1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Need help with extremely slow laptop

Discussion in 'Malware and Virus Removal' started by BillB, 2016/12/02.

Page 1 of 2
  1. 2016/12/02
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    I'm trying to help a friend figure out why their laptop is so slow. It's running Win7 SP1 with 2G of memory. They had run scans with Avast, Superantispyware and Malwarebytes before I got it and cleaned up a bunch of stuff, but they say it is still too slow. I don't have a baseline to go on but to me it's very slow and the cpu seems to be busy a lot when nothing is open and running. Here are the requested logs, hopefully you can find something to explain why it's behaving this way.

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 30-11-2016
    Ran by graymassie (administrator) on GRAYMASSIE-PC (02-12-2016 15:27:18)
    Running from C:\Users\graymassie\Desktop
    Loaded Profiles: graymassie (Available Profiles: graymassie)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: FF)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (AMD) C:\Windows\System32\atiesrxx.exe
    (AMD) C:\Windows\System32\atieclxx.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgent.exe
    (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\ccsvchst.exe
    (TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
    (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
    (RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe
    (RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
    (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
    (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
    (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
    (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
    (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    (Dropbox, Inc.) C:\Users\graymassie\AppData\Roaming\Dropbox\bin\Dropbox.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    (AOL Inc.) C:\Program Files (x86)\Common Files\aol\1266376774\ee\aolsoftware.exe
    (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgentUI.exe
    (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
    (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
    (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe


    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [] => [X]
    HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [508472 2009-10-09] (Conexant Systems, Inc.)
    HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-07-16] ()
    HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1794856 2009-05-29] (Synaptics Incorporated)
    HKLM\...\Run: [ThpSrv] => C:\windows\system32\thpsrv /logon
    HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [497504 2009-08-21] (TOSHIBA Corporation)
    HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [508216 2009-07-28] (TOSHIBA Corporation)
    HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [909624 2009-08-05] (TOSHIBA Corporation)
    HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711000 2009-08-04] (TOSHIBA Corporation)
    HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1482592 2009-09-28] (TOSHIBA Corporation)
    HKLM\...\Run: [ConexantAudioPatch] => C:\Program Files\ConexantAudioPatch\Audioreset.exe [284472 2009-09-02] ()
    HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-09-17] (TOSHIBA Corporation)
    HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2009-10-28] (TOSHIBA Corporation)
    HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [34648 2009-10-28] (TOSHIBA Corporation)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-06] (Apple Inc.)
    HKLM-x32\...\Run: [TUSBSleepChargeSrv] => C:\Program Files (x86)\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe [252288 2009-07-02] (TOSHIBA)
    HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-30] (Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [TWebCamera] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2446648 2009-11-05] (TOSHIBA CORPORATION.)
    HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe [529256 2009-08-10] (Toshiba)
    HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
    HKLM-x32\...\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1266376774\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.)
    HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
    HKLM-x32\...\Run: [NACAgentUI] => C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgentUI.exe [610776 2012-12-03] (Cisco Systems, Inc.)
    HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6133520 2015-11-26] (AVAST Software)
    HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
    HKLM-x32\...\RunOnce: [20161125] => "C:\Program Files\AVAST Software\Avast\aswRunDll.exe" "C:\Program Files\AVAST Software\Avast\cfcfb332-8783-4996-90db-9551559343ba\ca5b9637-88ec-45e7-b4bc-53bb119065a3.dll ",_stage2@16
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7943072 2016-11-07] (SUPERAntiSpyware)
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\...\Run: [Dropbox Update] => C:\Users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe [143144 2016-04-16] (Dropbox, Inc.)
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\...\MountPoints2: {e0fa4cb1-89a3-11e1-b340-00038a000015} - C:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL D:\TL-Bootstrap.exe
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-10-17] (AVAST Software)
    ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-11-07] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-11-07] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-11-07] (Dropbox, Inc.)
    Startup: C:\Users\graymassie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2016-11-24]
    ShortcutTarget: Dropbox.lnk -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
    CHR HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{DC620884-DD72-484B-AB30-4B52A0B0022E}: [DhcpNameServer] 192.168.1.1
    ManualProxies:

    Internet Explorer:
    ==================
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?trackid=sp-006
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?trackid=sp-006
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Microsoft\Internet Explorer\Main,Start Page Restore = hxxp://www.aol.com
    SearchScopes: HKLM -> DefaultScope {A34FF9F8-5169-44F8-8D60-DE66CAFE6E6C} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {A34FF9F8-5169-44F8-8D60-DE66CAFE6E6C} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKLM -> {c9ab6446-7efc-47fe-966c-dc54324eff9f} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> {0CD0CEF1-C388-4E52-A24E-9A1B17237722} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKLM-x32 -> {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&query={searchTerms}&invocationType=tb50-ie-aol-chromesbox-en-us&tb_uuid=20110405150551468&tb_oid=17-02-2010&tb_mrud=01-05-2011
    SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {0CD0CEF1-C388-4E52-A24E-9A1B17237722} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&query={searchTerms}&invocationType=tb50-ie-aol-chromesbox-en-us&tb_uuid=20110405150551468&tb_oid=17-02-2010&tb_mrud=01-05-2011
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {44816E91-C68A-2FF3-3D8F-8970062E5600} URL = hxxp://www.bing.com/search?q={searchTerms}&pc=ZUGO&form=ZGAIDF
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {65A73339-391B-401D-8AB4-4198673FA064} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA_enUS366
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {A34FF9F8-5169-44F8-8D60-DE66CAFE6E6C} URL =
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-10-17] (AVAST Software)
    BHO-x32: No Name -> {3ef64538-8b54-4573-b48f-4d34b0238ab2} -> No File
    BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
    BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\coIEPlg.dll [2010-03-25] (Symantec Corporation)
    BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\IPSBHO.DLL [2010-02-03] (Symantec Corporation)
    BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
    BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-10-17] (AVAST Software)
    BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2009-11-11] (Sun Microsystems, Inc.)
    Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
    Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
    Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\coIEPlg.dll [2010-03-25] (Symantec Corporation)
    Toolbar: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    Toolbar: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    Toolbar: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> No Name - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} - No File
    DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
    DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: HKLM-x32 {76CBDDBA-3897-4EAC-A1D3-CCC47DE82EFB} hxxps://suri-ccas01.edmc.edu/auth/taweb.cab
    Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
    Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
    StartMenuInternet: IEXPLORE.EXE - iexplore.exe

    FireFox:
    ========
    FF DefaultProfile: h79j4u84.default
    FF ProfilePath: C:\Users\graymassie\AppData\Roaming\Mozilla\Firefox\Profiles\h79j4u84.default [2016-11-26]
    FF Homepage: Mozilla\Firefox\Profiles\h79j4u84.default -> hxxps://www.malwarebytes.org/restorebrowser//?f=1&a=drg_mdaffmarmar_15_30&cd=2XzuyEtN2Y1L1QzuyBtDtC0AtDyEzy0EyCzzzy0C0C0AtA0EtN0D0Tzu0StCtBzyyCtN1L2XzutAtFtCtBtFtCtFtCtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StC0BtDyD0CyB0D0CtGyC0ByBzztG0FtAtA0AtGtA0DtAyBtGzytB0F0FyC0D0D0Dzy0C0F0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EyD0BtDyD0A0FyDtGzzzytCyCtGyEyE0CyDtG0AyE0F0FtGyEyC0D0B0FyCyE0BzztCtD0A2QtN0A0LzuyE&cr=1768113399&ir=
    FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn
    FF Extension: (No Name) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn [2013-10-01] [not signed]
    FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn
    FF Extension: (No Name) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn [2013-10-01] [not signed]
    FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-16]
    FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-25] ()
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-25] ()
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw.dll [No File]
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
    FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-06] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-06] (Google Inc.)
    FF Plugin-x32: @viewpoint.com/VMP -> C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll [2004-02-20] ()
    FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll [2014-04-29] ()
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-4153870025-4142338956-1366997006-1000: CouponNetwork.com/CMDUniversalCouponPrintActivator -> C:\Users\GRAYMA~1\AppData\Roaming\CATALI~1\NPBCSK~1.DLL [No File]
    StartMenuInternet: FIREFOX.EXE - firefox.exe

    Chrome:
    =======
    CHR DefaultProfile: Default
    CHR HomePage: Default -> hxxps://www.google.com/?trackid=sp-006
    CHR StartupUrls: Default -> "hxxps://www.google.com/?trackid=sp-006 "
    CHR DefaultSearchURL: Default -> hxxps://www.google.de/search?q={searchTerms}&trackid=sp-006
    CHR DefaultSuggestURL: Default -> hxxps://www.google.com/complete/search?client=chrome&q={searchTerms}
    CHR Profile: C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default [2016-11-24]
    CHR Extension: (Google Docs) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-08-06]
    CHR Extension: (Google Drive) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-27]
    CHR Extension: (YouTube) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-08-06]
    CHR Extension: (Google Docs Offline) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-08-06]
    CHR Extension: (Avast Online Security) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-02-09]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-08-06]
    CHR Extension: (Select-Links) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ppmbcfaniaaligobicejgielmnfcpbno [2015-02-09]
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-06-04]
    CHR HKLM-x32\...\Chrome\Extension: [ppmbcfaniaaligobicejgielmnfcpbno] - C:\Program Files (x86)\OApps\chrome-sl.crx [2013-05-31]

