Solved Is malware making IE to stop working?

broni, when I clicked on fixlist.txt in the Attached Files block in your latest post, a message opened -- titled "Opening fixlist.txt" -- that gives me 2 options: Open with Notepad (default) and Save File. I usually opt for Save File when I download something and it downloads into C:\Downloads\Temporary and then I click on the downloaded file there. Is that what I should do this time?

 

Here's the first batch of the Fixlog:

Fix result of Farbar Recovery Scan Tool (x64) Version: 22-05-2017
Ran by Gayle (27-05-2017 10:55:36) Run:1
Running from C:\Downloads\Temporary
Loaded Profiles: UpdatusUser & Gayle (Available Profiles: UpdatusUser & Gayle)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
ShellExecuteHooks: No Name - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - -> No File
ShellExecuteHooks-x32: No Name - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - -> No File
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-3812855668-3064132733-4185535367-1000 -> {2BAF436E-4041-42B3-91B5-CEBE04B2855E} URL =
SearchScopes: HKU\S-1-5-21-3812855668-3064132733-4185535367-1002 -> DefaultScope {ED1C8FFB-0094-4EAA-BB0C-583683CBAE34} URL =
BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll => No File
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton AntiVirus\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NAVENG; \??\C:\Program Files (x86)\Norton AntiVirus\NortonData\22.5.0.124\Definitions\SDSDefs\20170508.001\NAVENG.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton AntiVirus\NortonData\22.5.0.124\Definitions\SDSDefs\20170508.001\NAVEX15.SYS [X]
S3 NVHDA; system32\drivers\nvhda64v.sys [X]
2011-02-17 14:41 - 2011-02-17 14:41 - 0000268 ___RH () C:\Users\Gayle\AppData\Roaming\Pipe Organ
2011-02-17 14:43 - 2011-02-17 14:43 - 0000268 ___RH () C:\Users\Gayle\AppData\Roaming\Plants
2014-07-28 10:49 - 2014-07-28 10:49 - 0003584 _____ () C:\Users\Gayle\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-03-31 08:05 - 2011-03-31 08:05 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2011-02-17 14:41 - 2016-12-05 17:11 - 0000020 ____H () C:\ProgramData\PKP_DLdu.DAT
2011-02-17 14:43 - 2012-10-20 14:12 - 0000020 ____H () C:\ProgramData\PKP_DLdw.DAT
2011-02-17 14:41 - 2011-02-17 14:41 - 0000268 ___RH () C:\ProgramData\Plug-Ins
2011-02-17 14:43 - 2011-02-17 14:43 - 0000268 ___RH () C:\ProgramData\Podcasting
2011-02-17 14:41 - 2011-02-17 14:41 - 0000012 ___RH () C:\ProgramData\Printer Icons
2011-02-17 14:43 - 2011-02-17 14:43 - 0000012 ___RH () C:\ProgramData\Profiles
CustomCLSID: HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Gayle\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\Gayle\AppData\Local\Google\Update\1.3.30.3\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\Gayle\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\Gayle\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Gayle\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{8C46158B-D978-483C-A312-16EE5013BE04}\InprocServer32 -> C:\Users\Gayle\AppData\Local\Google\Update\1.3.33.3\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\Gayle\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\Gayle\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\Gayle\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File
Task: {B020F68D-7E12-44A5-8768-95F90CC626DC} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION
Task: {FBF94E84-4C04-42FC-A52E-EA47B891CC4F} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION
AlternateDataStreams: C:\Windows\explorer.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\HelpPane.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\acmigration.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\aelupsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\aepic.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\aitstatic.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\apphelp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\appinfo.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\asycfilt.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\atmfd.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\audiodg.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\AudioEng.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\AUDIOKSE.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\AudioSes.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\audiosrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\authui.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\basesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\bcdedit.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\blackbox.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\catsrvut.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\centel.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\cewmdm.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\chajei.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\ci.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\cintlgnt.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\clfs.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\COLORCNV.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\comsvcs.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\consent.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\CPFilters.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\cryptsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\cryptui.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\d3d10level9.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\d3d10warp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\davclnt.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\dciman32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\devenum.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\devinv.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\diagtrack.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\dns-sd.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\drmmgrtn.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\drmv2clt.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\dwmapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\DWrite.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\dxmasf.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\els.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\EncDec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\EncDump.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\evr.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\ExplorerFrame.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\fixmapi.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\FntCache.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\fontsub.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\FwRemoteSvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\GEARAspi64.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\gpapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\hlink.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\icaapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\icm32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\IMJP10.IME:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\IMJP10K.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\imkr80.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\inetcomm.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\inetpp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\inetppui.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\INETRES.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\InkEd.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\invagent.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\IPSECSVC.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\KBDAZE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\KBDAZEL.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\kbdgeoqw.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\ksproxy.ax:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\ksuser.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\localspl.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\lpk.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mcmde.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mcupdate_GenuineIntel.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mf.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mferror.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mfmjpegdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mfplat.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mfpmp.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mfps.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mfvdsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\MFWMAAEC.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\MP3DMOD.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MP43DECD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\MP4SDECD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\MPG4DECD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mscms.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msctf.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msdxm.ocx:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msi.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msiexec.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msihnd.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msimsg.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msmmsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msmpeg2adec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\MSMPEG2ENC.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msmpeg2vdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msnetobj.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msscp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mstscax.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msxml3.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msxml3r.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msxml6.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\msxml6r.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\netbtugc.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\nlasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\nlsbres.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\ntprint.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\ntprint.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\pcadm.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\pcaevts.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\pcalua.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\pcasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\pcawrk.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\perftrack.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\phon.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\pintlgnt.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\polstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\poqexec.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\powertracker.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\profsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\qasf.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\qdvd.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\qedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\qintlgnt.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\quartz.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\quick.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\rdpcorets.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\rdpudd.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\rdvidcrl.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\RESAMPLEDMO.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\rrinstaller.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\samsrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\scavengeui.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\scesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\sdbinst.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\seclogon.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\shell32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\shimeng.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\spwmp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\SysFxUI.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\sysmain.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\tdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\tintlgnt.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\tsgqec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\TSWbPrxy.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\ubpm.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\ucrtbase.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\usp10.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\UtcResources.dll:$CmdTcID [64]

