@= "{FB314EDE-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt4"]
@= "{FB314EDE-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt5]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt5"]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt6]
@= "{FB314EDF-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt6"]
@= "{FB314EDF-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt7]
@= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt7"]
@= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt8]
@= "{FB314EE0-A251-47B7-93E1-CDD82E34AF8B} "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt8"]
@= "{FB314EE0-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2016-03-12 00:16 200000 ----a-w- c:\program files\Dropbox\Client\DropboxExt.34.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol "= "c:\program files\Ruiware\WinPatrol\winpatrol.exe" [2015-07-27 1216648]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"RoboForm "= "c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2016-03-15 110376]
"Microsoft Office Document Cache "= "c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2015-09-02 721504]
"OfficeSyncProcess "= "c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2015-09-02 721504]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2016-01-29 986872]
"Dropbox "= "c:\program files\Dropbox\Client\Dropbox.exe" [2016-03-12 25577864]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2009-10-02 150552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm "= "c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2016-03-15 110376]
.
c:\users\Colin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Outlook 2010.lnk - c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\outicon.exe [2010-9-2 304296]
WindowManager.lnk - c:\program files\WindowManager\WindowManager.exe -MINIMIZE -WAITFORDATAPATH [2016-3-16 274432]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
"DisableCAD "= 1 (0x1)
"PromptOnSecureDesktop "= 0 (0x0)
"EnableLinkedConnections "= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceRunOnStartMenu "= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NokiaMServer "=c:\program files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
.
R2 dbupdate;Dropbox Update Service (dbupdate);c:\program files\Dropbox\Update\DropboxUpdate.exe [2016-03-15 143144]
R2 gupdate1ca22f353ab90dc;Google Update Service (gupdate1ca22f353ab90dc);c:\program files\Google\Update\GoogleUpdate.exe [2015-08-29 144200]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [2010-04-29 26112]
R3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\Drivers\btnetBus.sys [2009-06-17 29192]
R3 cpuz134;cpuz134;c:\users\Colin\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-07-20 79360]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-06-01 79360]
R3 dbupdatem;Dropbox Update Service (dbupdatem);c:\program files\Dropbox\Update\DropboxUpdate.exe [2016-03-15 143144]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2016-01-08 99296]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2009-04-06 13224]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2016-02-08 102912]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\Drivers\IvtBtBus.sys [2008-07-02 26248]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-10-05 51928]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys [2012-12-24 17408]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2015-11-13 104664]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2016-01-29 292816]
R3 PRODIGY;PRODIGY;c:\windows\system32\Drivers\PRODIGY.SYS [2006-08-29 32377]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2010-08-16 16472]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2010-08-16 11104]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\DRIVERS\RTL2832U_IRHID.sys [x]
R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [x]
R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys [x]
R3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\DRIVERS\s0017bus.sys [2008-10-21 86824]
R3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0017mdfl.sys [2008-10-21 15016]
R3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0017mdm.sys [2008-10-21 114600]
R3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0017mgmt.sys [2008-10-21 108328]
R3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\DRIVERS\s0017nd5.sys [2008-10-21 26024]
R3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0017obex.sys [2008-10-21 104616]
R3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\DRIVERS\s0017unic.sys [2008-10-21 109736]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2016-01-08 191200]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2013-10-02 49152]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-18 1343400]
S0 BtHidBus;Bluetooth HID Bus Service;c:\windows\System32\Drivers\BtHidBus.sys [2008-07-31 20616]
S0 cfadisk;CompactFlash Filter Driver;c:\windows\system32\DRIVERS\cfadisk.sys [2002-12-24 3712]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2016-03-15 243128]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2014-07-22 142648]
S2 Amazon 1Button App Service;Amazon 1Button App Service;c:\program files\Amazon\Amazon1ButtonApp\Amazon1ButtonService.Exe [2016-02-17 409376]
S2 BotkindSyncService;Botkind Service;c:\program files\Allway Sync\Bin\SyncService.exe service [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 HP LaserJet Service;HP LaserJet Service;c:\program files\HP\HPLaserJetService\HPLaserJetService.exe [2009-06-24 136704]
S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [2010-04-07 99896]
S2 ss_conn_service;SAMSUNG Mobile Connectivity Service;c:\program files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [2016-01-08 754784]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2015-07-13 93040]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x86.sys [2009-10-13 49152]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-10-05 23256]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - aswFsBlk
*Deregistered* - aswMonFlt
*Deregistered* - aswRdr
*Deregistered* - aswSP
*Deregistered* - aswTdi
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr fdrespub AppIDSvc QWAVE wcncsvc SensrSvc Mcx2Svc
utcsvc REG_MULTI_SZ DiagTrack
.
Contents of the 'Scheduled Tasks' folder
.
2016-03-17 c:\windows\Tasks\DropboxUpdateTaskMachineCore.job
- c:\program files\Dropbox\Update\DropboxUpdate.exe [2016-03-15 16:03]
.
2016-03-17 c:\windows\Tasks\DropboxUpdateTaskMachineUA.job
- c:\program files\Dropbox\Update\DropboxUpdate.exe [2016-03-15 16:03]
.
2016-03-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-22 14:19]
.
2016-03-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-22 14:19]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bbc.co.uk/news
uInternet Settings,ProxyOverride = *.local
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Fill Forms - file://C:/Program Files/Siber Systems/AI RoboForm/RoboFormComFillForms.html
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
IE: RoboForm Options - file://C:/Program Files/Siber Systems/AI RoboForm/RoboFormComOptions.html
IE: Save Forms - file://C:/Program Files/Siber Systems/AI RoboForm/RoboFormComSavePass.html
IE: Show RoboForm Toolbar - file://C:/Program Files/Siber Systems/AI RoboForm/RoboFormComShowToolbar.html
Trusted Zone: amazon.co.uk
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\
FF - prefs.js: browser.search.selectedEngine - Yahoo!
FF - prefs.js: browser.startup.homepage - hxxp://www.bbc.co.uk/news|https://www.google.co.uk/
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-NPSStartup - (no file)
HKLM_ActiveSetup-{981b174d-7733-4e7f-b89d-6545a7c21838} - c:\program files\Amazon\Amazon1ButtonApp\Amazon1ButtonTaskbarApp.exe
AddRemove-{561b5fb5-1d4d-40e8-b3e4-ad52858b217c} - c:\programdata\Package Cache\{561b5fb5-1d4d-40e8-b3e4-ad52858b217c}\Intel Driver Update Utility Installer.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-27_ssconn - c:\program files\Samsung\USB Drivers\27_ssconn\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c1,d9,71,5c,34,66,b9,4d,82,76,df,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c1,d9,71,5c,34,66,b9,4d,82,76,df,\
.
[HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001_Classes\VirtualStore\MACHINE\SOFTWARE\Gabest\Media Player Classic]
@DACL=(02 0000)
"ExePath "= "c:\\Program Files\\K-Lite Codec Pack\\Media Player Classic\\mplayerc.exe "
.
[HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001_Classes\VirtualStore\MACHINE\SOFTWARE\Google\Web Accelerator\1.0\Version\googlewebaccclient.exe]
@DACL=(02 0000)
@= "0.2.70.88-pintail.a "
.
[HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001_Classes\VirtualStore\MACHINE\SOFTWARE\Google\Web Accelerator\1.0\Version\googlewebaccwarden.exe]
@DACL=(02 0000)
@= "0.1.70.88-dogcatcher.a "
.
[HKEY_USERS\S-1-5-21-2548019330-3924178630-1638020567-1001_Classes\VirtualStore\MACHINE\SOFTWARE\InterVideo\Common]
@DACL=(02 0000)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_21_0_0_182_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_21_0_0_182_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker6 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(1328)
c:\program files\WindowManager\WindowManager.dll
.
Completion time: 2016-03-17 08:01:15
ComboFix-quarantined-files.txt 2016-03-17 08:01
.
Pre-Run: 43,901,693,952 bytes free
Post-Run: 43,534,831,616 bytes free
.
- - End Of File - - 89E8E22A8FD144554426B4225EF3BED6
A36C5E4F47E84449FF07ED3517B43A31

 

FRST Second Run Log Part 1:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-03-2016 01
Ran by Colin (administrator) on EMPIRE (17-03-2016 22:49:16)
Running from C:\Users\Colin\Desktop
Loaded Profiles: Colin (Available Profiles: Colin & Julie & Main User)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Creative Technology Ltd) C:\Program Files\Creative\Shared Files\CTAudSvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore.exe
(Amazon Inc.) C:\Program Files\Amazon\Amazon1ButtonApp\Amazon1ButtonService.Exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Allway Sync\Bin\SyncService.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
(Smart Link) C:\Windows\System32\slserv.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(DeskSoft) C:\Program Files\WindowManager\WindowManager.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Dropbox, Inc.) C:\Program Files\Dropbox\Client\Dropbox.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Ruiware) C:\Program Files\Ruiware\WinPatrol\WinPatrol.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Siber Systems) C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(DeskSoft) C:\Program Files\WindowManager\WindowManager.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(HP) C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_21_0_0_182_ActiveX.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [986872 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [Dropbox] => C:\Program Files\Dropbox\Client\Dropbox.exe [25577864 2016-03-12] (Dropbox, Inc.)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Run: [WinPatrol] => C:\Program Files\Ruiware\WinPatrol\winpatrol.exe [1216648 2015-07-27] (Ruiware)
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [110376 2016-03-15] (Siber Systems)
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Run: [Microsoft Office Document Cache] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [721504 2015-09-02] (Microsoft Corporation)
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [721504 2015-09-02] (Microsoft Corporation)
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Policies\Explorer: [ForceRunOnStartMenu] 1
HKU\S-1-5-18\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [110376 2016-03-15] (Siber Systems)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ "DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
Startup: C:\Users\Colin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Outlook 2010.lnk [2016-03-17]
ShortcutTarget: Microsoft Outlook 2010.lnk -> C:\Windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\outicon.exe ()
Startup: C:\Users\Colin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowManager.lnk [2016-03-16]
ShortcutTarget: WindowManager.lnk -> C:\Program Files\WindowManager\WindowManager.exe (DeskSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{9242017B-5EBE-49F1-90E3-5C5C77017F87}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bbc.co.uk/news
HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://www.google.co.uk/?gws_rd=ssl
SearchScopes: HKLM -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001 -> DefaultScope {75F2D7D1-E886-4156-8FB2-4A4502DA0961} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001 -> {75F2D7D1-E886-4156-8FB2-4A4502DA0961} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: RoboForm Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2016-03-15] (Siber Systems Inc.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_73\bin\ssv.dll [2016-03-16] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-03-16] (Oracle Corporation)
Toolbar: HKLM - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2016-03-15] (Siber Systems Inc.)
Toolbar: HKU\.DEFAULT -> &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2016-03-15] (Siber Systems Inc.)
Toolbar: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001 -> &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2016-03-15] (Siber Systems Inc.)
Toolbar: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001 -> No Name - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab

FireFox:
========
FF ProfilePath: C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114
FF DefaultSearchEngine: Yahoo!
FF SelectedSearchEngine: Yahoo!
FF Homepage: hxxp://www.bbc.co.uk/news
hxxps://www.google.co.uk/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_21_0_0_182.dll [2016-03-15] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2015-10-14] ()
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-12-29] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-12-29] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-12-29] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-12-29] (Foxit Corporation)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-03-16] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-03-16] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3522.0110 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @nullsoft.com/winampDetector;version=1 -> C:\Program Files\Winamp Detect\npwachk.dll [No File]
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-21] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-02-26] (Adobe Systems Inc.)
FF Extension: Double-click To Reload Tab - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\doubleclick2reloadtab@linhph.com.xpi [2015-05-29]
FF Extension: Print/Print Preview - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{19EB90DC-A456-458b-8AAC-616D91AAFCE1}.xpi [2015-06-28]
FF Extension: Add-on Update Checker - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{891f0410-aaa2-11e0-9f1c-0800200c9a66}.xpi [2015-10-14]
FF Extension: BetterPrivacy - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2015-11-28]
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} [2016-03-09]
FF Extension: ColorfulTabs - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2016-03-09]
FF Extension: ReloadEvery - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi [2016-03-12]
FF Extension: FEBE - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2016-03-15]
FF Extension: Multirow Bookmarks Toolbar Plus - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\extensions\{4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi [2016-03-16]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\elemhidehelper@adblockplus.org.xpi [2016-02-17]
FF Extension: British English Dictionary - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\en-GB@dictionaries.addons.mozilla.org [2015-12-18] [not signed]
FF Extension: British English Dictionary (Updated) - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\en-gb@flyingtophat.co.uk [2015-12-16] [not signed]
FF Extension: British English Dictionary (Forked by Marco Pinto) - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\marcoagpinto@mail.telepac.pt [2016-02-29]
FF Extension: The Addon Bar (restored) - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\the-addon-bar@GeekInTraining-GiT.xpi [2016-01-28]
FF Extension: Session Manager - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2016-02-07]
FF Extension: Download Status Bar - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\{6c28e999-e900-4635-a39d-b1ec90ba0c0f}.xpi [2016-03-11]
FF Extension: Adblock Plus - C:\Users\Colin\AppData\Roaming\Mozilla\Firefox\Profiles\veef56bw.default-1426859717114\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-03-09]
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-03-04] [not signed]
FF HKLM\...\Firefox\Extensions: [{22119944-ED35-4ab1-910B-E619EA06A115}] - C:\Program Files\Siber Systems\AI RoboForm\Firefox\roboform.xpi
FF Extension: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\Firefox\roboform.xpi [2016-03-15]
FF HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\Firefox\Extensions: [{22119944-ED35-4ab1-910B-E619EA06A115}] - C:\Program Files\Siber Systems\AI RoboForm\Firefox\roboform.xpi