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-16] (SUPERAntiSpyware.com)
    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-10-17] (AVAST Software)
    S2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [113704 2013-12-31] (AVAST Software)
    S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent)
    S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
    R2 NACAgent; C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgent.exe [1270744 2012-12-03] (Cisco Systems, Inc.)
    R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\ccSvcHst.exe [126392 2010-02-25] (Symantec Corporation)
    R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe [255256 2016-11-04] (RaMMicHaeL)
    R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 aswHwid; C:\windows\system32\drivers\aswHwid.sys [28656 2015-10-17] (AVAST Software)
    R1 aswKbd; C:\windows\system32\drivers\aswKbd.sys [28144 2015-10-17] (AVAST Software)
    R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [90968 2015-10-17] (AVAST Software)
    S1 aswNdisFlt; C:\windows\System32\DRIVERS\aswNdisFlt.sys [439648 2014-01-21] (AVAST Software)
    R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [93528 2015-10-17] (AVAST Software)
    R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-10-17] (AVAST Software)
    R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [1059656 2015-11-26] (AVAST Software)
    R1 aswSP; C:\windows\system32\drivers\aswSP.sys [449992 2015-11-26] (AVAST Software)
    R2 aswStm; C:\windows\system32\drivers\aswStm.sys [153744 2015-10-17] (AVAST Software)
    R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-10-17] (AVAST Software)
    S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100211.001\BHDrvx64.sys [676912 2010-02-11] (Symantec Corporation)
    R1 ccHP; C:\windows\system32\drivers\NISx64\1106000.020\ccHPx64.sys [615040 2010-02-25] (Symantec Corporation)
    R3 CnxtHdmiAudService; C:\windows\System32\drivers\CHDMI64.sys [688128 2009-08-18] (Conexant Systems Inc.)
    R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-02-18] (Symantec Corporation)
    R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100310.001\IDSvia64.sys [466992 2009-10-28] (Symantec Corporation)
    S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-22] (Realtek Semiconductor Corp.)
    R3 RTL8187Se; C:\windows\System32\DRIVERS\RTL8187Se.sys [403968 2008-08-22] (Realtek Semiconductor Corporation )
    R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    S3 SRTSP; C:\windows\System32\Drivers\NISx64\1106000.020\SRTSP64.SYS [505392 2010-02-26] (Symantec Corporation)
    R1 SRTSPX; C:\windows\system32\drivers\NISx64\1106000.020\SRTSPX64.SYS [32304 2010-02-26] (Symantec Corporation)
    R0 SymDS; C:\windows\System32\drivers\NISx64\1106000.020\SYMDS64.SYS [433200 2009-08-29] (Symantec Corporation)
    R0 SymEFA; C:\windows\System32\drivers\NISx64\1106000.020\SYMEFA64.SYS [221232 2010-02-03] (Symantec Corporation)
    R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [173104 2010-02-18] (Symantec Corporation)
    S1 SymIRON; C:\windows\system32\drivers\NISx64\1106000.020\Ironx64.SYS [149552 2010-02-26] (Symantec Corporation)
    R1 SYMTDIv; C:\windows\System32\Drivers\NISx64\1106000.020\SYMTDIV.SYS [451120 2010-02-03] (Symantec Corporation)
    S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100311.002\ENG64.SYS [X]
    S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100311.002\EX64.SYS [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    BillB,
    #1
  2. 2016/12/02
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2016-12-02 15:23 - 2016-12-02 15:26 - 00050800 _____ C:\Users\graymassie\Desktop\Addition.txt
    2016-12-02 15:16 - 2016-12-02 15:27 - 00027481 _____ C:\Users\graymassie\Desktop\FRST.txt
    2016-12-02 15:15 - 2016-12-02 15:27 - 00000000 ____D C:\FRST
    2016-12-02 15:14 - 2016-12-02 15:08 - 02411520 _____ (Farbar) C:\Users\graymassie\Desktop\FRST64.exe
    2016-11-25 18:54 - 2016-04-08 23:20 - 01230848 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
    2016-11-25 18:54 - 2016-04-08 22:52 - 01424896 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
    2016-11-25 18:54 - 2016-03-16 13:50 - 00156672 _____ (Microsoft Corporation) C:\windows\system32\mtxoci.dll
    2016-11-25 18:54 - 2016-03-16 13:28 - 00176128 _____ (Microsoft Corporation) C:\windows\SysWOW64\msorcl32.dll
    2016-11-25 18:54 - 2016-03-16 13:28 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\mtxoci.dll
    2016-11-25 18:54 - 2016-03-09 14:00 - 00396800 _____ (Microsoft Corporation) C:\windows\system32\webio.dll
    2016-11-25 18:54 - 2016-03-09 13:40 - 00316416 _____ (Microsoft Corporation) C:\windows\SysWOW64\webio.dll
    2016-11-25 18:54 - 2016-02-09 04:55 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\seclogon.dll
    2016-11-25 18:54 - 2015-11-13 18:09 - 00091648 _____ (Microsoft Corporation) C:\windows\system32\mapistub.dll
    2016-11-25 18:54 - 2015-11-13 18:09 - 00091648 _____ (Microsoft Corporation) C:\windows\system32\mapi32.dll
    2016-11-25 18:54 - 2015-11-13 18:08 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\fixmapi.exe
    2016-11-25 18:54 - 2015-11-13 17:50 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mapistub.dll
    2016-11-25 18:54 - 2015-11-13 17:50 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mapi32.dll
    2016-11-25 18:54 - 2015-11-13 17:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\fixmapi.exe
    2016-11-25 18:53 - 2016-03-17 17:56 - 02084864 _____ (Microsoft Corporation) C:\windows\system32\ole32.dll
    2016-11-25 18:53 - 2016-03-17 17:28 - 01414144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ole32.dll
    2016-11-25 18:53 - 2016-03-06 13:53 - 01885696 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
    2016-11-25 18:53 - 2016-03-06 13:53 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
    2016-11-25 18:53 - 2016-03-06 13:38 - 01240576 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
    2016-11-25 18:53 - 2016-03-06 13:38 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll
    2016-11-25 18:53 - 2016-02-02 13:57 - 00511488 _____ (Microsoft Corporation) C:\windows\system32\rpcss.dll
    2016-11-25 18:52 - 2016-05-12 12:20 - 00154856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
    2016-11-25 18:52 - 2016-05-12 12:20 - 00095464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
    2016-11-25 18:52 - 2016-05-12 12:15 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
    2016-11-25 18:52 - 2016-05-12 12:15 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
    2016-11-25 18:52 - 2016-05-12 12:15 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
    2016-11-25 18:52 - 2016-05-12 12:15 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
    2016-11-25 18:52 - 2016-05-12 12:15 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 01464320 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00730624 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00463872 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00344064 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00316416 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\rpchttp.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00666112 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00342528 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00260608 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00251392 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00141312 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpchttp.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
    2016-11-25 18:52 - 2016-05-12 10:05 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
    2016-11-25 18:52 - 2016-05-12 09:58 - 00464896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
    2016-11-25 18:52 - 2016-05-12 09:58 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
    2016-11-25 18:52 - 2016-05-12 09:58 - 00291328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
    2016-11-25 18:52 - 2016-05-12 09:58 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
    2016-11-25 18:52 - 2016-05-12 09:58 - 00159744 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
    2016-11-25 18:52 - 2016-05-12 09:58 - 00129536 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
    2016-11-25 18:52 - 2016-05-12 09:57 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
    2016-11-25 18:52 - 2016-05-12 09:56 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
    2016-11-25 18:52 - 2016-05-12 09:51 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll
    2016-11-25 18:52 - 2016-05-12 08:05 - 00459640 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
    2016-11-25 18:52 - 2016-05-12 08:05 - 00297984 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
    2016-11-25 18:52 - 2016-05-12 08:04 - 00249352 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
    2016-11-25 18:52 - 2016-02-12 13:52 - 03169792 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
    2016-11-25 18:52 - 2016-02-12 13:52 - 00192512 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
    2016-11-25 18:52 - 2016-02-12 13:52 - 00098816 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
    2016-11-25 18:52 - 2016-02-12 13:44 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
    2016-11-25 18:52 - 2016-02-12 13:39 - 00174080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
    2016-11-25 18:52 - 2016-02-12 13:22 - 02610688 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
    2016-11-25 18:52 - 2016-02-12 13:19 - 00709120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
    2016-11-25 18:52 - 2016-02-12 13:18 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
    2016-11-25 18:52 - 2016-02-12 13:18 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
    2016-11-25 18:52 - 2016-02-12 13:18 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
    2016-11-25 18:52 - 2016-02-12 13:18 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
    2016-11-25 18:52 - 2016-02-12 13:18 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
    2016-11-25 18:52 - 2016-02-12 13:06 - 00573440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
    2016-11-25 18:52 - 2016-02-12 13:05 - 00093696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
    2016-11-25 18:52 - 2016-02-12 13:05 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
    2016-11-25 18:52 - 2016-02-12 13:05 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
    2016-11-25 18:52 - 2016-01-20 19:51 - 00073664 _____ (Microsoft Corporation) C:\windows\system32\Drivers\disk.sys
    2016-11-25 18:52 - 2015-11-19 09:07 - 00994760 _____ (Microsoft Corporation) C:\windows\system32\ucrtbase.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00063840 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-private-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00020832 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-math-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00019808 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00017760 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-string-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00017760 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00016224 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00015712 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-convert-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00014176 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-time-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00014176 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-2-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00013664 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012640 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-process-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012640 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-heap-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012640 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-conio-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-utility-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-locale-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-environment-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00011616 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l2-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00011616 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-timezone-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00011616 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l2-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00011616 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-2-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00922432 _____ (Microsoft Corporation) C:\windows\SysWOW64\ucrtbase.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00066400 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00022368 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00019808 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00017760 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00017760 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00016224 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00015712 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00014176 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00014176 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00013664 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012640 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012640 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012640 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