 

Here's the second batch of Fixlog:

AlternateDataStreams: C:\Windows\system32\UtcResources.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\VIDRESZR.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WcsPlugInService.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\wdi.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\WebClnt.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\win32spl.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WindowsCodecs.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\winipsec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\winload.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\wksprt.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\WMADMOD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WMADMOE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WMALFXGFXDSP.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\wmdrmsdk.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\wmp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WMPhoto.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\wmpmde.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WMSPDMOD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WMSPDMOE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WMVDECOD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WMVENCOD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WMVSDECD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WMVSENCD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WMVXENCD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\wpnpinst.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\wshrm.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WSManHTTPConfig.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WSManMigrationPlugin.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WsmAuto.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\wsmplpxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\wsmprovhost.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WsmRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WsmSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WsmWmiPl.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\apphelp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\asycfilt.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\atmfd.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\AudioEng.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\AUDIOKSE.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\AudioSes.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\authui.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\blackbox.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\catsrvut.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\cewmdm.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\chajei.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\cintlgnt.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\clfsw32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\COLORCNV.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\comsvcs.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\CPFilters.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\cryptsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\cryptui.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3d10level9.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3d10warp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\davclnt.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\dciman32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\devenum.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\dns-sd.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\drmmgrtn.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\drmv2clt.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\dwmapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\dwmcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\DWrite.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\dxmasf.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\els.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\EncDec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\evr.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\explorer.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\ExplorerFrame.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\fixmapi.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\fontsub.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\FwRemoteSvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\GEARAspi.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\gpapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\GPhotos.scr:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\hlink.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\icm32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\IMJP10.IME:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\IMJP10K.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\imkr80.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\inetcomm.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\INETRES.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\InkEd.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\KBDAZE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\KBDAZEL.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\kbdgeoqw.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\ksproxy.ax:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\ksuser.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\lpk.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\mapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\mapistub.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\mf.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\mferror.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\mfmjpegdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\mfplat.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\mfpmp.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\mfps.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\mfvdsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\MFWMAAEC.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MP3DMOD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\MP43DECD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\MP4SDECD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\MPG4DECD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\mscms.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msctf.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\msdxm.ocx:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msi.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msiexec.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msihnd.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msimsg.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msmpeg2adec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\MSMPEG2ENC.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msmpeg2vdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msnetobj.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msscp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\mstscax.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msxml3.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msxml3r.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msxml6.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msxml6r.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\ncsi.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\nlaapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\nlsbres.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\notepad.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\ntprint.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\ntprint.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\olepro32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\phon.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\pintlgnt.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\polstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\poqexec.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\qasf.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\qdvd.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\qedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\qintlgnt.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\quartz.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\quick.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\rdvidcrl.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\RESAMPLEDMO.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\rrinstaller.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\scesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\sdbinst.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\shell32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\shimeng.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\spwmp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\tdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\tintlgnt.ime:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\tsgqec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\ubpm.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\ucrtbase.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\usp10.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\VIDRESZR.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WcsPlugInService.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\wdi.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\WebClnt.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\win32spl.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WindowsCodecs.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\winipsec.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WMADMOD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WMADMOE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\wmdrmsdk.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\wmp.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WMPhoto.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\wmpmde.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WMSPDMOD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WMSPDMOE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WMVDECOD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WMVENCOD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WMVSDECD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WMVSENCD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WMVXENCD.DLL:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\wshrm.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WSManHTTPConfig.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WSManMigrationPlugin.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WsmAuto.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\wsmplpxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\wsmprovhost.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WsmRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WsmSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\WsmWmiPl.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\bowser.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\cng.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\dfsc.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\drmk.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\drmkaud.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\http.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\mbam.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\mbamchameleon.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\mountmgr.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\mrxdav.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\mwac.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\ndis.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\PEAuth.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\portcls.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\rmcast.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\stream.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\tssecsrv.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\usbccgp.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\usbd.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\usbehci.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\usbhub.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\usbohci.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\usbport.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\usbuhci.sys:$CmdTcID [64]
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [125]

 

Here's the third batch of Fixlog:

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [125]
AlternateDataStreams: C:\Users\Gayle\Downloads\AdobeAIRInstaller.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Gayle\Downloads\AdobeAIRInstaller.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Gayle\Downloads\AdobeAir_17.0.0.144_SPS.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Gayle\Downloads\AdobeAir_17.0.0.144_SPS.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Gayle\Downloads\AdobeFlashPlayer_17.0.0.188_NPAPI_SPS.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Gayle\Downloads\AdobeFlashPlayer_17.0.0.188_NPAPI_SPS.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Gayle\Downloads\AdobeReader_11.0.10_en-US_SPS.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Gayle\Downloads\JavaJRE_7u71_32-bit_PSIonlySPS.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Gayle\Downloads\JavaJRE_7u71_32-bit_PSIonlySPS.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Gayle\Downloads\spywareblastersetup55.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Gayle\Downloads\spywareblastersetup55.exe:$CmdZnID [26]