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - <no Path\update_url>

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [142648 2014-07-22] (SUPERAntiSpyware.com)
R2 Amazon 1Button App Service; C:\Program Files\Amazon\Amazon1ButtonApp\Amazon1ButtonService.Exe [409376 2016-02-17] (Amazon Inc.)
R2 BotkindSyncService; C:\Program Files\Allway Sync\Bin\SyncService.exe [182784 2015-10-29] () [File not signed]
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2011-07-20] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2010-06-01] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [307200 2008-11-18] (Creative Technology Ltd) [File not signed]
S2 dbupdate; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-03-15] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-03-15] (Dropbox, Inc.)
S2 gupdate1ca22f353ab90dc; C:\Program Files\Google\Update\GoogleUpdate.exe [144200 2015-08-29] (Google Inc.)
R2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2016-01-29] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [292816 2016-01-29] (Microsoft Corporation)
R2 SLService; C:\Windows\system32\slserv.exe [73796 2004-01-08] (Smart Link)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S2 BlueSoleilCS; C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [26112 2010-04-29] (Google Inc)
R2 Aspi32; C:\Windows\system32\Drivers\Aspi32.sys [25244 1999-09-10] (Adaptec)
R0 BtHidBus; C:\Windows\System32\Drivers\BtHidBus.sys [20616 2008-07-31] (IVT Corporation.)
S3 btnetBUs; C:\Windows\System32\Drivers\btnetBus.sys [29192 2009-06-17] ()
R0 cfadisk; C:\Windows\System32\DRIVERS\cfadisk.sys [3712 2002-12-24] (Hitachi Global Storage Technologies) [File not signed]
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2016-03-15] (Disc Soft Ltd)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed]
S3 IvtBtBUs; C:\Windows\System32\Drivers\IvtBtBus.sys [26248 2008-07-02] (IVT Corporation.)
S3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [253704 2015-11-13] (Microsoft Corporation)
S3 MREMP50; C:\Program Files\Common Files\Motive\MREMP50.sys [21248 2009-12-07] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MRESP50; C:\Program Files\Common Files\Motive\MRESP50.sys [20096 2009-12-07] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
R3 Mtlmnt5; C:\Windows\System32\DRIVERS\Mtlmnt5.sys [126686 2004-04-01] (Smart Link)
S3 Mtlstrm; C:\Windows\System32\DRIVERS\Mtlstrm.sys [1309184 2004-01-28] (Smart Link)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
S3 NtMtlFax; C:\Windows\System32\DRIVERS\NtMtlFax.sys [180360 2004-01-28] (Smart Link)
R3 P17; C:\Windows\System32\drivers\P17.sys [1168896 2009-10-16] (Creative Technology Ltd.)
S3 PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] (B-phreaks) [File not signed]
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [16472 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [11104 2010-08-16] ()
R0 RecAgent; C:\Windows\System32\DRIVERS\RecAgent.sys [13776 2004-01-13] (Smart Link)
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [86824 2008-10-21] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-10-21] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [114600 2008-10-21] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [108328 2008-10-21] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [26024 2008-10-21] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [104616 2008-10-21] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [109736 2008-10-21] (MCCI Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 Slntamr; C:\Windows\System32\DRIVERS\slntamr.sys [404990 2004-04-01] (Smart Link)
S3 SlNtHal; C:\Windows\System32\DRIVERS\Slnthal.sys [95424 2004-01-28] (Smart Link)
R3 SlWdmSup; C:\Windows\System32\DRIVERS\SlWdmSup.sys [13240 2004-01-28] (Smart Link)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [324152 2016-03-15] (Duplex Secure Ltd.)
R2 STEC3; C:\Windows\system32\STEC3.sys [2368 2010-08-10] (AntiCracking) [File not signed]
S3 BT; system32\DRIVERS\btnetdrv.sys [X]
S3 btaudio; system32\drivers\btaudio.sys [X]
S3 Btcsrusb; System32\Drivers\btcusb.sys [X]
S3 BTKRNL; system32\DRIVERS\btkrnl.sys [X]
S3 catchme; \??\C:\Users\Colin\AppData\Local\Temp\catchme.sys [X]
S3 cpuz134; \??\C:\Users\Colin\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [X]
S3 RTL2832UBDA; system32\drivers\RTL2832UBDA.sys [X]
S3 RTL2832UUSB; System32\Drivers\RTL2832UUSB.sys [X]
S3 RTL2832U_IRHID; system32\DRIVERS\RTL2832U_IRHID.sys [X]
S3 StarOpen; no ImagePath
S3 VComm; system32\DRIVERS\VComm.sys [X]
S3 VcommMgr; System32\Drivers\VcommMgr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FRST Second Run Log Part 2:

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-17 22:49 - 2016-03-17 22:49 - 00027556 _____ C:\Users\Colin\Desktop\FRST.txt
2016-03-17 22:21 - 2016-03-17 22:05 - 00003029 _____ C:\Users\Colin\Desktop\Microsoft Outlook 2010.lnk
2016-03-17 19:29 - 2016-03-17 19:29 - 00002024 _____ C:\Users\Colin\Desktop\ComboFix - Shortcut.lnk
2016-03-17 19:29 - 2016-03-17 00:48 - 01610352 _____ (Malwarebytes) C:\Users\Colin\Desktop\JRT.exe
2016-03-17 19:29 - 2016-03-17 00:46 - 01527296 _____ C:\Users\Colin\Desktop\adwcleaner_5.102.exe
2016-03-17 19:29 - 2016-03-16 23:50 - 19587656 _____ C:\Users\Colin\Desktop\RogueKiller.exe
2016-03-17 19:29 - 2016-03-16 23:07 - 01725440 _____ (Farbar) C:\Users\Colin\Desktop\FRST.exe
2016-03-17 17:09 - 2016-03-17 17:09 - 00000000 ____D C:\Users\Colin\AppData\Local\Audacity
2016-03-17 12:45 - 2016-03-17 12:45 - 00000000 ____D C:\Windows\en
2016-03-17 07:44 - 2016-03-17 10:23 - 00000000 ____D C:\Users\Colin\AppData\Local\CrashDumps
2016-03-17 07:41 - 2011-06-26 06:45 - 00256000 _____ C:\Windows\PEV.exe
2016-03-17 07:41 - 2010-11-07 17:20 - 00208896 _____ C:\Windows\MBR.exe
2016-03-17 07:41 - 2009-04-20 04:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-03-17 07:41 - 2000-08-31 00:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-03-17 07:41 - 2000-08-31 00:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-03-17 07:41 - 2000-08-31 00:00 - 00098816 _____ C:\Windows\sed.exe
2016-03-17 07:41 - 2000-08-31 00:00 - 00080412 _____ C:\Windows\grep.exe
2016-03-17 07:41 - 2000-08-31 00:00 - 00068096 _____ C:\Windows\zip.exe
2016-03-17 07:34 - 2016-03-17 08:01 - 00000000 ____D C:\Qoobox
2016-03-17 07:33 - 2016-03-17 07:59 - 00000000 ____D C:\Windows\erdnt
2016-03-16 23:51 - 2016-03-16 23:51 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-03-16 23:08 - 2016-03-17 22:49 - 00000000 ____D C:\FRST
2016-03-16 22:29 - 2016-03-16 22:29 - 00000000 ____D C:\Program Files\Alex Feinman
2016-03-16 16:14 - 2016-03-16 16:14 - 00000000 ____D C:\Users\Julie\AppData\LocalLow\Adblock Plus for IE
2016-03-16 14:10 - 2016-03-16 14:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
2016-03-16 13:45 - 2016-03-16 13:51 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WindowManager
2016-03-16 12:26 - 2016-03-16 14:09 - 00000000 ____D C:\Program Files\WinZip
2016-03-16 12:18 - 2016-03-16 12:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2016-03-16 12:18 - 2016-03-16 12:18 - 00000000 ____D C:\Program Files\TomTom HOME 2
2016-03-16 12:17 - 2016-03-16 12:17 - 00000000 ____D C:\Program Files\TomTom International B.V
2016-03-16 11:43 - 2016-03-16 11:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-03-16 11:42 - 2016-03-16 11:48 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-03-16 11:39 - 2016-03-16 11:39 - 00095840 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2016-03-16 11:39 - 2016-03-16 11:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-03-16 11:38 - 2016-03-16 11:38 - 00000000 ____D C:\Program Files\Java
2016-03-16 11:35 - 2016-03-16 11:35 - 00000000 ____D C:\Program Files\ieSpell
2016-03-16 11:29 - 2016-03-16 11:29 - 00000000 ____D C:\Windows\system32\Adobe
2016-03-16 11:27 - 2016-03-16 11:28 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2016-03-16 11:27 - 2016-03-16 11:27 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2016-03-16 11:27 - 2016-03-16 11:27 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2016-03-16 11:07 - 2016-03-17 01:55 - 00000000 ____D C:\Users\Colin\AppData\LocalLow\Adblock Plus for IE
2016-03-16 09:28 - 2016-03-16 09:26 - 00001865 _____ C:\Users\Colin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-03-16 09:12 - 2016-03-16 09:12 - 00001103 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-03-15 19:36 - 2016-02-02 18:48 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2016-03-15 19:36 - 2016-02-01 19:02 - 00105408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-03-15 19:36 - 2016-02-01 18:49 - 02364928 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-03-15 19:36 - 2016-02-01 18:49 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2016-03-15 19:36 - 2016-02-01 18:49 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2016-03-15 19:36 - 2016-02-01 18:45 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-03-15 19:36 - 2016-02-01 18:44 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-03-15 19:35 - 2016-02-05 18:44 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2016-03-15 19:35 - 2016-02-05 17:33 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\tbs.dll
2016-03-15 19:35 - 2016-01-21 00:51 - 00057280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2016-03-15 19:35 - 2015-06-03 20:22 - 00355456 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2016-03-15 18:39 - 2016-03-15 18:39 - 00000000 ____D C:\Users\Julie\AppData\Local\Dropbox
2016-03-15 18:05 - 2016-03-15 18:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
2016-03-15 18:04 - 2016-03-15 18:04 - 00243128 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2016-03-15 18:04 - 2016-03-15 18:04 - 00000000 ____D C:\Program Files\DAEMON Tools Lite
2016-03-15 16:48 - 2016-03-15 16:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2016-03-15 16:47 - 2016-03-15 16:47 - 00000000 ____D C:\Program Files\iPod
2016-03-15 16:46 - 2016-03-15 16:46 - 00000000 ____D C:\Program Files\Bonjour
2016-03-15 16:32 - 2016-03-17 18:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2016-03-15 16:32 - 2016-03-17 17:36 - 00000000 ____D C:\Program Files\QuickTime
2016-03-15 16:13 - 2016-01-08 08:51 - 00191200 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2016-03-15 16:13 - 2016-01-08 08:51 - 00099296 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys
2016-03-15 16:06 - 2016-03-15 16:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-03-15 16:03 - 2016-03-17 22:17 - 00000890 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2016-03-15 16:03 - 2016-03-17 22:08 - 00000894 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2016-03-15 16:03 - 2016-03-15 16:06 - 00000000 ____D C:\Program Files\Dropbox
2016-03-15 15:47 - 2016-03-15 15:47 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-03-15 15:47 - 2016-03-15 15:47 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-03-15 14:39 - 2016-03-15 14:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2016-03-15 09:05 - 2016-03-15 09:05 - 00000000 ____D C:\Users\Colin\AppData\Local\{3225C812-5FB8-41CE-B15F-997F80151000}
2016-03-15 08:55 - 2016-03-15 09:28 - 00000000 ____D C:\Program Files\Microsoft Security Client
2016-03-15 08:36 - 2016-03-17 12:31 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2016-03-15 08:04 - 2016-03-16 13:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WindowManager
2016-03-15 08:04 - 2016-03-15 18:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2016-03-15 08:04 - 2016-03-15 16:01 - 00001831 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2016-03-15 08:04 - 2016-03-15 15:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sim AQUARIUM 2
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Show Desktop
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PrimoPDF
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PoiEdit
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoFiltre
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Printer & Scanner
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GetDiz
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BurnAware Free
2016-03-15 08:04 - 2016-03-15 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Allway Sync
2016-03-15 08:04 - 2013-11-19 14:59 - 00001444 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elevated Command Prompt.lnk
2016-03-15 08:04 - 2011-06-24 19:58 - 00001112 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SB Audigy Audio Manager.lnk
2016-03-15 08:04 - 2010-06-02 09:31 - 00001617 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Realtek Audio Manager.lnk
2016-03-15 02:55 - 2016-03-15 02:55 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Sync App Settings
2016-03-15 00:52 - 2016-03-15 00:52 - 00000020 _____ C:\Windows\ø
2016-03-14 13:27 - 2016-03-14 13:27 - 00002057 _____ C:\Users\Julie\Desktop\Colin's Music.lnk
2016-03-14 13:24 - 2016-03-14 13:24 - 00000817 _____ C:\Users\Julie\Desktop\My Pictures.lnk
2016-03-14 13:23 - 2016-03-14 13:23 - 00000939 _____ C:\Users\Julie\Desktop\My Documents.lnk
2016-03-14 13:23 - 2016-03-14 13:23 - 00000754 _____ C:\Users\Julie\Desktop\Colin's Documents.lnk
2016-03-14 13:22 - 2016-03-17 22:04 - 00003011 _____ C:\Users\Julie\Desktop\Microsoft Outlook 2010.lnk
2016-03-14 13:21 - 2016-03-14 13:21 - 00001296 _____ C:\Users\Julie\Desktop\HP PrecisionScan LTX.lnk
2016-03-14 01:33 - 2016-03-14 01:01 - 00024064 _____ C:\Windows\zoek-delete.exe
2016-03-13 21:54 - 2016-03-13 22:15 - 00000000 ____D C:\Users\Colin\AppData\Roaming\ZHP
2016-03-13 21:30 - 2016-03-13 21:30 - 00290304 _____ (Microsoft Corporation) C:\Windows\system32\subinacl.exe
2016-03-13 21:30 - 2016-03-13 21:30 - 00000000 ____D C:\Program Files\Adware Removal Tool by TSA
2016-03-13 21:08 - 2016-03-17 01:17 - 00000000 ____D C:\Program Files\AdwCleaner
2016-03-13 13:41 - 2016-03-13 13:41 - 00000000 ____D C:\Users\Julie\AppData\Roaming\Foxit Software
2016-03-13 10:26 - 2016-03-15 07:32 - 00002027 _____ C:\Users\Colin\Desktop\My Setup Programs.lnk
2016-03-11 18:05 - 2016-03-11 18:05 - 00000000 ____D C:\Users\Julie\AppData\Local\CEF
2016-03-11 08:30 - 2016-03-11 08:30 - 00000000 ___HD C:\ProgramData\Intel
2016-03-11 08:29 - 2016-03-11 08:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel Driver Update Utility
2016-03-10 08:06 - 2016-03-16 09:11 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-03-08 20:25 - 2016-02-11 18:44 - 03994560 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2016-03-08 20:25 - 2016-02-11 18:44 - 03938240 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-03-08 20:25 - 2016-02-11 18:44 - 00138176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-03-08 20:25 - 2016-02-11 18:44 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-03-08 20:25 - 2016-02-11 18:41 - 01310232 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-03-08 20:25 - 2016-02-11 18:38 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-03-08 20:25 - 2016-02-11 18:38 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-03-08 20:25 - 2016-02-11 18:37 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-03-08 20:25 - 2016-02-11 18:35 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-03-08 20:25 - 2016-02-11 18:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-03-08 20:25 - 2016-02-11 18:35 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-03-08 20:25 - 2016-02-11 18:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-03-08 20:25 - 2016-02-11 18:33 - 01060864 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-03-08 20:25 - 2016-02-11 18:33 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-03-08 20:25 - 2016-02-11 18:31 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-03-08 20:25 - 2016-02-11 18:31 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-03-08 20:25 - 2016-02-11 18:30 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-03-08 20:25 - 2016-02-11 18:30 - 00642560 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-03-08 20:25 - 2016-02-11 18:30 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-03-08 20:25 - 2016-02-11 17:43 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-03-08 20:25 - 2016-02-11 17:37 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-03-08 20:25 - 2016-02-11 17:32 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-03-08 20:25 - 2016-02-11 17:32 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-03-08 20:25 - 2016-02-11 17:32 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-03-08 20:25 - 2016-02-11 17:31 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-03-08 20:25 - 2016-02-11 17:30 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-03-08 20:25 - 2016-02-11 17:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-03-08 20:25 - 2016-02-11 17:30 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-03-08 20:25 - 2016-02-09 09:50 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2016-03-08 20:25 - 2016-02-09 06:10 - 00341200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-03-08 20:25 - 2016-02-08 21:05 - 20352512 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-03-08 20:25 - 2016-02-08 20:51 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-03-08 20:25 - 2016-02-08 20:51 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-03-08 20:25 - 2016-02-08 20:39 - 00496640 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-03-08 20:25 - 2016-02-08 20:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-03-08 20:25 - 2016-02-08 20:38 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-03-08 20:25 - 2016-02-08 20:38 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-03-08 20:25 - 2016-02-08 20:37 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-03-08 20:25 - 2016-02-08 20:34 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-03-08 20:25 - 2016-02-08 20:32 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-03-08 20:25 - 2016-02-08 20:31 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-03-08 20:25 - 2016-02-08 20:30 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-03-08 20:25 - 2016-02-08 20:28 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-03-08 20:25 - 2016-02-08 20:28 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-03-08 20:25 - 2016-02-08 20:28 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-03-08 20:25 - 2016-02-08 20:28 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-03-08 20:25 - 2016-02-08 20:23 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-03-08 20:25 - 2016-02-08 20:20 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-03-08 20:25 - 2016-02-08 20:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-03-08 20:25 - 2016-02-08 20:15 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-03-08 20:25 - 2016-02-08 20:13 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-03-08 20:25 - 2016-02-08 20:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-03-08 20:25 - 2016-02-08 20:11 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-03-08 20:25 - 2016-02-08 20:10 - 04611072 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-03-08 20:25 - 2016-02-08 20:10 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-03-08 20:25 - 2016-02-08 20:03 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-03-08 20:25 - 2016-02-08 20:02 - 13012480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-03-08 20:25 - 2016-02-08 20:02 - 00687104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-03-08 20:25 - 2016-02-08 20:02 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-03-08 20:25 - 2016-02-08 20:01 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-03-08 20:25 - 2016-02-08 20:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-03-08 20:25 - 2016-02-08 19:43 - 02121216 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-03-08 20:25 - 2016-02-08 19:39 - 01311744 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-03-08 20:25 - 2016-02-08 19:38 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-03-08 20:25 - 2016-02-04 18:41 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2016-03-08 20:25 - 2016-02-04 17:46 - 02387456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-03-08 20:25 - 2016-02-03 18:49 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2016-03-08 20:25 - 2016-02-03 18:49 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\olepro32.dll
2016-03-08 20:25 - 2016-02-03 18:43 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-03-08 20:25 - 2016-02-03 17:59 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2016-03-08 20:22 - 2016-02-09 09:51 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2016-03-08 20:22 - 2016-02-09 09:51 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2016-03-08 20:22 - 2016-02-09 09:13 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2016-03-08 20:22 - 2016-02-09 09:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2016-03-08 20:22 - 2016-02-09 09:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2016-03-08 20:22 - 2016-02-05 18:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-03-08 20:22 - 2016-02-05 18:44 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-03-08 20:22 - 2016-02-05 18:42 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-03-08 20:22 - 2016-02-05 17:43 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-03-08 20:22 - 2016-02-05 17:43 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-03-02 14:23 - 2016-02-19 18:50 - 00034240 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-03-02 14:23 - 2016-02-19 18:41 - 00958464 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-03-02 14:23 - 2016-02-19 14:07 - 01206784 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-03-02 14:23 - 2016-02-12 18:39 - 02956288 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-03-02 14:23 - 2016-02-12 18:39 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-03-02 14:23 - 2016-02-12 18:26 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2016-03-02 14:23 - 2016-02-12 18:07 - 02062848 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-03-02 14:23 - 2016-02-12 18:06 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-03-02 14:23 - 2016-02-12 18:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-03-02 14:23 - 2016-02-12 18:05 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-03-02 14:23 - 2016-02-12 18:05 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-03-02 14:23 - 2016-02-12 18:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-03-02 14:23 - 2016-02-12 18:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-03-02 14:23 - 2016-02-12 18:05 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2016-03-02 14:23 - 2016-02-11 14:07 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-03-02 14:23 - 2016-02-05 14:07 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-03-02 14:23 - 2016-02-05 14:07 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-03-02 14:23 - 2016-02-05 14:07 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-02-26 11:22 - 2016-02-26 11:22 - 00000000 ____D C:\Program Files\Amazon
2016-02-26 11:15 - 2016-03-15 02:02 - 00000000 ___HD C:\Users\Colin\.oracle_jre_usage
2016-02-18 13:09 - 2016-01-11 18:54 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2016-02-18 13:09 - 2015-11-19 14:06 - 00922432 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00066400 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00022368 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2016-02-18 13:09 - 2015-11-19 14:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-17 22:25 - 2009-07-14 04:34 - 00025552 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-17 22:25 - 2009-07-14 04:34 - 00025552 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-17 22:20 - 2009-08-22 06:53 - 00000886 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-17 22:18 - 2014-11-09 10:34 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Dropbox
2016-03-17 22:17 - 2009-08-22 06:53 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-17 22:17 - 2009-07-14 04:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-17 18:49 - 2014-03-29 10:46 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-03-17 18:28 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\ModemLogs
2016-03-17 18:04 - 2009-08-25 10:17 - 00000000 ____D C:\Program Files\SpywareBlaster
2016-03-17 18:04 - 2009-08-22 11:56 - 00000000 ___HD C:\ProgramData\TEMP
2016-03-17 18:04 - 2009-07-14 02:37 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2016-03-17 17:51 - 2014-03-27 09:15 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-03-17 17:10 - 2009-08-22 12:56 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Audacity
2016-03-17 17:09 - 2015-05-11 18:52 - 00000963 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2016-03-17 17:09 - 2009-08-25 21:00 - 00000000 ____D C:\Program Files\Audacity
2016-03-17 16:41 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\inf
2016-03-17 16:36 - 2012-12-03 20:26 - 00000000 ____D C:\Users\Colin\AppData\Local\Adobe
2016-03-17 12:49 - 2009-08-24 13:51 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Applications
2016-03-17 12:44 - 2012-09-25 14:48 - 00000000 ____D C:\Program Files\Windows Live
2016-03-17 12:43 - 2009-07-14 02:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-03-17 12:41 - 2010-10-20 07:44 - 00000000 ____D C:\Users\Colin\AppData\Local\Windows Live
2016-03-17 07:57 - 2009-07-14 02:04 - 00000215 _____ C:\Windows\system.ini
2016-03-17 00:23 - 2013-02-27 05:51 - 00000000 ____D C:\Program Files\mbam-chameleon-1.62.1.1000
2016-03-16 23:19 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-03-16 14:10 - 2010-03-31 12:37 - 00000000 ___RD C:\Users\Colin
2016-03-16 14:10 - 2009-08-24 10:14 - 00000000 ___HD C:\ProgramData\WinZip
2016-03-16 13:52 - 2010-03-31 12:37 - 00000000 ___RD C:\Users\Julie
2016-03-16 13:52 - 2010-03-31 12:36 - 00000000 ___HD C:\Users\Main User
2016-03-16 13:51 - 2011-03-24 18:35 - 00000000 ____D C:\Program Files\WindowManager
2016-03-16 13:51 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\registration
2016-03-16 11:54 - 2009-09-15 06:51 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2016-03-16 11:40 - 2013-09-15 15:49 - 00000000 ___HD C:\ProgramData\Oracle
2016-03-16 11:39 - 2010-05-01 11:06 - 00000000 ____D C:\Users\Colin\AppData\LocalLow\Sun
2016-03-16 11:33 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\system32\NDF
2016-03-16 11:27 - 2009-08-25 19:47 - 00000000 ____D C:\Program Files\Adobe
2016-03-16 09:37 - 2010-04-07 07:01 - 00000000 ____D C:\Windows\system32\Atheros_L1
2016-03-16 09:26 - 2011-06-20 15:01 - 00000000 ____D C:\Program Files\Common Files\Adobe
2016-03-16 09:20 - 2012-04-24 17:36 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-03-16 09:09 - 2009-07-14 04:53 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-03-16 08:00 - 2010-03-31 11:29 - 00000000 ____D C:\Windows\pss
2016-03-15 20:50 - 2012-12-11 21:50 - 00000000 ____D C:\Windows\rescache
2016-03-15 18:29 - 2013-06-21 17:25 - 00000000 ____D C:\Users\Colin\AppData\Local\Samsung
2016-03-15 18:27 - 2010-07-11 19:21 - 00000000 ___HD C:\ProgramData\Samsung
2016-03-15 18:26 - 2010-10-22 19:05 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Samsung
2016-03-15 18:25 - 2011-05-13 07:52 - 00000000 ____D C:\Users\Colin\AppData\Local\Downloaded Installations
2016-03-15 18:24 - 2013-06-21 17:12 - 00000000 ____D C:\Program Files\Samsung
2016-03-15 18:24 - 2009-08-22 07:40 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2016-03-15 18:08 - 2010-03-31 13:16 - 00812350 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-15 18:01 - 2015-06-13 08:49 - 00000000 ____D C:\Users\Colin\AppData\Local\Dropbox
2016-03-15 17:18 - 2013-06-30 16:42 - 00000000 ____D C:\Program Files\iTunes
2016-03-15 16:47 - 2014-01-27 17:44 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-03-15 16:25 - 2014-12-22 13:17 - 00002086 _____ C:\Users\Colin\Desktop\Dropbox.lnk
2016-03-15 16:23 - 2009-08-24 18:35 - 00324152 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys
2016-03-15 16:21 - 2011-09-21 17:14 - 00000000 ____D C:\Users\Colin\AppData\Roaming\vlc
2016-03-15 16:05 - 2009-08-27 07:54 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Notepad++
2016-03-15 16:01 - 2012-02-23 08:49 - 00000000 ____D C:\Program Files\CDBurnerXP
2016-03-15 13:24 - 2009-08-22 08:56 - 00000000 ____D C:\Program Files\Nitro PDF
2016-03-15 09:28 - 2010-12-28 09:36 - 00002155 _____ C:\Windows\epplauncher.mif
2016-03-15 08:48 - 2011-05-03 17:21 - 00002629 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ultimate Windows Tweaker.lnk
2016-03-15 02:51 - 2009-08-22 10:01 - 00000000 ____D C:\Program Files\Allway Sync
2016-03-15 00:55 - 2009-12-18 19:11 - 00000000 ___HD C:\ProgramData\Nokia
2016-03-15 00:55 - 2009-12-16 19:22 - 00000000 ____D C:\Program Files\Nokia
2016-03-15 00:54 - 2009-12-16 19:22 - 00000000 ____D C:\Program Files\Common Files\Nokia
2016-03-15 00:54 - 2009-08-26 23:02 - 00000000 ___HD C:\ProgramData\Installations
2016-03-14 08:53 - 2010-03-31 14:55 - 00000008 __RSH C:\Users\Julie\ntuser.pol
2016-03-14 00:09 - 2009-08-22 11:51 - 00000008 __RSH C:\ProgramData\ntuser.pol
2016-03-13 23:48 - 2010-03-31 13:13 - 00000008 __RSH C:\Users\Colin\ntuser.pol
2016-03-13 13:35 - 2013-10-09 14:13 - 00000000 ____D C:\Users\Colin\AppData\Local\ElevatedDiagnostics
2016-03-13 11:46 - 2010-05-01 11:06 - 00000000 ____D C:\Users\Colin\AppData\LocalLow\Adobe
2016-03-11 18:05 - 2013-07-13 09:21 - 00000000 ____D C:\Users\Julie\AppData\Local\Adobe
2016-03-11 08:29 - 2015-06-11 10:17 - 00000000 ____D C:\Program Files\Intel Driver Update Utility
2016-03-10 19:02 - 2010-04-10 15:40 - 00007599 _____ C:\Users\Colin\AppData\Local\resmon.resmoncfg
2016-03-08 20:56 - 2009-07-14 04:33 - 00412456 _____ C:\Windows\system32\FNTCACHE.DAT
2016-03-08 20:40 - 2013-07-09 17:59 - 00000000 ____D C:\Windows\system32\MRT
2016-03-08 20:28 - 2010-04-13 18:49 - 141270216 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-03-07 18:42 - 2014-12-31 11:06 - 00000000 ____D C:\Program Files\BurnAware Free
2016-03-05 08:28 - 2010-01-27 07:19 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2016-03-02 14:23 - 2015-04-12 09:41 - 00000000 ____D C:\Windows\system32\appraiser
2016-02-16 11:53 - 2014-06-17 19:20 - 00000000 ____D C:\Users\Colin\AppData\Roaming\Foxit Software
2016-02-16 11:46 - 2009-10-17 12:51 - 00000000 ____D C:\Users\Colin\AppData\Roaming\PrimoPDF