    2016-11-25 18:51 - 2016-04-09 02:01 - 00986344 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
    2016-11-25 18:51 - 2016-04-09 02:01 - 00264936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgmms1.sys
    2016-11-25 18:51 - 2016-04-09 01:57 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\cdd.dll
    2016-11-25 18:51 - 2016-03-15 19:16 - 00760320 _____ (Microsoft Corporation) C:\windows\system32\samsrv.dll
    2016-11-25 18:51 - 2016-03-15 19:16 - 00106496 _____ (Microsoft Corporation) C:\windows\system32\samlib.dll
    2016-11-25 18:51 - 2016-03-15 18:53 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\samlib.dll
    2016-11-25 18:51 - 2016-02-05 13:56 - 00020480 _____ (Microsoft Corporation) C:\windows\system32\tbs.dll
    2016-11-25 18:51 - 2016-02-05 13:54 - 00109568 _____ (Microsoft Corporation) C:\windows\system32\fveapibase.dll
    2016-11-25 18:51 - 2016-02-05 12:33 - 00015360 _____ (Microsoft Corporation) C:\windows\SysWOW64\tbs.dll
    2016-11-25 18:51 - 2016-02-04 20:19 - 00381440 _____ (Microsoft Corporation) C:\windows\system32\mfds.dll
    2016-11-25 18:51 - 2016-02-04 13:41 - 00296448 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfds.dll
    2016-11-25 18:51 - 2016-02-03 13:58 - 00862208 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
    2016-11-25 18:51 - 2016-02-03 13:52 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\asycfilt.dll
    2016-11-25 18:51 - 2016-02-03 13:49 - 00572416 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
    2016-11-25 18:51 - 2016-02-03 13:43 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\asycfilt.dll
    2016-11-25 18:51 - 2016-02-03 13:07 - 00091648 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBSTOR.SYS
    2016-11-25 18:51 - 2016-01-11 14:11 - 01684416 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys
    2016-11-25 18:51 - 2016-01-07 12:42 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
    2016-11-25 18:51 - 2015-11-05 14:05 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\wshrm.dll
    2016-11-25 18:51 - 2015-11-05 14:02 - 00014848 _____ (Microsoft Corporation) C:\windows\SysWOW64\wshrm.dll
    2016-11-25 18:51 - 2015-11-05 04:53 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rmcast.sys
    2016-11-25 18:51 - 2015-06-03 15:21 - 00451080 _____ (Microsoft Corporation) C:\windows\system32\fveapi.dll
    2016-11-25 18:50 - 2016-05-13 17:15 - 00382184 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
    2016-11-25 18:50 - 2016-05-13 17:09 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
    2016-11-25 18:50 - 2016-05-13 17:09 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
    2016-11-25 18:50 - 2016-05-13 17:09 - 00041472 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
    2016-11-25 18:50 - 2016-05-13 17:09 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
    2016-11-25 18:50 - 2016-05-13 16:54 - 00308456 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
    2016-11-25 18:50 - 2016-05-13 16:50 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll
    2016-11-25 18:50 - 2016-05-13 16:49 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll
    2016-11-25 18:50 - 2016-05-13 16:49 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll
    2016-11-25 18:50 - 2016-05-13 16:27 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
    2016-11-25 18:50 - 2016-05-12 10:03 - 03217408 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
    2016-11-25 18:50 - 2016-05-11 12:02 - 00483840 _____ (Microsoft Corporation) C:\windows\system32\StructuredQuery.dll
    2016-11-25 18:50 - 2016-05-11 10:19 - 00363520 _____ (Microsoft Corporation) C:\windows\SysWOW64\StructuredQuery.dll
    2016-11-25 18:50 - 2016-04-14 08:49 - 00603648 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10level9.dll
    2016-11-25 18:50 - 2016-04-14 08:21 - 00647680 _____ (Microsoft Corporation) C:\windows\system32\d3d10level9.dll
    2016-11-25 18:50 - 2015-12-11 13:57 - 01164800 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
    2016-11-25 18:50 - 2015-12-08 16:54 - 02285056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msmpeg2vdec.dll
    2016-11-25 18:50 - 2015-12-08 16:54 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 01568768 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVENCOD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 01325056 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMSPDMOE.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00902144 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMADMOD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00815616 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMADMOE.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00740352 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmpmde.dll
    2016-11-25 18:50 - 2015-12-08 16:54 - 00739328 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMSPDMOD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00665088 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVXENCD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00541184 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVSDECD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00358400 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVSENCD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00154112 _____ (Microsoft Corporation) C:\windows\SysWOW64\VIDRESZR.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 01329664 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00970240 _____ (Microsoft Corporation) C:\windows\SysWOW64\msmpeg2adec.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00829952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MSMPEG2ENC.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00609280 _____ (Microsoft Corporation) C:\windows\SysWOW64\MFWMAAEC.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00509952 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00489984 _____ (Microsoft Corporation) C:\windows\SysWOW64\evr.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00415744 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP4SDECD.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00354816 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00241152 _____ (Microsoft Corporation) C:\windows\SysWOW64\MPG4DECD.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00241152 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP43DECD.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00206848 _____ (Microsoft Corporation) C:\windows\SysWOW64\RESAMPLEDMO.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00206848 _____ (Microsoft Corporation) C:\windows\SysWOW64\qasf.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00193536 _____ (Microsoft Corporation) C:\windows\SysWOW64\ksproxy.ax
    2016-11-25 18:50 - 2015-12-08 16:53 - 00153600 _____ (Microsoft Corporation) C:\windows\SysWOW64\COLORCNV.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP3DMOD.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\devenum.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00053248 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfvdsp.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
    2016-11-25 18:50 - 2015-12-08 16:53 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
    2016-11-25 18:50 - 2015-12-08 16:53 - 00004608 _____ (Microsoft Corporation) C:\windows\SysWOW64\ksuser.dll
    2016-11-25 18:50 - 2015-12-08 16:50 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 02777088 _____ (Microsoft Corporation) C:\windows\system32\msmpeg2vdec.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 01955328 _____ (Microsoft Corporation) C:\windows\system32\WMVENCOD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01575424 _____ (Microsoft Corporation) C:\windows\system32\WMSPDMOE.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01573888 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 01307136 _____ (Microsoft Corporation) C:\windows\system32\msmpeg2adec.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 01232896 _____ (Microsoft Corporation) C:\windows\system32\WMADMOD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01160192 _____ (Microsoft Corporation) C:\windows\system32\MSMPEG2ENC.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01153024 _____ (Microsoft Corporation) C:\windows\system32\WMADMOE.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01026048 _____ (Microsoft Corporation) C:\windows\system32\wmpmde.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 01010688 _____ (Microsoft Corporation) C:\windows\system32\mcmde.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00978944 _____ (Microsoft Corporation) C:\windows\system32\WMSPDMOD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00666112 _____ (Microsoft Corporation) C:\windows\system32\WMVSDECD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00653824 _____ (Microsoft Corporation) C:\windows\system32\MP4SDECD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00642048 _____ (Microsoft Corporation) C:\windows\system32\WMVXENCD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00632320 _____ (Microsoft Corporation) C:\windows\system32\evr.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00624640 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00484864 _____ (Microsoft Corporation) C:\windows\system32\MFWMAAEC.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00447488 _____ (Microsoft Corporation) C:\windows\system32\WMVSENCD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00432128 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00378880 _____ (Microsoft Corporation) C:\windows\system32\SysFxUI.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00292352 _____ (Microsoft Corporation) C:\windows\system32\VIDRESZR.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00254464 _____ (Microsoft Corporation) C:\windows\system32\qasf.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00225792 _____ (Microsoft Corporation) C:\windows\system32\RESAMPLEDMO.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00224768 _____ (Microsoft Corporation) C:\windows\system32\MPG4DECD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00223744 _____ (Microsoft Corporation) C:\windows\system32\MP43DECD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00189952 _____ (Microsoft Corporation) C:\windows\system32\COLORCNV.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\MP3DMOD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\devenum.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00070144 _____ (Microsoft Corporation) C:\windows\system32\mfvdsp.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
    2016-11-25 18:50 - 2015-12-08 14:07 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\ksuser.dll
    2016-11-25 18:50 - 2015-12-08 14:06 - 00250880 _____ (Microsoft Corporation) C:\windows\system32\ksproxy.ax
    2016-11-25 18:50 - 2015-12-08 14:06 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
    2016-11-25 18:50 - 2015-12-08 14:04 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
    2016-11-25 18:50 - 2015-12-08 13:54 - 00116736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\drmk.sys
    2016-11-25 18:50 - 2015-12-08 13:12 - 00230400 _____ (Microsoft Corporation) C:\windows\system32\Drivers\portcls.sys
    2016-11-25 18:50 - 2015-12-08 13:11 - 00005632 _____ (Microsoft Corporation) C:\windows\system32\Drivers\drmkaud.sys
    2016-11-25 18:50 - 2015-11-16 15:17 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
    2016-11-25 18:49 - 2016-05-11 12:02 - 00444928 _____ (Microsoft Corporation) C:\windows\system32\winhttp.dll
    2016-11-25 18:49 - 2016-05-11 12:02 - 00327168 _____ (Microsoft Corporation) C:\windows\system32\mswsock.dll
    2016-11-25 18:49 - 2016-05-11 12:02 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\ws2_32.dll
    2016-11-25 18:49 - 2016-05-11 10:19 - 00351744 _____ (Microsoft Corporation) C:\windows\SysWOW64\winhttp.dll
    2016-11-25 18:49 - 2016-05-11 10:19 - 00231424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mswsock.dll
    2016-11-25 18:49 - 2016-05-11 10:19 - 00206336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ws2_32.dll
    2016-11-25 18:49 - 2016-05-11 10:11 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\netbtugc.exe
    2016-11-25 18:49 - 2016-05-11 10:01 - 00026624 _____ (Microsoft Corporation) C:\windows\SysWOW64\netbtugc.exe
    2016-11-25 18:49 - 2016-05-11 09:58 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netbt.sys
    2016-11-25 18:48 - 2016-01-22 01:18 - 00961024 _____ (Microsoft Corporation) C:\windows\system32\CPFilters.dll
    2016-11-25 18:48 - 2016-01-22 01:18 - 00723968 _____ (Microsoft Corporation) C:\windows\system32\EncDec.dll
    2016-11-25 18:48 - 2016-01-22 01:04 - 00642048 _____ (Microsoft Corporation) C:\windows\SysWOW64\CPFilters.dll
    2016-11-25 18:48 - 2016-01-22 01:04 - 00535040 _____ (Microsoft Corporation) C:\windows\SysWOW64\EncDec.dll
    2016-11-25 18:46 - 2016-05-18 11:10 - 00312832 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
    2016-11-25 18:46 - 2016-05-18 11:09 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