*****************

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist => key removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} => value removed successfully
HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972} => key not found.
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} => value removed successfully
HKCR\Wow6432Node\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972} => key not found.
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
C:\Windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully
HKLM\SOFTWARE\Policies\Google => key removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully
HKU\S-1-5-21-3812855668-3064132733-4185535367-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2BAF436E-4041-42B3-91B5-CEBE04B2855E} => key removed successfully
HKCR\CLSID\{2BAF436E-4041-42B3-91B5-CEBE04B2855E} => key not found.
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => key removed successfully
HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => key removed successfully
HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C} => key removed successfully
HKCR\Wow6432Node\CLSID\{6D53EC84-6AAE-4787-AEEE-F4628F01010C} => key not found.
HKLM\System\CurrentControlSet\Services\catchme => key removed successfully
catchme => service removed successfully
HKLM\System\CurrentControlSet\Services\NAVENG => could not remove key. Access Denied.
HKLM\System\CurrentControlSet\Services\NAVEX15 => could not remove key. Access Denied.
HKLM\System\CurrentControlSet\Services\NVHDA => key removed successfully
NVHDA => service removed successfully
C:\Users\Gayle\AppData\Roaming\Pipe Organ => moved successfully
C:\Users\Gayle\AppData\Roaming\Plants => moved successfully
C:\Users\Gayle\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
C:\ProgramData\ezsidmv.dat => moved successfully
C:\ProgramData\PKP_DLdu.DAT => moved successfully
C:\ProgramData\PKP_DLdw.DAT => moved successfully
C:\ProgramData\Plug-Ins => moved successfully
C:\ProgramData\Podcasting => moved successfully
C:\ProgramData\Printer Icons => moved successfully
C:\ProgramData\Profiles => moved successfully
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448} => key removed successfully
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856} => key removed successfully
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4} => key removed successfully
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E} => key removed successfully
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247} => key removed successfully
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{8C46158B-D978-483C-A312-16EE5013BE04} => key removed successfully
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA} => key removed successfully
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2} => key removed successfully
HKU\S-1-5-21-3812855668-3064132733-4185535367-1002_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B020F68D-7E12-44A5-8768-95F90CC626DC} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B020F68D-7E12-44A5-8768-95F90CC626DC} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FBF94E84-4C04-42FC-A52E-EA47B891CC4F} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FBF94E84-4C04-42FC-A52E-EA47B891CC4F} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Activation Technologies\ValidationTask => key removed successfully
C:\Windows\explorer.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\HelpPane.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\acmigration.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\adsmsext.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\aelupsvc.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\aepic.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\aitstatic.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\apphelp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\appinfo.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\asycfilt.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\atmfd.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\atmlib.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\audiodg.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\AudioEng.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\AUDIOKSE.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\AudioSes.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\audiosrv.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\authui.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\basesrv.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\bcdedit.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\blackbox.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\catsrvut.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\centel.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\cewmdm.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\chajei.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\ci.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\cintlgnt.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\clfs.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\COLORCNV.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\comsvcs.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\consent.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\CPFilters.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\cryptsp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\cryptui.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\d3d10level9.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\d3d10warp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\davclnt.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\dciman32.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\devenum.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\devinv.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\diagtrack.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\dns-sd.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\drmmgrtn.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\drmv2clt.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\dwmapi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\DWrite.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\dxmasf.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\els.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\EncDec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\EncDump.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\evr.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\ExplorerFrame.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\fixmapi.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\FntCache.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\fontsub.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\FwRemoteSvr.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\GEARAspi64.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\gpapi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\hlink.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\icaapi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\icm32.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\IMJP10.IME => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\IMJP10K.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\imkr80.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\inetcomm.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\inetpp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\inetppui.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\INETRES.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\InkEd.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\input.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\invagent.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\IPSECSVC.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\KBDAZE.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\KBDAZEL.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\kbdgeoqw.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\ksproxy.ax => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\ksuser.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\localspl.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\lpk.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\mcmde.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\mcupdate_GenuineIntel.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\mf.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\mferror.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\mfmjpegdec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\mfplat.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\mfpmp.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\mfps.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\mfvdsp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\MFWMAAEC.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\MP3DMOD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\MP43DECD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\MP4SDECD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\MPG4DECD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\mscms.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msctf.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msdxm.ocx => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msiexec.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msihnd.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msimsg.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msmmsp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msmpeg2adec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\MSMPEG2ENC.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msmpeg2vdec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msnetobj.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msscp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\mstscax.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\MSVidCtl.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msxml3.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msxml3r.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msxml6.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\msxml6r.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\netbtugc.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\nlasvc.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\nlsbres.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\ntprint.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\ntprint.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\pcadm.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\pcaevts.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\pcalua.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\pcasvc.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\pcawrk.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\perftrack.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\phon.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\pintlgnt.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\polstore.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\poqexec.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\powertracker.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\profsvc.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\qasf.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\qdvd.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\qedit.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\qintlgnt.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\quartz.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\quick.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\rdpcorets.dll => ":$CmdTcID" ADS could not remove.