==================== Files in the root of some directories =======

2009-08-22 11:55 - 2014-05-09 11:04 - 0000063 _____ () C:\Users\Colin\AppData\Roaming\AVSDVDPlayer.m3u
2011-03-29 16:19 - 2011-03-29 16:20 - 0000066 _____ () C:\Users\Colin\AppData\Roaming\AVSMediaPlayer.m3u
2014-04-27 19:16 - 2014-04-27 19:16 - 0038423 _____ () C:\Users\Colin\AppData\Roaming\Comma Separated Values (DOS).ADR
2010-02-27 08:31 - 2013-11-26 15:19 - 0038429 _____ () C:\Users\Colin\AppData\Roaming\Comma Separated Values (Windows).ADR
2009-09-09 12:03 - 2009-09-09 12:22 - 0000113 _____ () C:\Users\Colin\AppData\Roaming\default.pls
2009-08-30 20:24 - 2009-10-17 12:47 - 0006900 _____ () C:\Users\Colin\AppData\Roaming\PrimoPDFSet.xml
2011-03-18 20:04 - 2015-03-04 12:15 - 0012800 ___SH () C:\Users\Colin\AppData\Roaming\Thumbs.db
2011-03-13 10:25 - 2011-03-13 10:25 - 0007142 _____ () C:\Users\Colin\AppData\Roaming\UserTile.png
2014-12-31 11:35 - 2014-12-31 11:35 - 0000031 _____ () C:\Users\Colin\AppData\Local\burnaware.ini
2010-04-12 08:50 - 2012-07-05 17:35 - 0046080 _____ () C:\Users\Colin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-04-10 15:40 - 2016-03-10 19:02 - 0007599 _____ () C:\Users\Colin\AppData\Local\resmon.resmoncfg
2010-10-17 15:24 - 2010-10-17 15:52 - 0001356 ____H () C:\ProgramData\hpzinstall.log

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-03-09 10:57

==================== End of FRST.txt ============================

 

Addition Second Run Log Part 1:

Additional scan result of Farbar Recovery Scan Tool (x86) Version:05-03-2016 01
Ran by Colin (2016-03-17 22:51:09)
Running from C:\Users\Colin\Desktop
Microsoft Windows 7 Professional Service Pack 1 (X86) (2010-03-31 13:13:29)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Colin (S-1-5-21-2548019330-3924178630-1638020567-1001 - Administrator - Enabled) => C:\Users\Colin
Guest (S-1-5-21-2548019330-3924178630-1638020567-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-2548019330-3924178630-1638020567-1011 - Limited - Enabled)
Julie (S-1-5-21-2548019330-3924178630-1638020567-1003 - Limited - Enabled) => C:\Users\Julie
Main User (S-1-5-21-2548019330-3924178630-1638020567-500 - Administrator - Enabled) => C:\Users\Main User