    2016-11-25 18:46 - 2016-05-12 12:15 - 00105472 _____ (Microsoft Corporation) C:\windows\system32\winipsec.dll
    2016-11-25 18:46 - 2016-05-12 12:14 - 00794624 _____ (Microsoft Corporation) C:\windows\system32\gpsvc.dll
    2016-11-25 18:46 - 2016-05-12 12:14 - 00502272 _____ (Microsoft Corporation) C:\windows\system32\IPSECSVC.DLL
    2016-11-25 18:46 - 2016-05-12 12:14 - 00373760 _____ (Microsoft Corporation) C:\windows\system32\polstore.dll
    2016-11-25 18:46 - 2016-05-12 12:14 - 00096256 _____ (Microsoft Corporation) C:\windows\system32\gpapi.dll
    2016-11-25 18:46 - 2016-05-12 12:14 - 00075776 _____ (Microsoft Corporation) C:\windows\system32\FwRemoteSvr.dll
    2016-11-25 18:46 - 2016-05-12 10:18 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\polstore.dll
    2016-11-25 18:46 - 2016-05-12 10:18 - 00079360 _____ (Microsoft Corporation) C:\windows\SysWOW64\gpapi.dll
    2016-11-25 18:46 - 2016-05-12 10:18 - 00070144 _____ (Microsoft Corporation) C:\windows\SysWOW64\winipsec.dll
    2016-11-25 18:46 - 2016-05-12 10:18 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\FwRemoteSvr.dll
    2016-11-25 18:46 - 2016-04-06 10:27 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\jnwmon.dll
    2016-11-25 18:46 - 2016-03-09 13:54 - 00275456 _____ (Microsoft Corporation) C:\windows\system32\InkEd.dll
    2016-11-25 18:46 - 2016-03-09 13:34 - 00216064 _____ (Microsoft Corporation) C:\windows\SysWOW64\InkEd.dll
    2016-11-25 18:46 - 2016-02-09 04:57 - 14634496 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
    2016-11-25 18:46 - 2016-02-09 04:57 - 12625920 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
    2016-11-25 18:46 - 2016-02-09 04:56 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\msdxm.ocx
    2016-11-25 18:46 - 2016-02-09 04:56 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\dxmasf.dll
    2016-11-25 18:46 - 2016-02-09 04:54 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\spwmp.dll
    2016-11-25 18:46 - 2016-02-09 04:51 - 12625408 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmploc.DLL
    2016-11-25 18:46 - 2016-02-09 04:51 - 11411456 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
    2016-11-25 18:46 - 2016-02-09 04:13 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\spwmp.dll
    2016-11-25 18:46 - 2016-02-09 04:13 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\msdxm.ocx
    2016-11-25 18:46 - 2016-02-09 04:13 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxmasf.dll
    2016-11-25 18:45 - 2016-04-09 02:02 - 00631176 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
    2016-11-25 18:45 - 2016-04-09 02:01 - 05546216 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
    2016-11-25 18:45 - 2016-04-09 02:01 - 00706280 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
    2016-11-25 18:45 - 2016-04-09 01:59 - 03998952 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
    2016-11-25 18:45 - 2016-04-09 01:59 - 03943144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
    2016-11-25 18:45 - 2016-04-09 01:59 - 01732864 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 01314112 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00880640 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00419840 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00059904 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00034816 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00644096 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00275456 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00050688 _____ (Microsoft Corporation) C:\windows\SysWOW64\appidapi.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 00:52 - 00148480 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
    2016-11-25 18:45 - 2016-04-09 00:52 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
    2016-11-25 18:45 - 2016-04-09 00:52 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
    2016-11-25 18:45 - 2016-04-09 00:48 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
    2016-11-25 18:45 - 2016-04-09 00:47 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
    2016-11-25 18:45 - 2016-04-09 00:43 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
    2016-11-25 18:45 - 2016-04-09 00:38 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
    2016-11-25 18:45 - 2016-04-09 00:38 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
    2016-11-25 18:45 - 2016-04-09 00:38 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
    2016-11-25 18:45 - 2016-04-09 00:38 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
    2016-11-25 18:45 - 2016-04-09 00:37 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 00:37 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 00:37 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 00:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2016-11-25 18:44 - 2016-04-14 11:46 - 00114408 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
    2016-11-25 18:44 - 2016-04-14 11:42 - 03243520 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
    2016-11-25 18:44 - 2016-04-14 11:42 - 01941504 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
    2016-11-25 18:44 - 2016-04-14 11:42 - 00504320 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
    2016-11-25 18:44 - 2016-04-14 11:42 - 00070144 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll
    2016-11-25 18:44 - 2016-04-14 11:42 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\msimsg.dll
    2016-11-25 18:44 - 2016-04-14 10:33 - 02365440 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
    2016-11-25 18:44 - 2016-04-14 10:33 - 01806848 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
    2016-11-25 18:44 - 2016-04-14 10:33 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
    2016-11-25 18:44 - 2016-04-14 10:33 - 00025088 _____ (Microsoft Corporation) C:\windows\SysWOW64\msimsg.dll
    2016-11-25 18:44 - 2016-04-14 10:19 - 00128000 _____ (Microsoft Corporation) C:\windows\system32\msiexec.exe
    2016-11-25 18:44 - 2016-04-14 10:11 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msiexec.exe
    2016-11-25 18:31 - 2016-05-23 18:37 - 00394960 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
    2016-11-25 18:31 - 2016-05-23 17:54 - 00346312 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
    2016-11-25 18:31 - 2016-05-21 12:28 - 25802752 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
    2016-11-25 18:31 - 2016-05-21 11:57 - 20341248 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
    2016-11-25 18:31 - 2016-05-20 17:27 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
    2016-11-25 18:31 - 2016-05-20 17:27 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
    2016-11-25 18:31 - 2016-05-20 17:14 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
    2016-11-25 18:31 - 2016-05-20 17:10 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
    2016-11-25 18:31 - 2016-05-20 17:09 - 00572416 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
    2016-11-25 18:31 - 2016-05-20 17:09 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec
    2016-11-25 18:31 - 2016-05-20 17:09 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
    2016-11-25 18:31 - 2016-05-20 17:08 - 02895360 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
    2016-11-25 18:31 - 2016-05-20 17:08 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
    2016-11-25 18:31 - 2016-05-20 17:02 - 06051328 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
    2016-11-25 18:31 - 2016-05-20 17:00 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
    2016-11-25 18:31 - 2016-05-20 16:59 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
    2016-11-25 18:31 - 2016-05-20 16:57 - 00497664 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
    2016-11-25 18:31 - 2016-05-20 16:57 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
    2016-11-25 18:31 - 2016-05-20 16:57 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
    2016-11-25 18:31 - 2016-05-20 16:56 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
    2016-11-25 18:31 - 2016-05-20 16:56 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
    2016-11-25 18:31 - 2016-05-20 16:55 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
    2016-11-25 18:31 - 2016-05-20 16:54 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
    2016-11-25 18:31 - 2016-05-20 16:54 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
    2016-11-25 18:31 - 2016-05-20 16:54 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
    2016-11-25 18:31 - 2016-05-20 16:54 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
    2016-11-25 18:31 - 2016-05-20 16:50 - 02287104 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
    2016-11-25 18:31 - 2016-05-20 16:49 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
    2016-11-25 18:31 - 2016-05-20 16:48 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
    2016-11-25 18:31 - 2016-05-20 16:45 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
    2016-11-25 18:31 - 2016-05-20 16:45 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
    2016-11-25 18:31 - 2016-05-20 16:44 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
    2016-11-25 18:31 - 2016-05-20 16:44 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
    2016-11-25 18:31 - 2016-05-20 16:43 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
    2016-11-25 18:31 - 2016-05-20 16:41 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
    2016-11-25 18:31 - 2016-05-20 16:33 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
    2016-11-25 18:31 - 2016-05-20 16:33 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
    2016-11-25 18:31 - 2016-05-20 16:32 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
    2016-11-25 18:31 - 2016-05-20 16:29 - 13815808 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
    2016-11-25 18:31 - 2016-05-20 16:28 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
    2016-11-25 18:31 - 2016-05-20 16:27 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
    2016-11-25 18:31 - 2016-05-20 16:27 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
    2016-11-25 18:31 - 2016-05-20 16:26 - 00091136 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
    2016-11-25 18:31 - 2016-05-20 16:25 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
    2016-11-25 18:31 - 2016-05-20 16:23 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
    2016-11-25 18:31 - 2016-05-20 16:23 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
    2016-11-25 18:31 - 2016-05-20 16:22 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
    2016-11-25 18:31 - 2016-05-20 16:21 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
    2016-11-25 18:31 - 2016-05-20 16:19 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
    2016-11-25 18:31 - 2016-05-20 16:14 - 04610048 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
    2016-11-25 18:31 - 2016-05-20 16:12 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
    2016-11-25 18:31 - 2016-05-20 16:11 - 15420928 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
    2016-11-25 18:31 - 2016-05-20 16:11 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
    2016-11-25 18:31 - 2016-05-20 16:09 - 00725504 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
    2016-11-25 18:31 - 2016-05-20 16:09 - 00693248 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
    2016-11-25 18:31 - 2016-05-20 16:08 - 02055680 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
    2016-11-25 18:31 - 2016-05-20 16:08 - 00806400 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
    2016-11-25 18:31 - 2016-05-20 16:07 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
    2016-11-25 18:31 - 2016-05-20 16:07 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
    2016-11-25 18:31 - 2016-05-20 16:06 - 02131968 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
    2016-11-25 18:31 - 2016-05-20 15:46 - 02597888 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
    2016-11-25 18:31 - 2016-05-20 15:42 - 02121216 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
    2016-11-25 18:31 - 2016-05-20 15:38 - 01310208 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
    2016-11-25 18:31 - 2016-05-20 15:38 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
    2016-11-25 18:31 - 2016-05-20 15:34 - 01544192 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
    2016-11-25 18:31 - 2016-05-20 15:23 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
    2016-11-24 16:39 - 2016-11-26 17:05 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
    2016-11-24 16:39 - 2016-11-24 16:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2016-11-24 16:38 - 2016-11-24 16:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
    2016-11-24 16:38 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
    2016-11-24 16:38 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
    2016-11-24 16:34 - 2016-11-24 16:34 - 00004476 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
    2016-11-24 13:54 - 2016-11-24 17:54 - 00002109 _____ C:\Users\Public\Desktop\Google Earth.lnk
    2016-11-24 13:54 - 2016-11-24 13:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
    2016-11-24 13:17 - 2016-11-24 13:17 - 00000000 ____D C:\Users\graymassie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
     