 

Here's the last batch of Fixlog:

C:\Windows\system32\rdpudd.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\rdvidcrl.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\RESAMPLEDMO.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\rrinstaller.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\samlib.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\samsrv.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\scavengeui.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\scesrv.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\sdbinst.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\seclogon.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\shell32.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\shimeng.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\spwmp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\SysFxUI.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\sysmain.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\tdh.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\tintlgnt.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\tsgqec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\TSWbPrxy.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\ubpm.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\ucrtbase.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\UIAnimation.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\user32.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\usp10.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\UtcResources.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\VIDRESZR.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WcsPlugInService.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\wdi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WebClnt.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\win32spl.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WindowsCodecs.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\winipsec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\winload.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\wksprt.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WMADMOD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WMADMOE.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WMALFXGFXDSP.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\wmdrmsdk.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\wmp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WMPhoto.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\wmploc.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\wmpmde.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WMSPDMOD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WMSPDMOE.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WMVDECOD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WMVENCOD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WMVSDECD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WMVSENCD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WMVXENCD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\wpnpinst.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\wshrm.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WSManHTTPConfig.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WSManMigrationPlugin.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WsmAuto.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\wsmplpxy.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\wsmprovhost.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WsmRes.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WsmSvc.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\WsmWmiPl.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\adsmsext.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\apphelp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\asycfilt.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\atmfd.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\atmlib.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\AudioEng.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\AUDIOKSE.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\AudioSes.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\authui.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\blackbox.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\catsrvut.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\cewmdm.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\chajei.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\cintlgnt.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\clfsw32.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\COLORCNV.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\comsvcs.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\CPFilters.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\cryptsp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\cryptui.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\d3d10level9.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\d3d10warp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\davclnt.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\dciman32.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\devenum.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\dns-sd.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\drmmgrtn.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\drmv2clt.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\dwmapi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\dwmcore.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\DWrite.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\dxmasf.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\els.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\EncDec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\evr.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\explorer.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\ExplorerFrame.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\fixmapi.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\fontsub.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\FwRemoteSvr.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\GEARAspi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\gpapi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\GPhotos.scr => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\hlink.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\icm32.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\IMJP10.IME => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\IMJP10K.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\imkr80.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\inetcomm.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\INETRES.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\InkEd.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\input.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\KBDAZE.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\KBDAZEL.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\kbdgeoqw.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\ksproxy.ax => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\ksuser.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\lpk.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\mapi32.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\mapistub.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\mf.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\mferror.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\mfmjpegdec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\mfplat.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\mfpmp.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\mfps.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\mfvdsp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\MFWMAAEC.