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC (HKLM\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.010.20060 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 21.0.0.176 - Adobe Systems Incorporated)
Adobe Flash Player 21 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 21.0.0.182 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 21.0.0.182 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.2 (HKLM\...\Adobe Shockwave Player) (Version: 12.2.4.194 - Adobe Systems, Inc.)
Allway Sync version 15.3.1 (HKLM\...\Allway Sync_is1) (Version: - Botkind Inc)
Apple Application Support (32-bit) (HKLM\...\{7FA9ECCF-A2DE-4DA1-BFF3-81260DBDA68F}) (Version: 4.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{9A629DCB-415D-4A50-85B9-5C2E4F8F74A8}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Arcade Classic Pack 5.10 (HKLM\...\Arcade Classic Pack_is1) (Version: - Arcade Classic Pack)
Atheros Communications Inc.(R) L1 Gigabit Ethernet Driver (HKLM\...\{6E19F210-3813-4002-B561-94D66AA182B6}) (Version: 2.4.7.29 - Atheros Communications Inc.)
Audacity 2.1.0 (HKLM\...\Audacity_is1) (Version: 2.1.0 - Audacity Team)
Audacity 2.1.2 (HKLM\...\Audacity®_is1) (Version: 2.1.2 - Audacity Team)
BBC iPlayer Downloads (HKLM\...\{C3794B09-6C43-4B93-9CA8-F10BECCF2971}) (Version: 1.11.1 - BBC)
Bonjour (HKLM\...\{D168AAD0-6686-47C1-B599-CDD4888B9D1A}) (Version: 3.1.0.1 - Apple Inc.)
BurnAware Free 8.9 (HKLM\...\BurnAware Free_is1) (Version: - Burnaware)
CCleaner (HKLM\...\CCleaner) (Version: 5.15 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.6.6053 - CDBurnerXP)
Creative ALchemy (HKLM\...\ALchemy) (Version: 1.41 - Creative Technology Limited)
Creative Audio Control Panel (HKLM\...\AudioCS) (Version: 2.56 - Creative Technology Limited)
Creative Software AutoUpdate (HKLM\...\Creative Software AutoUpdate) (Version: 1.40 - Creative Technology Limited)
Creative Sound Blaster Properties (HKLM\...\Creative Sound Blaster Properties) (Version: 1.02 - Creative Technology Limited)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Defraggler (HKLM\...\Defraggler) (Version: 2.20 - Piriform)
Dropbox (HKLM\...\Dropbox) (Version: 3.16.1 - Dropbox, Inc.)
Dropbox Update Helper (Version: 1.3.35.1 - Dropbox, Inc.) Hidden
FFmpeg for Audacity on Windows (HKLM\...\FFmpeg for Audacity on Windows_is1) (Version: - )
Foxit PhantomPDF Standard (HKLM\...\{C82148DF-556D-472D-B3F5-5EF85512CDB6}) (Version: 7.2.0.722 - Foxit Software Inc.)
Foxit Reader (HKLM\...\Foxit Reader_is1) (Version: 7.3.0.118 - Foxit Software Inc.)
GetDiz (HKLM\...\GetDiz) (Version: 4.8 - Outertech)
Google Advertising Cookie Opt-out (HKLM\...\{291820D0-A626-40F9-BDFF-8D5CEAB04243}) (Version: 1.0.1.0 - Google Inc)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.29.5 - Google Inc.) Hidden
HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )
HP PrecisionScan LTX (HKLM\...\HP PrecisionScan LTX) (Version: - )
HP Scan-to-Web Wizard (HKLM\...\Scan-To-Web) (Version: - )
hppLaserJetService (Version: 001.001.0.0 - Hewlett-Packard) Hidden
hppP1100P1560P1600SeriesLaserJetService (Version: 001.001.0.0 - Hewlett-Packard) Hidden
hppusgP1100P1560P1600Series (Version: 1.0.0.1 - Hewlett-Packard) Hidden
HPSSupply (HKLM\...\{7902E313-FF0F-4493-ACB1-A8147B78DCD0}) (Version: 2.1.1.0000 - Hewlett Packard Development Company L.P.)
ieSpell (HKLM\...\ieSpell) (Version: 2.6.4 (build 573) - Red Egg Software)
ImgBurn (HKLM\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Internet TV for Windows Media Center (HKLM\...\{9D318C86-AF4C-409F-A6AC-7183FF4CF424}) (Version: 3.2.0.0 - Microsoft Corporation)
ISO Recorder (HKLM\...\{1235083F-52F9-44CC-9DF5-F9B7802BB9B7}) (Version: 3.0.0 - Alex Feinman)
iTunes (HKLM\...\{2C741651-87E0-4479-9703-6DD0D7988B84}) (Version: 12.3.2.35 - Apple Inc.)
Java 8 Update 73 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218073F0}) (Version: 8.0.730.2 - Oracle Corporation)
Lyrics Plugin for Windows Media Player (HKLM\...\{43002AE2-4093-49E0-A03D-990EE184C568}) (Version: 0.4 - Lyrics Plugin)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office FrontPage 2003 (HKLM\...\{90170409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM\...\{95140000-0081-0409-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Outlook Personal Folders Backup (HKLM\...\{C63E7C60-25EB-11D3-8EDA-00A0C911E8E5}) (Version: 1.10.0.0 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 45.0 (x86 en-GB) (HKLM\...\Mozilla Firefox 45.0 (x86 en-GB)) (Version: 45.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 45.0 - Mozilla)
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
NirSoft ShellExView (HKLM\...\NirSoft ShellExView) (Version: - )
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
PhotoFiltre (HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\PhotoFiltre) (Version: - )
PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
PoiEdit (HKLM\...\PoiEdit) (Version: - )
PrimoPDF -- brought to you by Nitro PDF Software (HKLM\...\PrimoPDF) (Version: 5 - Nitro PDF Software)
QuickTime 7 (HKLM\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5936 - Realtek Semiconductor Corp.)
RoboForm 7-9-18-0 (All Users) (HKLM\...\AI RoboForm) (Version: 7-9-18-0 - Siber Systems)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.16011.2 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.3.16011.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
SeaTools for Windows (HKLM\...\{98613C99-1399-416C-A07C-1EE1C585D872}) (Version: 1.2.0.0 - Seagate Technology)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
ShellExView (HKLM\...\ShellExView) (Version: 1.37 - NirSoft)
Show Desktop (HKLM\...\{A7EC7775-06C1-4394-830D-240367AF93BF}_is1) (Version: 1.1 - Green Point Software LTD)
Sim AQUARIUM 2 (HKLM\...\Sim AQUARIUM 2_is1) (Version: 2.32 - Digital Illusions Software)
SpywareBlaster 5.4 (HKLM\...\SpywareBlaster_is1) (Version: 5.4.0 - BrightFort LLC)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1200 - SUPERAntiSpyware.com)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TomTom HOME (HKLM\...\{5DCB2EB3-87AD-426E-8D74-8B92C9D731C4}) (Version: 2.9.8 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TrueCrypt (HKLM\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
VC 9.0 Runtime (Version: 1.0.0 - Check Point Software Technologies Ltd) Hidden
Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.2 - VideoLAN)
WindowManager (HKLM\...\WindowManager) (Version: 1.6.0 - DeskSoft)
Windows Installer Clean Up (HKLM\...\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}) (Version: 3.00.00.0000 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR 4.00 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
WinZip 12.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}) (Version: 12.0.8252 - WinZip Computing, S.L. )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0785F436-5405-4E7A-A7D2-CB98A7C7E345} - System32\Tasks\{CF582DF5-477F-48C1-B391-72CAA4AD0476} => pcalua.exe -a "C:\Program Files\Windows Installer Clean Up\msicuu.exe" -d C:\Windows\system32
Task: {0876E36C-37CA-457A-B81F-5899542E9BB0} - System32\Tasks\{03A790EC-EC3B-47C5-A031-44046A2C33F1} => C:\Program Files\PhotoFiltre\PhotoFiltre.exe [2012-01-05] (Antonio Da Cruz)
Task: {0FF9FE0E-4B10-4646-A77E-8BAF19DA9C30} - System32\Tasks\{C1B3AE18-E47C-4438-95C1-DB8EE710AF14} => pcalua.exe -a "C:\Users\Colin\Desktop\QRM Plus\QRM Menu Setup.exe" -d "C:\Users\Colin\Desktop\QRM Plus "
Task: {113DC3ED-A3A3-4EC6-80EE-44F579F0FE0B} - System32\Tasks\{69417E0F-05A8-472A-9BE6-DA655783F349} => D:\Colin's Documents\Setup Programs\My Setup Programs\java3d-1_5_1-windows-i586.exe
Task: {1322D0A8-A04A-4BE2-AA0E-7CEE3F974039} - System32\Tasks\{F77CB2F2-7098-40A6-B2AB-903401B44F5D} => msiexec.exe /package "C:\Users\Colin\Desktop\LS_HSI.msi "
Task: {14AB694E-26B2-451E-929F-9D5928DFD910} - System32\Tasks\{7735F762-A23A-43AC-920B-8E9BA03BB1B6} => msiexec.exe /package "C:\Users\Colin\Desktop\LS_HSI.msi "
Task: {175898BE-3031-4037-AAA2-F7A851B76C16} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {19F4148E-F2C4-4960-97DD-7283D90C08D9} - System32\Tasks\{58D99967-91D6-4A2D-82D3-A1AE02E76EE1} => pcalua.exe -a C:\Users\Colin\Desktop\Shockwave_Installer_Full.exe -d C:\Users\Colin\Desktop
Task: {1A154D49-CC14-4E85-AEFB-6A91D481EC64} - System32\Tasks\{DEFF112B-F4E3-4431-AA25-F592A189F635} => pcalua.exe -a C:\Users\Colin\Desktop\allwaysync-9-4-5.exe -d C:\Users\Colin\Desktop
Task: {1A5FD17D-6604-4BA0-AB62-0C2A955C8C30} - System32\Tasks\{8C450E87-935C-49CA-91A0-1A3AEFA01C8D} => D:\Colin's Documents\Setup Programs\My Setup Programs\Your Uninstaller! 2010\yusetup2010.exe
Task: {1A66D327-E00E-4CB8-89A1-CB9D2EFA8F88} - System32\Tasks\{75D7F88B-0161-479E-856F-BF8EAA20C49F} => pcalua.exe -a Z:\WIN2K-XP\Setup.exe -d Z:\WIN2K-XP
Task: {1AFDEFA5-B9D0-4FDA-9780-4055B1EF7473} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-03-15] (Dropbox, Inc.)
Task: {1B87966F-532E-40F3-8792-0E4286CBED40} - System32\Tasks\{2EBD832E-B165-4605-99BE-C3047B9E66E9} => pcalua.exe -a "F:\Program Files\ChromePortable\ChromiumPortable.exe" -d "F:\Program Files\ChromePortable "
Task: {1E18F2E3-6C3C-4F0A-806F-A5949744C193} - System32\Tasks\{4CAF8F24-B038-42A4-B654-BE53B56C8429} => pcalua.exe -a "C:\Program Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files\VS Revo Group\Revo Uninstaller "
Task: {1E338357-6F62-4A1B-8FD0-ACF2EE20287D} - System32\Tasks\{F6A0126B-F95F-4E79-ADB5-D57ED4BD672E} => C:\Program Files\WindowManager\WindowManager.exe [2015-05-27] (DeskSoft)
Task: {229017B1-67AC-4D9C-BA79-13EBB9E46B71} - System32\Tasks\{BB59D284-B2E6-48D6-890E-B0EC78520273} => msiexec.exe /package "Z:\Installation\Data\Redist\LS_HSI.msi "
Task: {2367F253-FA9D-43F3-B715-23407A789144} - System32\Tasks\{AC279307-945D-494C-9298-1794E8B2DF04} => C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
Task: {247DECD3-A859-4FFE-A6F7-3952745EBE20} - System32\Tasks\{1109FBF4-06C0-4231-ACDB-38E9317C2F24} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\AdobeAIRInstaller.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {2794C284-D81D-40D8-B412-6BBCB67D6DB7} - System32\Tasks\{D05477AE-9774-46A2-A99A-6C616B605CF2} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\FreeMPGtoMP4Converter.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {2A2D4E13-EBDF-4E4D-86F1-4E19FCC7DAE9} - System32\Tasks\Run RoboForm TaskBar Icon => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [2016-03-15] (Siber Systems)
Task: {2C7760EC-E445-4A6E-8B84-FD3394CEF2F0} - System32\Tasks\{038C6F08-DEDD-47D3-A9E3-A948F7C6301B} => pcalua.exe -a C:\Users\Colin\Desktop\TweakUiPowertoySetup.exe -d "C:\Program Files\Mozilla Firefox "
Task: {31530688-AE66-4D7D-BE39-C5224B77A4AB} - System32\Tasks\{B32F2BFB-A1B1-4439-ACD9-1B06680AD7E7} => C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe
Task: {31BA5170-5428-442D-81DD-0AEF7794C3E6} - System32\Tasks\{A787AFED-216B-47E0-B790-A8E5EF39F868} => pcalua.exe -a C:\Users\Colin\Desktop\allwaysync-10-0-5.exe -d C:\Users\Colin\Desktop
Task: {330214B5-5750-40A6-A7AA-35688F63BF47} - System32\Tasks\{6F5F16A1-C629-4A4F-995F-6F5715B23A18} => C:\Program Files\WindowManager\WindowManager.exe [2015-05-27] (DeskSoft)
Task: {3512D505-F05C-47FA-A110-3D150ACCFCDB} - System32\Tasks\{07BAB270-CD7C-424D-A9AD-53CBA9AE7A13} => C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
Task: {35633F77-05FA-4AF6-BD78-1FD5404E6410} - System32\Tasks\{C7453ED2-482B-43E3-A8F7-1CB1508FA08D} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Via Rhine II Fast Ethernet Adapter Update\WinSetup.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\Via Rhine II Fast Ethernet Adapter Update "
Task: {380948F5-1E7D-42E7-A345-671172019321} - System32\Tasks\{CA32DA8F-1324-4CA1-85FC-8C3A806F03A1} => pcalua.exe -a "C:\Users\Colin\Desktop\Your Uninstaller! Pro v7.0.2010.30 + Crack-Serials [ChattChitto RG].exe" -d C:\Users\Colin\Desktop
Task: {38CE43F6-EAE3-4D8F-BA63-E8E217D1ACD9} - System32\Tasks\{A014501B-7890-4BBC-B9F1-14682AF975E1} => C:\Users\Colin\Desktop\wlsetup-web.exe
Task: {3D67E7C1-EA0F-4FFE-8346-1947A47A9B63} - System32\Tasks\{D7371013-4CD5-4C06-ACA7-A52E6A67FED2} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\New_PC_Studio_1.5.1.10064_2.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {3EEFF83D-5D7E-4A8E-B13B-2423140B1BEC} - System32\Tasks\{7BD8310F-A417-4F43-8D21-32611D67A872} => C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
Task: {426E0E19-6ABE-4405-80D7-B2801D01FE5D} - System32\Tasks\{B4D2EDA0-BB3E-425B-89BB-E08B7CE83260} => C:\Program Files\AVStoDVD\AVStoDVD.exe
Task: {44BC2BC8-536F-4AAB-8F7A-58623F067D72} - System32\Tasks\WindowManager => C:\Program Files\WindowManager\WindowManager.exe [2015-05-27] (DeskSoft)
Task: {4581988B-6519-4004-8266-31D1C0BACBA0} - System32\Tasks\{AB00ECE6-8515-49E4-AD51-27999B95C0B5} => C:\Program Files\Allway Sync\Bin\syncappw.exe [2015-10-29] ()
Task: {4712879E-F98C-4E9F-B720-16EA77B11FA4} - System32\Tasks\{4DE99E70-2843-490A-90FB-76DCA8A4CF16} => pcalua.exe -a C:\Users\Colin\Desktop\HostsMan_Setup.exe -d C:\Users\Colin\Desktop
Task: {49C966E2-1588-4403-8654-64497ECB3465} - System32\Tasks\{58213922-0F1D-43C7-A16A-91BF42D14F0A} => C:\Program Files\AVStoDVD\AVStoDVD.exe
Task: {4B7245DA-0AC1-4F70-8FC3-A325B6F85F57} - System32\Tasks\{46E09E7C-AB3E-4E80-A1C7-4BCE2C42CDA8} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\msicuu2.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {4B8EA06D-B384-447C-AFFA-34276B5DAB73} - System32\Tasks\{B1D1AD4A-1393-4DB9-ADF2-9AECD403E0D4} => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
Task: {4BD576CB-5AE5-4677-A7E7-1111ECF86F7C} - System32\Tasks\{CF961957-F336-4135-B2BB-3FB436B3FA4D} => C:\Program Files\Allway Sync\Bin\syncappw.exe [2015-10-29] ()
Task: {4BE8B553-EDEB-45CA-AADD-C9E9CB779AF3} - System32\Tasks\{16600099-B373-4554-9634-38091BFA34E6} => C:\Program Files\iTunes\iTunes.exe [2015-12-17] (Apple Inc.)
Task: {4D07FB42-ADC6-4E9D-9E71-FCF0323B02E6} - System32\Tasks\{13A2D928-2422-468F-ACEE-A7A1AB2DABBF} => pcalua.exe -a C:\Users\Colin\Desktop\jxpiinstall.exe -d C:\Users\Colin\Desktop