    BillB,
    #2


  3. to hide this advert.

  4. 2016/12/02
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2016-12-02 15:23 - 2015-06-30 11:52 - 00000886 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000Core.job
    2016-12-02 15:17 - 2009-07-14 00:13 - 00006206 _____ C:\windows\system32\PerfStringBackup.INI
    2016-12-02 15:16 - 2009-07-13 23:45 - 00018736 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2016-12-02 15:16 - 2009-07-13 23:45 - 00018736 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2016-12-02 15:09 - 2015-06-30 11:52 - 00000938 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000UA.job
    2016-12-02 15:06 - 2014-04-16 17:23 - 00000000 ___RD C:\Users\graymassie\Dropbox
    2016-12-02 15:04 - 2015-06-30 11:52 - 00003918 _____ C:\windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000UA
    2016-12-02 15:04 - 2015-06-30 11:52 - 00003522 _____ C:\windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000Core
    2016-12-02 15:02 - 2016-05-12 10:40 - 00000894 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    2016-12-02 15:00 - 2011-04-20 19:47 - 00000308 _____ C:\windows\Tasks\iMeshNAG.job
    2016-12-02 14:59 - 2009-07-14 00:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
    2016-11-26 17:39 - 2010-02-16 20:16 - 00000898 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    2016-11-26 17:32 - 2012-08-05 00:24 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
    2016-11-26 15:27 - 2013-10-03 08:16 - 00004182 _____ C:\windows\System32\Tasks\avast! Emergency Update
    2016-11-25 23:05 - 2009-07-13 23:45 - 00416792 _____ C:\windows\system32\FNTCACHE.DAT
    2016-11-25 23:02 - 2009-07-13 22:20 - 00000000 ____D C:\windows\inf
    2016-11-25 23:01 - 2009-07-14 02:45 - 00000000 ____D C:\Program Files\Windows Journal
    2016-11-25 22:58 - 2013-03-15 09:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
    2016-11-25 22:58 - 2013-03-15 09:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
    2016-11-25 22:18 - 2013-03-15 09:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
    2016-11-25 15:31 - 2012-08-05 00:24 - 00796352 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
    2016-11-25 15:31 - 2012-08-05 00:24 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
    2016-11-25 15:31 - 2012-02-22 11:25 - 00000000 ____D C:\windows\system32\Macromed
    2016-11-25 15:31 - 2012-01-17 10:33 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
    2016-11-25 15:31 - 2009-11-11 21:00 - 00000000 ____D C:\windows\SysWOW64\Macromed
    2016-11-25 09:51 - 2013-04-04 20:35 - 00002166 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2016-11-25 09:51 - 2013-04-04 20:35 - 00002154 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2016-11-24 17:54 - 2015-05-28 14:58 - 00001718 _____ C:\Users\Public\Desktop\iTunes.lnk
    2016-11-24 17:54 - 2015-05-28 14:44 - 00001810 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
    2016-11-24 17:54 - 2015-01-22 22:35 - 00001122 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    2016-11-24 17:54 - 2015-01-22 22:35 - 00001116 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
    2016-11-24 17:54 - 2014-11-28 15:27 - 00002031 _____ C:\Users\Public\Desktop\Avast SafeZone.lnk
    2016-11-24 17:54 - 2014-11-28 15:27 - 00001971 _____ C:\Users\Public\Desktop\Avast Pro Antivirus.lnk
    2016-11-24 17:54 - 2014-05-18 12:35 - 00001571 _____ C:\Users\Public\Desktop\Launch PERRLA.lnk
    2016-11-24 17:54 - 2013-12-03 08:23 - 00002033 _____ C:\Users\Public\Desktop\Cisco NAC Agent.lnk
    2016-11-24 17:54 - 2013-10-02 20:08 - 00001857 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
    2016-11-24 17:54 - 2013-10-02 11:28 - 00001071 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2016-11-24 17:54 - 2013-10-02 10:52 - 00000871 _____ C:\Users\Public\Desktop\CCleaner.lnk
    2016-11-24 17:54 - 2013-03-02 02:23 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
    2016-11-24 17:54 - 2013-03-02 02:23 - 00001984 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
    2016-11-24 17:54 - 2011-07-09 03:06 - 00002417 _____ C:\Users\Public\Desktop\WildTangent Games App - toshiba.lnk
    2016-11-24 17:54 - 2010-03-11 12:38 - 00002507 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
    2016-11-24 17:54 - 2010-02-16 22:21 - 00001038 _____ C:\Users\Public\Desktop\AOL Desktop 9.6.lnk
    2016-11-24 17:54 - 2009-12-08 09:40 - 00001714 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon.com - Shopping.lnk
    2016-11-24 17:54 - 2009-12-08 09:39 - 00001949 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickBooks Financial Center.lnk
    2016-11-24 17:54 - 2009-12-08 08:50 - 00002545 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2007.lnk
    2016-11-24 17:54 - 2009-12-08 08:49 - 00001106 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works Task Launcher.lnk
    2016-11-24 17:54 - 2009-11-11 20:49 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
    2016-11-24 17:54 - 2009-11-11 20:49 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
    2016-11-24 17:54 - 2009-07-13 23:57 - 00001340 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
    2016-11-24 17:54 - 2009-07-13 23:57 - 00001318 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
    2016-11-24 17:54 - 2009-07-13 23:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
    2016-11-24 17:54 - 2009-07-13 23:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
    2016-11-24 17:53 - 2015-07-20 10:37 - 00002318 _____ C:\Users\graymassie\Desktop\Chromium.lnk
    2016-11-24 17:53 - 2014-04-16 17:23 - 00001236 _____ C:\Users\graymassie\Desktop\Dropbox.lnk
    2016-11-24 17:53 - 2011-04-05 10:07 - 00001090 _____ C:\ProgramData\Microsoft\Windows\Start Menu\AOL Desktop 9.6.lnk
    2016-11-24 17:53 - 2010-03-06 16:17 - 00001077 _____ C:\Users\graymassie\Desktop\Documents - Shortcut.lnk
    2016-11-24 17:53 - 2010-02-28 18:02 - 00000622 _____ C:\Users\graymassie\Desktop\Solitaire - Shortcut.lnk
    2016-11-24 17:53 - 2010-02-25 16:12 - 00001070 _____ C:\Users\graymassie\Desktop\Pictures - Shortcut.lnk
    2016-11-24 17:53 - 2010-02-25 16:11 - 00001049 _____ C:\Users\graymassie\Desktop\Music - Shortcut.lnk
    2016-11-24 17:53 - 2010-02-24 11:28 - 00000355 _____ C:\Users\graymassie\Desktop\Computer - Shortcut.lnk
    2016-11-24 17:53 - 2010-02-24 11:26 - 00002675 _____ C:\Users\graymassie\Desktop\Microsoft Office Word 2007.lnk
    2016-11-24 17:53 - 2010-02-24 11:26 - 00002637 _____ C:\Users\graymassie\Desktop\Microsoft Office Excel 2007.lnk
    2016-11-24 17:53 - 2010-02-16 22:04 - 00002627 _____ C:\Users\graymassie\Desktop\Microsoft Office PowerPoint 2007.lnk
    2016-11-24 17:53 - 2010-02-16 22:04 - 00002625 _____ C:\Users\graymassie\Desktop\Microsoft Office Access 2007.lnk
    2016-11-24 17:53 - 2010-02-16 22:04 - 00002593 _____ C:\Users\graymassie\Desktop\Microsoft Office Publisher 2007.lnk
    2016-11-24 17:53 - 2010-02-10 18:47 - 00001428 _____ C:\Users\graymassie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    2016-11-24 17:53 - 2009-11-11 20:49 - 00000360 _____ C:\Users\graymassie\Desktop\Mahjong.lnk
    2016-11-24 17:53 - 2009-07-14 00:01 - 00001282 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
    2016-11-24 17:53 - 2009-07-13 23:57 - 00000378 _____ C:\Users\graymassie\Desktop\Purble Place.lnk
    2016-11-24 17:53 - 2009-07-13 23:49 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
    2016-11-24 17:44 - 2013-04-04 20:32 - 00000258 __RSH C:\Users\graymassie\ntuser.pol
    2016-11-24 17:44 - 2010-02-10 18:45 - 00000000 ____D C:\Users\graymassie
    2016-11-24 17:36 - 2013-08-09 19:02 - 00000000 ____D C:\Users\graymassie\AppData\LocalLow\Delta
    2016-11-24 17:36 - 2013-04-04 20:31 - 00000000 ____D C:\Program Files (x86)\Conduit
    2016-11-24 16:39 - 2013-09-30 09:19 - 00000000 ____D C:\Users\graymassie\AppData\Roaming\Malwarebytes
    2016-11-24 16:38 - 2013-10-02 11:28 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2016-11-24 16:38 - 2013-09-30 09:19 - 00000000 ____D C:\ProgramData\Malwarebytes
    2016-11-24 15:23 - 2010-02-10 18:57 - 00000000 ____D C:\Users\graymassie\AppData\Local\Google
    2016-11-24 15:05 - 2015-06-29 14:58 - 00000000 ____D C:\Users\graymassie\AppData\Local\Dropbox
    2016-11-24 14:18 - 2013-10-02 20:08 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
    2016-11-24 13:54 - 2009-12-08 09:30 - 00000000 ____D C:\Program Files (x86)\Google
    2016-11-24 13:20 - 2014-04-08 18:37 - 00000000 ____D C:\Users\graymassie\AppData\Roaming\Dropbox