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\MP3DMOD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\MP43DECD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\MP4SDECD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\MPG4DECD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\mscms.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msctf.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msdxm.ocx => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msiexec.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msihnd.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msimsg.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msmpeg2adec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\MSMPEG2ENC.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msmpeg2vdec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msnetobj.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msscp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\mstscax.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\MSVidCtl.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msxml3.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msxml3r.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msxml6.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\msxml6r.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\ncsi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\nlaapi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\nlsbres.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\notepad.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\ntprint.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\ntprint.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\olepro32.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\phon.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\pintlgnt.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\polstore.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\poqexec.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\qasf.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\qdvd.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\qedit.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\qintlgnt.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\quartz.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\quick.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\rdvidcrl.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\RESAMPLEDMO.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\rrinstaller.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\samlib.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\scesrv.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\sdbinst.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\shell32.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\shimeng.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\spwmp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\tdh.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\tintlgnt.ime => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\tsgqec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\ubpm.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\ucrtbase.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\UIAnimation.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\user32.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\usp10.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\VIDRESZR.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WcsPlugInService.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\wdi.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WebClnt.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\win32spl.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WindowsCodecs.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\winipsec.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WMADMOD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WMADMOE.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\wmdrmsdk.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\wmp.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WMPhoto.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\wmploc.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\wmpmde.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WMSPDMOD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WMSPDMOE.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WMVDECOD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WMVENCOD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WMVSDECD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WMVSENCD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WMVXENCD.DLL => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\wshrm.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WSManHTTPConfig.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WSManMigrationPlugin.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WsmAuto.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\wsmplpxy.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\wsmprovhost.exe => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WsmRes.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WsmSvc.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\SysWOW64\WsmWmiPl.dll => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\bowser.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\cng.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\dfsc.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\drmk.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\drmkaud.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\http.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\mbam.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\mbamchameleon.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\mountmgr.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\mrxdav.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\mwac.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\ndis.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\PEAuth.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\portcls.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\rmcast.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\stream.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\tssecsrv.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\usbccgp.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\usbd.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\usbehci.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\usbhub.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\usbohci.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\usbport.sys => ":$CmdTcID" ADS could not remove.
C:\Windows\system32\Drivers\usbuhci.sys => ":$CmdTcID" ADS could not remove.
C:\ProgramData\TEMP => ":5C321E34" ADS removed successfully.
C:\Users\Gayle\Downloads\AdobeAIRInstaller.exe => ":$CmdTcID" ADS could not remove.
C:\Users\Gayle\Downloads\AdobeAIRInstaller.exe => ":$CmdZnID" ADS removed successfully.
C:\Users\Gayle\Downloads\AdobeAir_17.0.0.144_SPS.exe => ":$CmdTcID" ADS could not remove.
C:\Users\Gayle\Downloads\AdobeAir_17.0.0.144_SPS.exe => ":$CmdZnID" ADS removed successfully.
C:\Users\Gayle\Downloads\AdobeFlashPlayer_17.0.0.188_NPAPI_SPS.exe => ":$CmdTcID" ADS could not remove.
C:\Users\Gayle\Downloads\AdobeFlashPlayer_17.0.0.188_NPAPI_SPS.exe => ":$CmdZnID" ADS removed successfully.
C:\Users\Gayle\Downloads\AdobeReader_11.0.10_en-US_SPS.exe => ":$CmdZnID" ADS removed successfully.
C:\Users\Gayle\Downloads\JavaJRE_7u71_32-bit_PSIonlySPS.exe => ":$CmdTcID" ADS could not remove.
C:\Users\Gayle\Downloads\JavaJRE_7u71_32-bit_PSIonlySPS.exe => ":$CmdZnID" ADS removed successfully.
C:\Users\Gayle\Downloads\spywareblastersetup55.exe => ":$CmdTcID" ADS could not remove.
C:\Users\Gayle\Downloads\spywareblastersetup55.exe => ":$CmdZnID" ADS removed successfully.