Task: {4ED5714B-2D7F-41B6-8459-7372200A6122} - System32\Tasks\{2C9AB11F-E0AA-4D38-908F-EAFF6CF4A9CE} => pcalua.exe -a C:\Users\Colin\Desktop\allwaysync-9-4-11.exe -d C:\Users\Colin\Desktop
Task: {4F073F92-F27F-432B-836F-815E12EAA03A} - \Go to RoboForm Install page -> No File <==== ATTENTION
Task: {53E77B5E-2A29-47A5-B831-8A9616ECE6B4} - System32\Tasks\{361C4E9B-9FD3-4470-8F3C-AEF5E4389080} => C:\Users\Colin\Desktop\unlocker1.8.7.exe
Task: {5554DF3F-BABE-42FB-8F14-EB36BDA2C318} - System32\Tasks\{43E25CB6-1222-4B4E-B072-8D2E715EF213} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Firefox Setup 3.5.4.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {568AD41D-E2BA-4044-A295-FD6543FFC266} - System32\Tasks\{B973E61B-0BEB-48D9-95FC-3CFFBE2FC17D} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Nokia_Ovi_Suite_webinstaller_ALL.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {58098784-53B0-480F-8C35-5E20024BC7C3} - System32\Tasks\{07F57205-15C9-4910-8893-A91DF1244221} => pcalua.exe -a C:\Users\Colin\Desktop\HijackThis.exe -d C:\Users\Colin\Desktop
Task: {591A9F0F-9895-433B-9E9C-9F33DA10779B} - System32\Tasks\{AA56F886-276C-439E-9E87-58890798EF2D} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\MP4 Converter\x-mp4-converter-41214.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\MP4 Converter "
Task: {6332D835-0A82-4B4A-A8B5-BEF6016ABB0C} - System32\Tasks\{3C2E3379-5EF6-48C6-90ED-451B7C175D13} => pcalua.exe -a C:\Users\Colin\Desktop\ChromePortable\ChromiumPortable.exe -d C:\Users\Colin\Desktop\ChromePortable
Task: {65194959-FE47-4A88-BA71-62B3BED04C02} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-03-15] (Dropbox, Inc.)
Task: {6D964C7F-3108-46ED-9F7E-EFAFFD6F3A09} - System32\Tasks\{E74F8EE3-7953-43DE-A133-A2B8E134A937} => C:\Program Files\Replay Media Catcher\MediaCatcher.exe
Task: {72544F8A-D916-4906-BFA3-4ECB054846EB} - System32\Tasks\{962A8C29-ED96-4CA9-88F2-7911A521069A} => pcalua.exe -a "C:\Program Files\QuickTime\QTSystem\QuickTime.cpl "
Task: {757F3CEF-D130-4190-95D1-FAF2AFC21D28} - System32\Tasks\{3AAA116C-B562-488E-B248-37CB960B3CEE} => C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe
Task: {78F2F80A-1F87-4716-8068-C2E0DB0AB846} - System32\Tasks\Create Restore Point => C:\Scripts\createrp.vbs [2009-12-21] ()
Task: {7CBC5A8A-95D7-445A-BA95-F29C475CA874} - System32\Tasks\{9888954F-BB61-441D-850D-F240A332DE89} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Downloads\Shockwave_Installer_Slim.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\Downloads "
Task: {7E4C6D9C-C590-458B-86BA-E9D8CD2BC4FC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {7EEF4CFD-A83D-43C9-9BEC-B30C2397BF0B} - System32\Tasks\{57973835-D391-4FF3-9EB3-46BFF7F5F20D} => pcalua.exe -a "C:\Program Files\HighCriteria\TotalRecorder\setup.exe "
Task: {7F2FBF4A-C7C4-45BC-9CF5-063E16F8B776} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-02-12] (Piriform Ltd)
Task: {82F4AD07-4678-4BE8-B16C-3AA2EEEA12FC} - System32\Tasks\{31DC229D-779B-43E4-9B91-03AD122B79C1} => D:\Colin's Documents\Setup Programs\My Setup Programs\daemon4304-lite.exe
Task: {832245DB-1B42-40E0-88E2-47416B0177D1} - System32\Tasks\{0148AA39-E98A-4D5A-892C-53AFC6965379} => Firefox.exe
Task: {8A9EC68A-D864-4AB3-A804-FFCAE0B8EAA2} - System32\Tasks\{65626912-8A8A-48AB-A242-06651FBF3915} => C:\Users\Colin\Desktop\wlsetup-web.exe
Task: {8AE680AC-E30B-4096-BB39-8876A3A58FA7} - System32\Tasks\{83B52E09-77B2-423F-9377-3F124EF3CC16} => pcalua.exe -a C:\Users\Colin\Desktop\avg_free_stb_all_9_40_cnet.exe -d C:\Users\Colin\Desktop
Task: {8B2238F5-6A14-4565-AA8F-809CBF73EFE7} - System32\Tasks\{AD824A97-9169-4721-94FB-3E74D9944DF3} => pcalua.exe -a C:\Users\Colin\Desktop\Shockwave_Installer_Slim.exe -d C:\Users\Colin\Desktop
Task: {90FC20E5-EAE2-45D0-B00D-73CBA47CA8E5} - System32\Tasks\{BC22558C-D204-487E-B6B5-0854EFC88B6B} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\shexview_setup.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {91219BC7-F287-427B-BA45-78CE836DE860} - System32\Tasks\{73963FC1-883D-4E27-B244-CCB383BA03EF} => C:\Program Files\Allway Sync\unins000.exe [2016-03-15] ()
Task: {936A7471-0047-492A-B103-AD4579BF0BF5} - System32\Tasks\{C8DB57B3-5FC0-448A-B5D5-DFCBD18CC492} => pcalua.exe -a "C:\Program Files\ChromePortable\ChromiumPortable.exe" -d "C:\Program Files\ChromePortable "
Task: {9579D07B-2A0F-43DA-AA52-C8E5CB026B50} - System32\Tasks\{F1F863E1-DE47-4FDD-B481-729A74E76F25} => pcalua.exe -a C:\Users\Colin\Desktop\WMSetup.exe -d C:\Users\Colin\Desktop
Task: {975C8E9C-19E4-404C-90C9-2BFD6ADC89AF} - System32\Tasks\{B2AC841B-5294-4A9E-8DB9-A3D286DE2937} => C:\Program Files\GoogleChromePortable\GoogleChromePortable.exe
Task: {9A59471D-F706-450B-9819-18C0FBB096E8} - System32\Tasks\Open URL by RoboForm => Rundll32.exe url.dll,FileProtocolHandler "hxxp://www.roboform.com/test-pass.html?aaa=KICMKMMJLJGMJMHMKJNMCNPMGMJJOJCNLMMJMJLJCNNJNJMJMJCNMMJJPMGMGMJMOMMJLJMMNMOJJNJICMIMCNGMCNOMHMFMOMOMCNPMCNGMJMPMPMFMJMCNOMCNIMJMPMOMCNNMJNPICMOMFMEKMICNJJCKFMOMHMIMLMJNHICMMJBJKJLIMJJNBJCMMLAJDJGJBJJNKJCMJNNICMJNDJCMKJBJJNMJCMOM (the data entry has 47 more characters).
Task: {9C3CB50C-0218-4DC6-9E68-F21D4FE0A065} - System32\Tasks\{9666F58D-7ACE-40A6-B5E5-FD50DDECC94E} => C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
Task: {9D335058-F251-4DD9-88CC-691386864095} - System32\Tasks\{1450E873-B2D5-40B5-973F-367ECEF3F93C} => pcalua.exe -a Z:\AlphaAudio\AlphaPlayer.exe -d Z:\
Task: {9E1849B1-D79D-4241-AE13-AC2DCE72378A} - System32\Tasks\{1216D9F5-3681-4639-BBFC-CEB2FD6C586C} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\MP4 Converter\x-mp4-converter-41214.exe" -d "D:\Colin's Documents\Setup Programs\MP4 Converter "
Task: {9F4EC255-3217-4ABD-8FF5-66CA636C762A} - System32\Tasks\{7CA627C5-F198-464F-8824-F5ED51ED4C4B} => pcalua.exe -a C:\Users\Colin\Desktop\install_flash_player.exe -d C:\Users\Colin\Desktop
Task: {A4E955CA-3D9C-4429-86F6-BE7530EBB7A0} - System32\Tasks\{1EAAF5B0-EDF4-4206-94EF-F3A296464725} => C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe
Task: {A58E6DAC-B6A0-46F6-A385-7483B3F4CB53} - System32\Tasks\{15786B07-B0D7-458C-9958-EE8A4D9141E4} => Firefox.exe
Task: {A7468536-659C-420F-964B-94F8547C7AEA} - System32\Tasks\{02085FF6-07EF-454A-ADF5-D9EB169FD4ED} => pcalua.exe -a "C:\Program Files\DAEMON Tools Lite\uninst.exe" -d "C:\Program Files\DAEMON Tools Lite "
Task: {AAD84284-BFB6-4895-A0EA-6441F7BC95B2} - System32\Tasks\{DCB92CCB-C19D-43E5-B695-6267A9701428} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Intel Programs\ChipUtil.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\Intel Programs "
Task: {B1AA4573-9FA2-4BEC-9364-6248E827F107} - System32\Tasks\{3C0D0CDE-7BEA-4A40-B8E9-ABE96CBC0021} => C:\Program Files\Allway Sync\Bin\syncappw.exe [2015-10-29] ()
Task: {B628FFC1-95D5-4697-9645-63F1F76BEE7B} - System32\Tasks\{B02C575C-DDCE-472D-A69A-19FF0C18DB0B} => C:\Program Files\Replay Media Catcher\MediaCatcher.exe
Task: {B8BFD770-D7AF-465A-991A-2E78E8C7D1B2} - System32\Tasks\{47D3D2EB-03F6-4BDC-A2F9-6575289C74FF} => C:\Program Files\Allway Sync\Bin\syncappw.exe [2015-10-29] ()
Task: {B96492BA-72BC-4B48-944A-52C4C7982223} - System32\Tasks\{EA9A637D-3A9A-4F9B-B11D-35E854134409} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Nokia_PC_Suite_7_1_40_1_eng_web.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {BD2B58A6-7206-4BB1-AEF3-734D34167947} - System32\Tasks\{71889984-AECB-4D60-A053-76A8DF7791B1} => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
Task: {BE512007-E97F-45F1-82A8-70EAD9296AE0} - System32\Tasks\{F70474F5-6EA8-4E43-B154-15B6B8475723} => pcalua.exe -a C:\Users\Colin\Desktop\ComboFix.exe -d C:\Users\Colin\Desktop
Task: {C3F65F76-D8D5-4D5C-AED4-293636CFA7C4} - System32\Tasks\{A4F98B04-B24D-469B-B578-572E947FC5DE} => C:\Program Files\eRightSoft\SUPER\SUPER.exe
Task: {C704FD4C-8E4A-4220-8648-96EAFC3FEB1F} - System32\Tasks\{E1ED794A-7AB3-40DE-ADBA-AF44955CAC62} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Firefox Setup 3.5.3.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {CC194524-49E9-4CBC-B983-C7050A296EA4} - System32\Tasks\{320CF422-4574-45FA-B573-8A5B8191FD8B} => pcalua.exe -a C:\Users\Colin\Desktop\allwaysync-9-3-3.exe -d C:\Users\Colin\Desktop
Task: {CCE275BE-34BC-43FF-A8CF-556582AB14DA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {CD28F11A-E5CA-44AA-B696-DDE78E4247D1} - System32\Tasks\{E3FA109D-7A23-490F-AE3E-A44A2052D452} => C:\Program Files\GoogleChromePortable\GoogleChromePortable.exe
Task: {CF55C46D-CB4A-46BB-B3BF-A1A0B330B151} - System32\Tasks\{18831D3B-C26A-4DBB-8B62-A8F4BFB0005F} => C:\Program Files\AVS4YOU\AVSDVDPlayer\AVSDVDPlayer.exe
Task: {D0BC5511-A62D-447D-9B85-AD53B4225C10} - System32\Tasks\{F4BD35C7-6EAF-42B7-A54D-D2C5FCEF61EE} => C:\Program Files\Frameworkx\Vista Shortcut Manager\FxVisor.exe
Task: {D10A5BE4-8BE4-4E90-A152-93142420EB92} - System32\Tasks\{0CBB86E4-F1BE-4406-8F2F-788B1FCB6618} => pcalua.exe -a C:\Users\Colin\Desktop\SBAXVSD_PCDRV_LB_2_12_0002.exe -d C:\Users\Colin\Desktop
Task: {D1B257D9-181D-4E18-94E5-740A10E969A2} - System32\Tasks\{E52C03B8-8F0B-4B1A-92BC-272D96296EC3} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Adobe Flash Player 10\Firefox\install_flash_player.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\Adobe Flash Player 10\Firefox "
Task: {D5F98697-4F39-41F2-AF54-000C1ED5B037} - System32\Tasks\{1653B29E-9D4D-4FFA-BA80-A22B5E24D43A} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\unlocker1.8.8.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {D635FA3A-332D-47AE-AAAD-A1DC3E6F472F} - System32\Tasks\{19E45342-A564-4D1F-84A0-FD61A1DAA025} => pcalua.exe -a "C:\Users\Colin\Desktop\WMP 11 - setup for Windows 7.exe" -d C:\Users\Colin\Desktop
Task: {D6E59A7D-0DFD-4BA3-AF15-F7820E54374D} - System32\Tasks\Allway Sync_{414CB83C37CFC1ED394642E6448E2DB0} => C:\Program Files\Allway Sync\Bin\syncappw.exe [2015-10-29] ()
Task: {D9728183-F8B9-4DC3-BA43-F6AD228CB185} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2548019330-3924178630-1638020567-500 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {DAC3649B-1BCF-48F4-B6B6-2F3EEDEF0465} - System32\Tasks\{187BE5B6-38E0-4C71-8C23-2D05180CE601} => pcalua.exe -a C:\Users\Colin\Desktop\SUPERsetup.exe -d C:\Users\Colin\Desktop
Task: {DB9F5C64-7907-436F-9AF0-01F77AA13AC2} - System32\Tasks\{2E629B41-7A55-4BA5-A8A9-87480EFDB1E0} => msiexec.exe /package "C:\Users\Colin\Desktop\LS_HSI.msi "
Task: {DE4C1074-A247-4632-A368-BEEBD223B9E4} - System32\Tasks\{B7AF4550-FC7A-4542-8FD4-4E728667C301} => C:\Program Files\PhotoFiltre\PhotoFiltre.exe [2012-01-05] (Antonio Da Cruz)
Task: {DEF65B48-6E30-4CFC-AFB8-51FA0986105C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.)
Task: {DF00EFA4-A614-4466-850B-D637F41FC1A8} - System32\Tasks\{A3919EFB-CBC6-48DE-ACF9-3304D5B5FFC9} => pcalua.exe -a C:\Users\Colin\Desktop\allwaysync-9-4-1.exe -d C:\Users\Colin\Desktop
Task: {E0FF22D4-18F1-43C2-8221-DAB35B28A9D3} - System32\Tasks\{62C8B877-A94F-4C13-8998-DEB495064C5C} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\WMSetup.exe" -d "D:\Colin's Documents\Setup Programs "
Task: {E211AFF6-046E-47EC-9F68-FFD5FEF44FF4} - System32\Tasks\{A95244CF-271A-4867-BFB4-596B1AA076C5} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Portable Applications\Chromium_Portable_2.0.173.13130_MultiLang.paf.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\Portable Applications "
Task: {E2373004-E2A5-4727-A181-9F573379C968} - System32\Tasks\{AEC106E0-B4AC-4C48-8C12-8B4F039556B4} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\DTV Pro\TotalMedia\Setup.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs\DTV Pro\TotalMedia "
Task: {E5FB51FD-67A2-4BCE-AF45-448FB60F8C02} - System32\Tasks\CCleaner => C:\Program Files\CCleaner\CCleaner.exe [2016-02-12] (Piriform Ltd)
Task: {E66BD936-11CB-4CDE-8058-3D641DADE382} - System32\Tasks\{94A07836-DE86-4AF3-BE2E-4101F4899B49} => pcalua.exe -a "C:\Program Files\Nokia\Nokia PC Suite 7\ApplicationInstaller.exe" -c "C:\Users\Colin\Desktop\RoboFormS60_3rd.SISX "
Task: {E9E773DB-B9F6-4B98-9004-9CE280225261} - System32\Tasks\{96DBEE80-A36D-403A-9A90-D00536723794} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\QRM Plus\QRM Menu Setup.exe" -d "D:\Colin's Documents\Setup Programs\QRM Plus "
Task: {EAB6B0B6-E537-47FE-AA59-CABCF92A34AC} - System32\Tasks\{EECCEFD5-AC87-431F-BEFD-2F8CB2FF5EC2} => pcalua.exe -a C:\Users\Colin\Desktop\VIA_Rhine_Windows7_V1.12A\x86\WinSetup.exe -d C:\Users\Colin\Desktop\VIA_Rhine_Windows7_V1.12A\x86
Task: {EED7BC18-5A1A-4302-8DE0-0C7DEBCD027B} - System32\Tasks\{1516E6F3-ADD9-4128-9026-352998B49CB8} => C:\Program Files\Unlocker\uninst.exe [2015-04-05] ()
Task: {F2833F21-55D2-49C4-9048-8F0F590D661D} - System32\Tasks\{14ACDC8F-99A1-4B23-8CB2-B46C767AC1C6} => pcalua.exe -a C:\Users\Colin\Desktop\wlsetup-web.exe -d C:\Users\Colin\Desktop
Task: {F46DF289-5A3C-4D4F-8074-F5634D91CFD8} - System32\Tasks\{CCC98C6B-32E2-42FF-BFBE-3FDFBFCA65C7} => C:\Users\Colin\Desktop\MozBackup-1.4.9_EN.exe
Task: {F5D7469D-8C76-425B-BD9A-DBDCB391F2BD} - System32\Tasks\{0B6762F0-14AE-4A37-84AF-6181249028B4} => pcalua.exe -a C:\Users\Colin\Desktop\WMSetup\WMSetup.exe -d C:\Users\Colin\Desktop\WMSetup
Task: {F70708D4-5118-4DC2-9F6C-4B32740FEB51} - System32\Tasks\{F94043AC-B335-411A-BF7D-DC0A7D5B8E86} => pcalua.exe -a Z:\WINME\Setup.exe -d Z:\WINME
Task: {F8CF9CC8-AC21-45BA-A55D-05A6C84DCCAB} - System32\Tasks\{8607D285-E116-4053-9C67-34A2E49A7526} => pcalua.exe -a "D:\Colin's Documents\Setup Programs\My Setup Programs\Shockwave_Installer_Slim.exe" -d "D:\Colin's Documents\Setup Programs\My Setup Programs "
Task: {FAF5B02E-BA8E-4B4E-80CA-275D5C3CEBF4} - System32\Tasks\{87D991BF-C89F-41F1-9A9D-56B98E4DBDA2} => pcalua.exe -a "C:\Users\Colin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NEHLPQGU\vcredist_x86[1].exe" -d "C:\Program Files\Mozilla Firefox "
Task: {FF62897F-E00B-4404-89E3-D863FF7471F3} - System32\Tasks\{BA006039-566E-4B25-8E76-9BF7732171F2} => C:\Program Files\SIW\siw.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