    ==================== Files in the root of some directories =======

    2016-05-10 20:33 - 2016-05-10 20:33 - 6748160 _____ () C:\Program Files (x86)\GUT34E2.tmp
    2014-11-16 12:00 - 2014-11-16 12:00 - 6000640 _____ () C:\Program Files (x86)\GUTBC0F.tmp
    2016-03-13 17:18 - 2016-03-13 17:18 - 6871040 _____ () C:\Program Files (x86)\GUTEC81.tmp
    2016-03-15 05:43 - 2016-03-15 05:43 - 6871040 _____ () C:\Program Files (x86)\GUTF3D.tmp
    2014-05-05 13:11 - 2014-05-05 13:11 - 0011264 _____ () C:\Users\graymassie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2013-08-04 19:52 - 2013-08-04 19:52 - 0000093 _____ () C:\ProgramData\SAH_Install.ini

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\windows\system32\winlogon.exe => File is digitally signed
    C:\windows\system32\wininit.exe => File is digitally signed
    C:\windows\SysWOW64\wininit.exe => File is digitally signed
    C:\windows\explorer.exe => File is digitally signed
    C:\windows\SysWOW64\explorer.exe => File is digitally signed
    C:\windows\system32\svchost.exe => File is digitally signed
    C:\windows\SysWOW64\svchost.exe => File is digitally signed
    C:\windows\system32\services.exe => File is digitally signed
    C:\windows\system32\User32.dll => File is digitally signed
    C:\windows\SysWOW64\User32.dll => File is digitally signed
    C:\windows\system32\userinit.exe => File is digitally signed
    C:\windows\SysWOW64\userinit.exe => File is digitally signed
    C:\windows\system32\rpcss.dll => File is digitally signed
    C:\windows\system32\dnsapi.dll => File is digitally signed
    C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-06-15 19:33

    ==================== End of FRST.txt ============================
     
    BillB,
    #3
  5. 2016/12/02
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-11-2016
    Ran by graymassie (02-12-2016 15:29:17)
    Running from C:\Users\graymassie\Desktop
    Windows 7 Home Premium Service Pack 1 (X64) (2010-02-10 23:45:30)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-4153870025-4142338956-1366997006-500 - Administrator - Disabled)
    graymassie (S-1-5-21-4153870025-4142338956-1366997006-1000 - Administrator - Enabled) => C:\Users\graymassie
    Guest (S-1-5-21-4153870025-4142338956-1366997006-501 - Limited - Disabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Norton Internet Security (Disabled - Out of date) {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
    AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    AS: Norton Internet Security (Disabled - Up to date) {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
    FW: Norton Internet Security (Disabled) {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
    FW: avast! Antivirus (Disabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe Connect 9 Add-in (HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\...\Adobe Connect 9 Add-in) (Version: 11,9,974,205 - Adobe Systems Incorporated)
    Adobe Flash Player 23 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 23.0.0.207 - Adobe Systems Incorporated)
    Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.18) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.18 - Adobe Systems Incorporated)
    Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.8.612 - Adobe Systems, Inc.)
    Amazon Links (HKLM-x32\...\{3135D885-9D9A-4B4D-8D45-9DB05DA115CA}) (Version: 2.02 - TOSHIBA Corporation)
    AOL Toolbar (HKLM-x32\...\AOL Toolbar) (Version: - )
    AOL Toolbar (HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\...\AOL Toolbar) (Version: - )
    AOL Uninstaller (Choose which Products to Remove) (HKLM-x32\...\AOL Uninstaller) (Version: - AOL Inc.)
    Apple Application Support (32-bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.10 - Atheros Communications Inc.)
    ATI Catalyst Install Manager (HKLM\...\{15BEAEBD-74D6-C40A-0089-5BFD0E689BFE}) (Version: 3.0.732.0 - ATI Technologies, Inc.)
    Avast Pro Antivirus (HKLM-x32\...\avast) (Version: 10.4.2233 - AVAST Software)
    Bejeweled 2 Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Blackhawk Striker 2 (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    Catalina Savings Printer (HKLM-x32\...\{37331C16-3E97-4A20-80D8-BFB43AB0E2FB}) (Version: 1.0.0 - Catalina Marketing Corp) <==== ATTENTION
    ccc-core-static (x32 Version: 2009.0729.2238.38827 - ATI) Hidden
    CCleaner (HKLM\...\CCleaner) (Version: 4.06 - Piriform)
    Cisco NAC Agent (HKLM-x32\...\{0CB855E9-B05A-41C7-B743-C286A08433D0}) (Version: 4.9.2.8 - Cisco Systems, Inc.)
    Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Conexant Audio Driver For AMD HDMI Codec (HKLM\...\CNXT_AUDIO_HDA_HDMI) (Version: 4.98.12.0 - Conexant)
    Conexant HD Audio (HKLM\...\CNXT_AUDIO) (Version: 4.98.16.61 - Conexant)
    DomaIQ (HKLM-x32\...\DomaIQ Uninstaller) (Version: - Tuguu SLU) <==== ATTENTION
    Download Updater (AOL LLC) (HKLM-x32\...\SoftwareUpdUtility) (Version: - ) <==== ATTENTION
    Dragon Ball (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Dropbox (HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\...\Dropbox) (Version: 14.4.19 - Dropbox, Inc.)
    Faerie Solitaire (x32 Version: 2.2.0.82 - WildTangent) Hidden
    FATE Undiscovered Realms (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 54.0.2840.99 - Google Inc.)
    Google Earth (HKLM-x32\...\{A0C18B96-AB79-46BD-8321-6FA83E6D25B9}) (Version: 7.1.7.2606 - Google)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
    iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
    Java(TM) 6 Update 14 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216014FF}) (Version: 6.0.140 - Sun Microsystems, Inc.)
    Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
    Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
    Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
    Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
    Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
    Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
    Microsoft Office Ultimate 2007 (HKLM-x32\...\ULTIMATER) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
    Monopoly (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Mozilla Firefox 39.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 en-US)) (Version: 39.0 - Mozilla)
    Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)
    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    Music Oasis (HKLM-x32\...\{c6c214df-2922-4809-94aa-f4d67d4451ec}) (Version: 1.0.0 - W3i, LLC)
    Mystery P.I. - The Vegas Heist (x32 Version: 2.2.0.82 - WildTangent) Hidden
    NetZero Launcher (HKLM-x32\...\{9AEAF9CC-390B-49C0-8F7F-14092BF163B6}) (Version: 2.01 - TOSHIBA Corporation)
    PERRLA (HKLM-x32\...\{82AA957D-51B3-4A63-B974-2BFB5CA8A7CE}) (Version: 7.4.0 - PERRLA)
    PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
    Polar Bowler (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Quickbooks Financial Center (HKLM-x32\...\{3B843B38-04B1-4CE6-8888-586273E0F289}) (Version: 2.02 - TOSHIBA Corporation)
    QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
    Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30105 - Realtek Semiconductor Corp.)
    Realtek WLAN Driver (HKLM-x32\...\{0FB630AB-7BD8-40AE-B223-60397D57C3C9}) (Version: 2.00.0006 - Realtek)
    Scrabble Plus (x32 Version: 2.2.0.82 - WildTangent) Hidden
    SelectionLinks (HKLM-x32\...\sl-cb) (Version: 1.0 - SelectionLinks) <==== ATTENTION
    Skype Launcher (HKLM-x32\...\{DA84ECBF-4B79-47F2-B34C-95C38484C058}) (Version: 2.01 - TOSHIBA Corporation)
    Strongvault Online Backup (HKLM-x32\...\{59DB31A9-BCB0-4985-ACA6-F6477C7BE367}) (Version: 2.1.4.0 - Strongvault) <==== ATTENTION
    SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.6.1038 - SUPERAntiSpyware.com)
    Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.1.2.0 - Synaptics Incorporated)
    TOSHIBA Application Installer (HKLM-x32\...\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.1.0 - TOSHIBA)
    TOSHIBA Assist (HKLM-x32\...\{1B87C40B-A60B-4EF3-9A68-706CF4B69978}) (Version: 3.00.09 - TOSHIBA)
    TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{F64684A0-754B-4637-B7F9-6E8DAA8CD5CD}) (Version: 1.5.05.64 - TOSHIBA Corporation)
    TOSHIBA ConfigFree (HKLM-x32\...\{F3529665-D75E-4D6D-98F0-745C78C68E9B}) (Version: 8.0.25 - TOSHIBA Corporation)
    TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.2 for x64 - TOSHIBA Corporation)
    TOSHIBA eco Utility (HKLM-x32\...\InstallShield_{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}) (Version: 1.1.12.64 - TOSHIBA Corporation)
    TOSHIBA Extended Tiles for Windows Mobility Center (HKLM-x32\...\InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}) (Version: - )
    TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.1.64 - TOSHIBA Corporation)
    TOSHIBA Hardware Setup (HKLM-x32\...\InstallShield_{C4FFA951-9678-4D51-84B4-AFD15D3C45AD}) (Version: - )
    TOSHIBA HDD Protection (HKLM\...\{94A90C69-71C1-470A-88F5-AA47ECC96B40}) (Version: 2.2.0.3 - TOSHIBA Corporation)
    TOSHIBA HDD/SSD Alert (HKLM-x32\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.3 - TOSHIBA Corporation)
    TOSHIBA Media Controller (HKLM-x32\...\{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}) (Version: 1.0.65 - TOSHIBA CORPORATION)
    Toshiba Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.38 - Toshiba)
    TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.4.1.64 - TOSHIBA Corporation)
    TOSHIBA Quality Application (HKLM-x32\...\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.0.1 - TOSHIBA)
    TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.4 for x64 - TOSHIBA Corporation)
    TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{5BCC94A1-DEF1-4AB4-8046-BC13048E929A}) (Version: 1.5.07.64 - TOSHIBA Corporation)
    TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.1.40 - TOSHIBA)
    TOSHIBA Supervisor Password (HKLM-x32\...\InstallShield_{CBD6B23D-41D5-4A46-8019-6208516C9712}) (Version: - )
    TOSHIBA USB Sleep and Charge Utility (HKLM-x32\...\{E487EE7D-EAAA-4E2A-9116-E3B477D8A74F}) (Version: 1.2.3.0 - TOSHIBA Corporation)
    TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.2.26.64 - TOSHIBA Corporation)
    TOSHIBA Web Camera Application (HKLM-x32\...\{5E6F6CF3-BACC-4144-868C-E14622C658F3}) (Version: 1.1.1.7 - TOSHIBA Corporation)
    ToshibaRegistration (HKLM-x32\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.0.3 - Toshiba)
    Unchecky v1.0.1 (HKLM-x32\...\Unchecky) (Version: 1.0.1 - RaMMicHaeL)
    Uninstall AOL Emergency Connect Utility 1.0 (HKLM-x32\...\AOL Emergency Connect Utility 1.0) (Version: - )
    Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
    Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
    Vegas Penny Slots Pack (x32 Version: 2.2.0.98 - WildTangent) Hidden
    Viewpoint Media Player (HKLM-x32\...\ViewpointMediaPlayer) (Version: - )
    Virtual Families (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Virtual Villagers - The Secret City (x32 Version: 2.2.0.82 - WildTangent) Hidden
    WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.2.5 - WildTangent)
    WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.2.5 - WildTangent)
    WildTangent Games App (Toshiba Games) (x32 Version: 4.0.11.9 - WildTangent) Hidden
    WildTangent Games App (x32 Version: 4.0.5.14 - WildTangent) Hidden
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
    Windows Live Sign-in Assistant (HKLM-x32\...\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)
    Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
    Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {033F1F2E-B3DD-47BA-9198-45C650F4B40D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-09-19] (Piriform Ltd)
    Task: {1AEEAB49-6171-4E08-B0AE-B56E74B8F44F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-16] (Google Inc.)
    Task: {1C31A4CE-E841-419C-93C3-376EF8DEB9F7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-11-25] (Adobe Systems Incorporated)
    Task: {2703C912-476B-452A-AC8B-71AE82D1401E} - System32\Tasks\Symantec\Symantec Error Processor 17.6.0.32 => C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\SymErr.exe [2010-03-26] (Symantec Corporation)
    Task: {2B243EBB-5653-422E-94DD-22938BF18559} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-07-21] (AVAST Software)
    Task: {348D7DC0-5E96-4B63-ABAD-5AD0751419DA} - \Dregol fico -> No File <==== ATTENTION
    Task: {4C96BADF-7F5E-40CC-8AF7-E9E57BDAD1AD} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000Core => C:\Users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-04-16] (Dropbox, Inc.)
    Task: {4D535872-600B-4B39-8DCF-D132177EAFDF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-16] (Google Inc.)
    Task: {4E773ADA-D52F-4445-A782-654E6B53A6F7} - System32\Tasks\Games\UpdateCheck_S-1-5-21-4153870025-4142338956-1366997006-1000
    Task: {783AB8AE-766C-4941-B966-DB8E784FC929} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: {79FBB6ED-978C-4F39-B012-1636B43D4FEB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
    Task: {9DB68880-B71C-4260-92B6-1B9F39C89CAC} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000UA => C:\Users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-04-16] (Dropbox, Inc.)
    Task: {C7DFB647-5789-4258-9C5E-9B2F347EA27C} - System32\Tasks\{1F083CEC-DB67-4301-8C4F-CA56D04106C2} => pcalua.exe -a "C:\Program Files\DomaIQ Uninstaller\DomaIQUninstall.exe "
    Task: {D0DBBCB8-050D-4D47-86C2-31C2A3FA0663} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)
    Task: {D6C9213B-AF03-4B2F-900C-44F39C1BABC0} - System32\Tasks\iMeshNAG => C:\Users\GRAYMA~1\AppData\Local\Temp\iMesh_setup.exe <==== ATTENTION
    Task: {DDC658A3-9D5D-4AF5-BC13-777383D89E50} - System32\Tasks\Symantec\Symantec Error Analyzer 17.6.0.32 => C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\SymErr.exe [2010-03-26] (Symantec Corporation)
    Task: {DF7CAB51-4ADA-447B-B5A6-4E60607A736F} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-10-17] (AVAST Software)
    Task: {E84AF896-6270-4120-A693-82AC8BBF6D3E} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2009-10-28] (TOSHIBA CORPORATION)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000Core.job => C:\Users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe
    Task: C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000UA.job => C:\Users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe
    Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\windows\Tasks\iMeshNAG.job => C:\Users\GRAYMA~1\AppData\Local\Temp\iMesh_setup.exe <==== ATTENTION