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 27-05-2017 10:58:12)


Result of scheduled keys to remove after reboot:

HKLM\System\CurrentControlSet\Services\NAVENG => could not remove key. Access Denied.
HKLM\System\CurrentControlSet\Services\NAVEX15 => could not remove key. Access Denied.

==== End of Fixlog 10:58:13 ====

 

I downloaded SecurityCheck.exe but when I double-clicked on it I got an error message that SecurityCheck.exe is not a valid Win32 application. Tried again, same result. I did a Restart and got the same result again. And again. The thing won't run, and doesn't give me any way to proceed. What do I do now, disable Norton A-V (although the warning doesn't appear to be a NAV warning)?

 

Here's the FSS log:

Farbar Service Scanner Version: 27-01-2016
Ran by Gayle (administrator) on 27-05-2017 at 19:24:41
Running from "C:\Downloads\Temporary"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is OK.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.

Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.

Nsi Service is not running. Checking service configuration:
The start type of Nsi service is OK.
The ImagePath of Nsi service is OK.
The ServiceDll of Nsi service is OK.

nsiproxy Service is not running. Checking service configuration:
The start type of nsiproxy service is OK.
The ImagePath of nsiproxy service is OK.

tdx Service is not running. Checking service configuration:
The start type of tdx service is OK.
The ImagePath of tdx service is OK.

afd Service is not running. Checking service configuration:
The start type of afd service is OK.
The ImagePath of afd service is OK.