 

Addition Second Run Log Part 2:

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2012-10-10 06:10 - 2012-08-31 14:01 - 00151552 _____ () C:\Windows\System32\HP1100LM.DLL
2009-08-22 09:12 - 2011-02-28 22:37 - 00180624 _____ () C:\Windows\System32\Primomonnt.dll
2010-10-17 15:19 - 2012-08-31 14:01 - 00069632 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\HP1100PP.DLL
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:46 - 2015-10-13 05:46 - 01040144 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-12-14 19:41 - 2015-10-29 12:44 - 00182784 _____ () C:\Program Files\Allway Sync\Bin\SyncService.exe
2016-03-16 13:45 - 2015-05-27 13:43 - 00046592 _____ () C:\Program Files\WindowManager\WindowManager.dll
2009-08-24 10:11 - 2011-03-02 11:40 - 00140288 _____ () C:\Program Files\WinRAR\rarext.dll
2016-03-15 16:06 - 2016-02-23 18:19 - 00034768 _____ () C:\Program Files\Dropbox\Client\_multiprocessing.pyd
2016-03-15 16:06 - 2016-02-23 18:20 - 00019408 _____ () C:\Program Files\Dropbox\Client\faulthandler.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00116688 _____ () C:\Program Files\Dropbox\Client\pywintypes27.dll
2016-03-15 16:06 - 2016-02-23 18:19 - 00093640 _____ () C:\Program Files\Dropbox\Client\_ctypes.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00018376 _____ () C:\Program Files\Dropbox\Client\select.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00019760 _____ () C:\Program Files\Dropbox\Client\tornado.speedups.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00105928 _____ () C:\Program Files\Dropbox\Client\win32api.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00392144 _____ () C:\Program Files\Dropbox\Client\pythoncom27.dll
2016-03-15 16:06 - 2016-03-12 00:18 - 00381752 _____ () C:\Program Files\Dropbox\Client\win32com.shell.shell.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00692688 _____ () C:\Program Files\Dropbox\Client\unicodedata.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020816 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2016-03-15 16:06 - 2016-02-23 18:20 - 00112592 _____ () C:\Program Files\Dropbox\Client\_cffi_backend.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 01682760 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020808 _____ () C:\Program Files\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020800 _____ () C:\Program Files\Dropbox\Client\_cffi_python_x66cf7a7cx17a72769.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00021840 _____ () C:\Program Files\Dropbox\Client\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00038696 _____ () C:\Program Files\Dropbox\Client\fastpath.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00020936 _____ () C:\Program Files\Dropbox\Client\mmapfile.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00024528 _____ () C:\Program Files\Dropbox\Client\win32event.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00114640 _____ () C:\Program Files\Dropbox\Client\win32security.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00124880 _____ () C:\Program Files\Dropbox\Client\win32file.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00021832 _____ () C:\Program Files\Dropbox\Client\_cffi_pywin_kernel32_x64d8f881xc8c369be.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32clipboard.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00175560 _____ () C:\Program Files\Dropbox\Client\win32gui.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00030160 _____ () C:\Program Files\Dropbox\Client\win32pipe.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00043472 _____ () C:\Program Files\Dropbox\Client\win32process.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00028616 _____ () C:\Program Files\Dropbox\Client\win32ts.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00048592 _____ () C:\Program Files\Dropbox\Client\win32service.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00026456 _____ () C:\Program Files\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00057808 _____ () C:\Program Files\Dropbox\Client\win32evtlog.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00024016 _____ () C:\Program Files\Dropbox\Client\win32profile.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00117056 _____ () C:\Program Files\Dropbox\Client\breakpad.client.windows.handler.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00024392 _____ () C:\Program Files\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00036296 _____ () C:\Program Files\Dropbox\Client\librsync.dll
2016-03-15 16:06 - 2016-03-12 00:18 - 00023376 _____ () C:\Program Files\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00134608 _____ () C:\Program Files\Dropbox\Client\_elementtree.pyd
2016-03-15 16:06 - 2016-02-23 18:19 - 00134088 _____ () C:\Program Files\Dropbox\Client\pyexpat.pyd
2016-03-15 16:06 - 2016-02-23 18:20 - 00240584 _____ () C:\Program Files\Dropbox\Client\jpegtran.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00052024 _____ () C:\Program Files\Dropbox\Client\psutil._psutil_windows.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020800 _____ () C:\Program Files\Dropbox\Client\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00021824 _____ () C:\Program Files\Dropbox\Client\winffi.kernel32._winffi_kernel32.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00019776 _____ () C:\Program Files\Dropbox\Client\winffi.winerror._winffi_winerror.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020800 _____ () C:\Program Files\Dropbox\Client\winffi.wininet._winffi_wininet.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00020280 _____ () C:\Program Files\Dropbox\Client\cpuid.compiled._cpuid.pyd
2016-03-15 16:06 - 2016-02-23 18:21 - 00350152 _____ () C:\Program Files\Dropbox\Client\winxpgui.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00022352 _____ () C:\Program Files\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00084792 _____ () C:\Program Files\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-03-15 16:06 - 2016-03-12 00:18 - 01826096 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtCore.pyd
2016-03-15 16:06 - 2016-02-23 18:20 - 00083912 _____ () C:\Program Files\Dropbox\Client\sip.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 03928880 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWidgets.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 01971504 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtGui.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00531248 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtNetwork.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00132912 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKit.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00223544 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00207672 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00158008 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00042808 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtWebChannel.pyd
2016-03-15 16:06 - 2016-02-23 18:23 - 00017864 _____ () C:\Program Files\Dropbox\Client\libEGL.dll
2016-03-15 16:06 - 2016-02-23 18:23 - 01631184 _____ () C:\Program Files\Dropbox\Client\libGLESv2.dll
2016-03-15 16:06 - 2016-03-12 00:18 - 00024904 _____ () C:\Program Files\Dropbox\Client\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00546096 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtQuick.pyd
2016-03-15 16:06 - 2016-03-12 00:18 - 00357680 _____ () C:\Program Files\Dropbox\Client\PyQt5.QtQml.pyd
2016-03-15 16:06 - 2016-02-23 18:25 - 00697304 _____ () C:\Program Files\Dropbox\Client\QtQuick\Controls\qtquickcontrolsplugin.dll
2012-12-24 06:53 - 2012-12-24 06:53 - 00081920 _____ () C:\Windows\system32\mvusbews.DLL
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2015-11-11 02:42 - 2015-11-11 02:42 - 01045672 _____ () C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2010-10-20 15:08 - 2010-10-20 15:08 - 00122720 _____ () C:\Program Files\Microsoft Office\Office14\OUTLCTL.DLL

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51 [298]
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [134]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\amazon.co.uk -> hxxps://amazon.co.uk
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7867 more sites.