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2015-03-20 17:12 - 2015-03-20 17:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2015-03-20 17:12 - 2015-03-20 17:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2009-07-16 18:27 - 2009-07-16 18:27 - 07244600 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
    2009-07-16 18:27 - 2009-07-16 18:27 - 00051512 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll
    2009-11-11 20:57 - 2009-06-22 18:40 - 00022328 _____ () C:\Program Files\TOSHIBA\Toshiba Assist\NotifyX.dll
    2009-03-12 22:08 - 2009-03-12 22:08 - 00048640 _____ () C:\Program Files (x86)\Toshiba\PCDiag\NotifyPCD.dll
    2009-07-25 20:38 - 2009-07-25 20:38 - 00017800 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
    2009-05-04 13:45 - 2009-05-04 13:45 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
    2009-12-08 09:10 - 2009-12-08 09:10 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
    2009-09-17 18:41 - 2009-09-17 18:41 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
    2015-10-17 20:31 - 2015-10-17 20:31 - 00103376 _____ () C:\Program Files\AVAST Software\Avast\log.dll
    2015-10-17 20:30 - 2015-10-17 20:30 - 00123976 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
    2016-11-26 15:30 - 2016-11-26 15:30 - 03134984 _____ () C:\Program Files\AVAST Software\Avast\defs\16112600\algo.dll
    2016-12-02 15:02 - 2016-12-02 15:02 - 03129808 _____ () C:\Program Files\AVAST Software\Avast\defs\16120200\algo.dll
    2016-11-24 13:17 - 2016-10-10 11:29 - 00035792 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
    2016-11-24 13:15 - 2016-10-10 11:29 - 00145864 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\pyexpat.pyd
    2016-11-24 13:15 - 2016-10-10 11:29 - 00019408 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\faulthandler.pyd
    2016-11-24 13:15 - 2016-10-10 11:29 - 00116688 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\pywintypes27.dll
    2016-11-24 13:17 - 2016-10-10 11:29 - 00100296 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\_ctypes.pyd
    2016-11-24 13:16 - 2016-10-10 11:29 - 00018888 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\select.pyd
    2016-11-24 13:16 - 2016-11-07 17:59 - 00019760 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
    2016-11-24 13:16 - 2016-10-10 11:29 - 00694224 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\unicodedata.pyd
    2016-11-24 13:15 - 2016-11-07 17:58 - 00020816 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
    2016-11-24 13:17 - 2016-10-10 11:30 - 00123856 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
    2016-11-24 13:15 - 2016-11-07 17:58 - 01682760 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
    2016-11-24 13:15 - 2016-11-07 17:58 - 00020808 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00105928 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32api.pyd
    2016-11-24 13:17 - 2016-11-07 17:59 - 00021312 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.crt.compiled._winffi_crt.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 00052024 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 00038696 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\fastpath.pyd
    2016-11-24 13:15 - 2016-10-10 11:29 - 00392144 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\pythoncom27.dll
    2016-11-24 13:15 - 2016-10-10 11:31 - 00020936 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\mmapfile.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00024528 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32event.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00116176 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32security.pyd
    2016-11-24 13:17 - 2016-11-07 17:59 - 00381752 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00124880 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32file.pyd
    2016-11-24 13:17 - 2016-11-07 17:59 - 00025424 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.kernel32.compiled._winffi_kernel32.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00024016 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00175560 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32gui.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00030160 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32pipe.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00043472 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32process.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00048592 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32service.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00057808 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32evtlog.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00024016 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32profile.pyd
    2016-11-24 13:15 - 2016-11-07 17:58 - 00246592 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 00026456 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\dropbox.infinite.win.compiled._driverinstallation.pyd
    2016-11-24 13:17 - 2016-10-10 11:30 - 00241104 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\_jpegtran.pyd
    2016-11-24 13:15 - 2016-11-07 17:58 - 00020280 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00028616 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32ts.pyd
    2016-11-24 13:17 - 2016-11-07 17:59 - 00023376 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
    2016-11-24 13:17 - 2016-11-07 17:59 - 00020800 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.iphlpapi._winffi_iphlpapi.pyd
    2016-11-24 13:17 - 2016-11-07 17:59 - 00019776 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.winerror._winffi_winerror.pyd
    2016-11-24 13:17 - 2016-11-07 17:59 - 00020800 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.wininet._winffi_wininet.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00350152 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winxpgui.pyd
    2016-11-24 13:17 - 2016-11-07 17:59 - 00022352 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winverifysignature.compiled._VerifySignature.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 00024392 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
    2016-11-24 13:15 - 2016-10-10 11:27 - 00036296 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\librsync.dll
    2016-11-24 13:15 - 2016-11-07 17:59 - 00084280 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
    2016-11-24 13:15 - 2016-11-07 17:59 - 01826096 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
    2016-11-24 13:16 - 2016-10-10 11:29 - 00083912 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\sip.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 00531248 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 03928880 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 01972528 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 00133424 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 00224056 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 00207672 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
    2016-11-24 13:17 - 2016-11-07 17:59 - 00020288 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.user32._winffi_user32.pyd
    2016-11-24 13:15 - 2016-10-10 11:33 - 00017864 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\libEGL.dll
    2016-11-24 13:15 - 2016-10-10 11:34 - 01631184 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\libGLESv2.dll
    2016-11-24 13:15 - 2016-11-07 17:59 - 00042808 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtWebChannel.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 00168760 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtWebEngineWidgets.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 00357680 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
    2016-11-24 13:17 - 2016-10-10 11:31 - 00060880 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32print.pyd
    2016-11-24 13:17 - 2016-11-07 17:59 - 00024904 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.winhttp.compiled._winffi_winhttp.pyd
    2016-11-24 13:15 - 2016-11-07 17:59 - 00546096 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
    2015-10-17 20:32 - 2015-10-17 20:33 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1 [104]
    AlternateDataStreams: C:\ProgramData\TEMP:D346F792 [294]