Tcpip Service is not running. Checking service configuration:
The start type of Tcpip service is OK.
The ImagePath of Tcpip service is OK.


Connection Status:
==============
Attempt to access Local Host IP returned error: Localhost is blocked: Destination is unreachable
LAN connected.
Attempt to access Google IP returned error. Google IP is unreachable
Attempt to access Google.com returned error: Google.com is unreachable
Attempt to access Yahoo.com returned error: Yahoo.com is unreachable


Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is OK.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.

bfe Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
The ServiceDll of bfe service is OK.


Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.

VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.


System Restore Policy:
========================


Action Center:
============

wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.

winmgmt Service is not running. Checking service configuration:
The start type of winmgmt service is OK.
The ImagePath of winmgmt: "%systemroot%\system32\svchost.exe -k netsvcs".
The ServiceDll of winmgmt service is OK.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.

BITS Service is not running. Checking service configuration:
The start type of BITS service is set to Demand. The default start type is Auto.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.

EventSystem Service is not running. Checking service configuration:
The start type of EventSystem service is OK.
The ImagePath of EventSystem service is OK.
The ServiceDll of EventSystem service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

PlugPlay Service is not running. Checking service configuration:
The start type of PlugPlay service is OK.
The ImagePath of PlugPlay service is OK.


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys
[2017-05-09 11:37] - [2017-04-04 07:53] - 0496128 ____A (Microsoft Corporation) 0DC2A9882540DEA4A55B08785E09D8FC

C:\Windows\System32\drivers\tdx.sys
[2017-05-09 11:37] - [2017-04-04 07:53] - 0117760 ____A (Microsoft Corporation) EC75A942C32F7F405659D86156DCE4C5

C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\dnsapi.dll
[2011-04-14 20:29] - [2011-03-02 23:24] - 0357888 ____A (Microsoft Corporation) 492D07D79E7024CA310867B526D9636D

C:\Windows\SysWOW64\dnsapi.dll
[2011-04-14 20:29] - [2011-03-02 22:38] - 0270336 ____A (Microsoft Corporation) B40420876B9288E0A1C8CCA8A84E5DC9

C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll
[2017-05-26 17:38] - [2017-04-17 08:23] - 2651136 ____A (Microsoft Corporation) BB85752B1F7A87D255EAF10161C5F94A

C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll
[2017-05-09 11:37] - [2017-04-12 08:32] - 0190976 ____A (Microsoft Corporation) 48FEDBE324F1EA9417BA1D62AE863011

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll
[2017-05-09 11:37] - [2017-04-17 08:37] - 0512000 ____A (Microsoft Corporation) 5E9F8D029D9B03110D835CBFC058068B



**** End of log ****

 

OK. When I began the FSS scan it said it was running in virtual mode or something like that. Does that have any significance?

Right now the Sophos Virus Removal Tool is running. It's been running for quite a few minutes, and so far it hasn't found any threats. The progress bar isn't moving very fast.

 

The Sophos scan finally finished. Scan results: Your computer is clean. Number of threats found: 0

I'll restart that laptop now and re-run FSS as you requested.

 

NOTE: When I restarted the laptop I got that error message again to the effect that Windows was unable to connect to a service of some kind.

Here's the FSS log:

Farbar Service Scanner Version: 27-01-2016
Ran by Gayle (administrator) on 27-05-2017 at 22:32:29
Running from "C:\Downloads\Temporary"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

I downloaded Delfix but when I double-clicked on it my Norton A-V blocked it as a Trojan.Gen.Blkcloud (or something like that -- the warning quickly disappeared) and deleted it. Should I disable NAV and try Delfix again?

I was curious if Internet Explorer would open now and I got the IE has stopped working error message again and IE wouldn't open. I just now did a Restart before downloading Delfix again and this time I didn't get the error message about Windows being unable to connect to a service of some kind.

How should I proceed now?

 

broni: I disabled NAV and ran Delfix again, enabled NAV, did a Restart and got that error message again about Windows being unable to connect to a windows service. As you suggest, I'll start at new topic in the Win7 forum now. Thanks for all your help.