IE trusted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\amazon.co.uk -> hxxps://amazon.co.uk
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\...\1-2005-search.com -> www.1-2005-search.com

There are 12680 more sites.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-07-08 17:20 - 2016-03-15 01:23 - 00000841 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2548019330-3924178630-1638020567-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Colin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: Lavasoft Ad-Aware Service => 3
MSCONFIG\Services: NMIndexingService => 3

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [UDP Query User{7120DC0E-2BCC-41F3-9294-4B9CEBB215CC}C:\windows\system32\mmc.exe] => (Allow) C:\windows\system32\mmc.exe
FirewallRules: [TCP Query User{5CB061FD-A0BA-42CB-A4B2-220099759D6A}C:\windows\system32\mmc.exe] => (Allow) C:\windows\system32\mmc.exe
FirewallRules: [{85C0ED59-EEDC-4DE6-92E2-E55C905FCD62}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{E47B67C2-CDE5-4D79-AD67-713D1AB0DC39}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{6E298CB6-390B-464B-97A2-6E60A3C12F47}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{5247BCD2-C4C6-4203-85F2-E65AB4E91C98}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{72E27FE9-5C79-4200-8FB8-E68345DC1E00}] => (Allow) svchost.exe
FirewallRules: [UDP Query User{3507CA9E-D1C6-4999-BD68-9A68F5CC50F6}C:\program files\windows sidebar\sidebar.exe] => (Allow) C:\program files\windows sidebar\sidebar.exe
FirewallRules: [TCP Query User{2F900F9A-F346-4160-BEA2-0D947ED7F997}C:\program files\windows sidebar\sidebar.exe] => (Allow) C:\program files\windows sidebar\sidebar.exe
FirewallRules: [TCP Query User{E7052CD0-8D59-4329-97D7-4C96EE02F42E}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{19A68877-3592-4088-96D1-D2F60D73512D}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{CB70F867-AC97-43CE-8D47-7B43E63B811F}C:\windows\system32\wfs.exe] => (Allow) C:\windows\system32\wfs.exe
FirewallRules: [UDP Query User{41C55738-B45E-4259-AFC2-29E120E14F8B}C:\windows\system32\wfs.exe] => (Allow) C:\windows\system32\wfs.exe
FirewallRules: [TCP Query User{28A3DCEA-88A9-4565-91B1-04FDC35EEF5E}C:\program files\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files\google\google earth\plugin\geplugin.exe
FirewallRules: [UDP Query User{CEE640AB-CA4A-437F-9BCD-45BF79D7ABBC}C:\program files\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files\google\google earth\plugin\geplugin.exe
FirewallRules: [TCP Query User{AF8E9AC6-096C-467D-A0E6-227BD8315E6A}C:\program files\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files\google\google earth\plugin\geplugin.exe
FirewallRules: [UDP Query User{8A9CE77A-A84F-4BFC-896C-6DC2F5D95B60}C:\program files\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files\google\google earth\plugin\geplugin.exe
FirewallRules: [TCP Query User{FECEB3D4-DD95-43E8-AA0A-93AD28F396BC}C:\program files\windows sidebar\sidebar.exe] => (Allow) C:\program files\windows sidebar\sidebar.exe
FirewallRules: [UDP Query User{88F16081-90F8-4941-8CEE-536B1E561877}C:\program files\windows sidebar\sidebar.exe] => (Allow) C:\program files\windows sidebar\sidebar.exe
FirewallRules: [{2D738BC2-6D2F-4DA2-BBDD-C8059807A167}] => (Allow) C:\Windows\System32\muzapp.exe
FirewallRules: [{47C756BE-8786-4FB1-9905-7D95AC378194}] => (Allow) C:\Windows\System32\muzapp.exe
FirewallRules: [{1CD8B5CB-55A6-49A3-B594-D130FF2C3D6C}] => (Allow) LPort=7878
FirewallRules: [{D3CBAFF4-7859-4811-AF32-1814FBE1AC74}] => (Allow) LPort=20102
FirewallRules: [{7FE84580-E774-4A8E-A547-76FFA7AA01C6}] => (Allow) LPort=1900
FirewallRules: [{6480EC6E-ED4E-4684-99BC-78FD31715FB1}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{5B33FFD9-1C09-48FA-86B4-56034D239E5E}] => (Allow) C:\Program Files\Dropbox\Client\Dropbox.exe
FirewallRules: [{495E253D-E08A-4CDD-B87C-8B8A7560B1E9}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9EA88028-3C22-4B64-A79A-1F1EB58D5256}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2B956730-D7C5-45A4-A0DD-7E73EE251D20}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{BEF12B22-DB00-458B-B42B-475E09241B80}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{176029A3-0C27-4E37-BDFF-D9A3C6F5C04F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{E51220E1-1078-4977-A78B-F690ED13CF84}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{AC9F9683-CA95-45C7-BE76-6FDC0765811E}] => (Allow) LPort=2869
FirewallRules: [{8062AA14-3B30-48E3-BA34-B54B9B34A2C1}] => (Allow) LPort=1900

==================== Restore Points =========================

16-03-2016 22:29:31 Installed ISO Recorder
17-03-2016 01:37:32 JRT Pre-Junkware Removal
17-03-2016 01:55:12 Removed Adblock Plus for IE (32-bit)
17-03-2016 09:00:03 Created a Restore Point now
17-03-2016 12:41:22 Windows Live Essentials
17-03-2016 12:42:27 Installed DirectX
17-03-2016 12:43:01 Installed DirectX
17-03-2016 12:43:27 Installed DirectX
17-03-2016 12:44:04 WLSetup
17-03-2016 12:50:39 Removed Internet TV for Windows Media Center

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/17/2016 04:43:34 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program psi.exe version 3.0.0.11005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 7e0

Start Time: 01d1806bedc3f7fc

Termination Time: 26

Application Path: C:\Program Files\Secunia\PSI\psi.exe

Report Id: 59d9e5ce-ec5f-11e5-b980-00248cbacfc7

Error: (03/17/2016 07:55:27 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Faulting module name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Exception code: 0xc0000005
Fault offset: 0x00002833
Faulting process id: 0xde8
Faulting application start time: 0xmtee.3XE0
Faulting application path: mtee.3XE1
Faulting module path: mtee.3XE2
Report Id: mtee.3XE3

Error: (03/17/2016 07:55:16 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Faulting module name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Exception code: 0xc0000005
Fault offset: 0x00002833
Faulting process id: 0x116c
Faulting application start time: 0xmtee.3XE0
Faulting application path: mtee.3XE1
Faulting module path: mtee.3XE2
Report Id: mtee.3XE3

Error: (03/17/2016 07:54:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Faulting module name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Exception code: 0xc0000005
Fault offset: 0x00002833
Faulting process id: 0xa58
Faulting application start time: 0xmtee.3XE0
Faulting application path: mtee.3XE1
Faulting module path: mtee.3XE2
Report Id: mtee.3XE3

Error: (03/17/2016 07:54:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Faulting module name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Exception code: 0xc0000005
Fault offset: 0x00002833
Faulting process id: 0x1604
Faulting application start time: 0xmtee.3XE0
Faulting application path: mtee.3XE1
Faulting module path: mtee.3XE2
Report Id: mtee.3XE3

Error: (03/17/2016 07:54:44 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Faulting module name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Exception code: 0xc0000005
Fault offset: 0x00002833
Faulting process id: 0xb58
Faulting application start time: 0xmtee.3XE0
Faulting application path: mtee.3XE1
Faulting module path: mtee.3XE2
Report Id: mtee.3XE3

Error: (03/17/2016 07:54:40 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Faulting module name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Exception code: 0xc0000005
Fault offset: 0x00002833
Faulting process id: 0x610
Faulting application start time: 0xmtee.3XE0
Faulting application path: mtee.3XE1
Faulting module path: mtee.3XE2
Report Id: mtee.3XE3

Error: (03/17/2016 07:54:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Faulting module name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Exception code: 0xc0000005
Fault offset: 0x00002833
Faulting process id: 0x564
Faulting application start time: 0xmtee.3XE0
Faulting application path: mtee.3XE1
Faulting module path: mtee.3XE2
Report Id: mtee.3XE3

Error: (03/17/2016 07:54:30 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Faulting module name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Exception code: 0xc0000005
Fault offset: 0x00002833
Faulting process id: 0xdb0
Faulting application start time: 0xmtee.3XE0
Faulting application path: mtee.3XE1
Faulting module path: mtee.3XE2
Report Id: mtee.3XE3

Error: (03/17/2016 07:54:24 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Faulting module name: mtee.3XE, version: 2.0.0.0, time stamp: 0x3f4d232a
Exception code: 0xc0000005
Fault offset: 0x00002833
Faulting process id: 0x12e0
Faulting application start time: 0xmtee.3XE0
Faulting application path: mtee.3XE1
Faulting module path: mtee.3XE2
Report Id: mtee.3XE3


System errors:
=============
Error: (03/17/2016 10:17:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The BlueSoleilCS service failed to start due to the following error:
%%2

Error: (03/17/2016 10:17:25 PM) (Source: NETLOGON) (EventID: 3095) (User: )
Description: This computer is configured as a member of a workgroup, not as
a member of a domain. The Netlogon service does not need to run in this
configuration.

Error: (03/17/2016 09:14:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The BlueSoleilCS service failed to start due to the following error:
%%2

Error: (03/17/2016 09:14:28 PM) (Source: NETLOGON) (EventID: 3095) (User: )
Description: This computer is configured as a member of a workgroup, not as
a member of a domain. The Netlogon service does not need to run in this
configuration.

Error: (03/17/2016 06:28:54 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The BlueSoleilCS service failed to start due to the following error:
%%2

Error: (03/17/2016 06:28:51 PM) (Source: NETLOGON) (EventID: 3095) (User: )
Description: This computer is configured as a member of a workgroup, not as
a member of a domain. The Netlogon service does not need to run in this
configuration.

Error: (03/17/2016 11:31:13 AM) (Source: WMPNetworkSvc) (EventID: 14365) (User: )
Description: 0x80004004-1

Error: (03/17/2016 10:25:49 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 20.

Error: (03/17/2016 08:13:48 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The BlueSoleilCS service failed to start due to the following error:
%%2

Error: (03/17/2016 08:13:47 AM) (Source: NETLOGON) (EventID: 3095) (User: )
Description: This computer is configured as a member of a workgroup, not as
a member of a domain. The Netlogon service does not need to run in this
configuration.


==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz
Percentage of memory in use: 74%
Total physical RAM: 2038.24 MB
Available physical RAM: 516.63 MB
Total Virtual: 5095.24 MB
Available Virtual: 3483.09 MB

==================== Drives ================================

Drive c: (Windows 7 Professional) (Fixed) (Total:99.61 GB) (Free:39.71 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:144.53 GB) (Free:58.34 GB) NTFS
Drive e: (Other Data) (Fixed) (Total:221.62 GB) (Free:94.02 GB) NTFS
Drive f: (Data Backup) (Fixed) (Total:152.67 GB) (Free:48.91 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 000D6D5B)
Partition 1: (Active) - (Size=99.6 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=144.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=221.6 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 152.7 GB) (Disk ID: 0D2D0D2C)
Partition 1: (Not Active) - (Size=152.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================