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)


    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 21:34 - 2016-12-02 15:00 - 00002024 ____A C:\windows\system32\Drivers\etc\hosts

    0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
    0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
    0.0.0.0 media.opencandy.com
    0.0.0.0 cdn.opencandy.com
    0.0.0.0 tracking.opencandy.com
    0.0.0.0 api.opencandy.com
    0.0.0.0 api.recommendedsw.com
    0.0.0.0 installer.betterinstaller.com
    0.0.0.0 installer.filebulldog.com
    0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
    0.0.0.0 inno.bisrv.com
    0.0.0.0 nsis.bisrv.com
    0.0.0.0 cdn.file2desktop.com
    0.0.0.0 cdn.goateastcach.us
    0.0.0.0 cdn.guttastatdk.us
    0.0.0.0 cdn.inskinmedia.com
    0.0.0.0 cdn.insta.oibundles2.com
    0.0.0.0 cdn.insta.playbryte.com
    0.0.0.0 cdn.llogetfastcach.us
    0.0.0.0 cdn.montiera.com
    0.0.0.0 cdn.msdwnld.com
    0.0.0.0 cdn.mypcbackup.com
    0.0.0.0 cdn.ppdownload.com
    0.0.0.0 cdn.riceateastcach.us
    0.0.0.0 cdn.shyapotato.us
    0.0.0.0 cdn.solimba.com
    0.0.0.0 cdn.tuto4pc.com
    0.0.0.0 cdn.appround.biz
    0.0.0.0 cdn.bigspeedpro.com
    0.0.0.0 cdn.bispd.com

    There are 4 more lines.


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\graymassie\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
    DNS Servers: 192.168.1.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    MSCONFIG\startupreg: PC Health Kit => C:\Program Files (x86)\PC Health Kit\PCHKLauncher.exe
    MSCONFIG\startupreg: SMessaging => "C:\Users\graymassie\AppData\Local\Strongvault Online Backup\SMessaging.exe "

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{9DE4A928-2BCC-496D-A2F1-C9A234F1EC6F}] => C:\Program Files (x86)\Windows Live\Messenger\wlcsdk.exe
    FirewallRules: [{8915A9F5-E33A-4238-9785-F3857F1C7499}] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    FirewallRules: [{204796BB-74D8-4B46-829C-0A965BF69D57}] => svchost.exe
    FirewallRules: [{21494F01-DB73-499E-A3A4-323D4EBEECB3}] => C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
    FirewallRules: [{A900E7A6-72BC-4167-A818-954498744B32}] => C:\Program Files (x86)\Common Files\aol\acs\AOLDial.exe
    FirewallRules: [{EC5A3F31-27AA-4C33-A111-40448C4FE5F3}] => C:\Program Files (x86)\Common Files\aol\acs\AOLDial.exe
    FirewallRules: [{92B1C7C3-CB71-49C3-9E24-9988E8E154E8}] => C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
    FirewallRules: [{DD766E25-F212-4184-8ACB-A3F47EE549BE}] => C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
    FirewallRules: [{3D1B8870-25F8-4186-81CF-4A743B7DF960}] => C:\Program Files (x86)\Common Files\aol\1266376774\ee\aolsoftware.exe
    FirewallRules: [{4CC13A34-9208-46E0-8E11-3D0A9FD58DA2}] => C:\Program Files (x86)\Common Files\aol\1266376774\ee\aolsoftware.exe
    FirewallRules: [{06C4BA3E-B67C-452B-8DD0-4A5156376E2B}] => C:\Program Files (x86)\AOL 9.5\waol.exe
    FirewallRules: [{44B3699C-C1EA-4F88-A8D2-9E93BD3D6589}] => C:\Program Files (x86)\AOL 9.5\waol.exe
    FirewallRules: [{E3A178C0-A02A-43DC-8C69-DDCCECAE26C4}] => C:\Program Files (x86)\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe
    FirewallRules: [{4B859F7C-2F16-419D-ADD5-D112127D95C7}] => C:\Program Files (x86)\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe
    FirewallRules: [{D5C025B0-60A5-4031-879F-D48F67CAFA80}] => C:\Program Files (x86)\Common Files\aol\Loader\aolload.exe
    FirewallRules: [{A35F4B90-C55F-4035-B6E7-C00FD9B69A3E}] => C:\Program Files (x86)\Common Files\aol\Loader\aolload.exe
    FirewallRules: [{0E3481C7-A8E1-48FB-B383-4CA9264E92FC}] => C:\Program Files (x86)\Common Files\aol\System Information\sinf.exe
    FirewallRules: [{C578E393-DFD2-4BD4-8DAE-E4400553DC9F}] => C:\Program Files (x86)\Common Files\aol\System Information\sinf.exe
    FirewallRules: [{FEE19B29-34E2-4AAF-96F4-BC3C38A242CC}] => C:\Program Files (x86)\Common Files\aol\acs\AOLDial.exe
    FirewallRules: [{8B235874-8695-4803-9E94-DABEC285A2D6}] => C:\Program Files (x86)\Common Files\aol\acs\AOLDial.exe
    FirewallRules: [{ACF6ECE1-0A31-4557-BAA9-CB00F4D42EC9}] => C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
    FirewallRules: [{61B642A8-5A5D-4FCD-89C4-762A17A3028E}] => C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
    FirewallRules: [{2A51CE14-25B3-41B6-8F34-C7311D62D628}] => C:\Program Files (x86)\Common Files\aol\1266376774\ee\aolsoftware.exe
    FirewallRules: [{877F0C44-9495-4C75-BF62-01F2C2A45A08}] => C:\Program Files (x86)\Common Files\aol\1266376774\ee\aolsoftware.exe
    FirewallRules: [{565441FB-6440-48D6-AA72-FAA27C83C8DB}] => C:\Program Files (x86)\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe
    FirewallRules: [{8F8B1064-0D97-40C2-B931-0B0E8DB30B9C}] => C:\Program Files (x86)\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe
    FirewallRules: [TCP Query User{192081BE-155C-457F-A37B-5048B34F69C1}C:\program files (x86)\java\jre6\bin\javaw.exe] => C:\program files (x86)\java\jre6\bin\javaw.exe
    FirewallRules: [UDP Query User{28F198F7-2B94-4466-96DB-E6BC041B3869}C:\program files (x86)\java\jre6\bin\javaw.exe] => C:\program files (x86)\java\jre6\bin\javaw.exe
    FirewallRules: [TCP Query User{443AD249-6FE2-4433-9AD5-6750ACA0BF0D}C:\program files (x86)\internet explorer\iexplore.exe] => C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [UDP Query User{88A9D563-AE18-4277-8645-787FA28053F3}C:\program files (x86)\internet explorer\iexplore.exe] => C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [{411E3024-1022-4A1E-80C3-09E19922D123}] => C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{C843AA50-5A97-43DF-B4ED-46A762BBF1E8}] => C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{3C00B2FE-3D90-4E88-9D10-04AE6DB9127C}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{12B531DB-ACC9-45B0-AA9F-3E5B997531B0}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{D1F65838-171E-4D08-9309-55CA5E0CD190}] => C:\Users\graymassie\AppData\Roaming\Dropbox\bin\Dropbox.exe
    FirewallRules: [{6F99D0C1-8EB1-4410-B3DC-AAEB3F6391D1}] => C:\Users\graymassie\AppData\Roaming\Dropbox\bin\Dropbox.exe
    FirewallRules: [TCP Query User{CCBE0BEB-4FCA-4C45-9ED7-66FD442B68A2}C:\users\graymassie\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\graymassie\appdata\roaming\dropbox\bin\dropbox.exe
    FirewallRules: [UDP Query User{E3BB5564-95FE-4251-872A-B267F24A1589}C:\users\graymassie\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\graymassie\appdata\roaming\dropbox\bin\dropbox.exe
    FirewallRules: [{F08786B7-917A-4572-872A-C0150FAAA775}] => C:\Program Files (x86)\Mozilla FireFox\firefox.exe
    FirewallRules: [{8BECDDDE-59DE-4271-9766-6F1E1639D2E6}] => C:\Program Files (x86)\Mozilla FireFox\firefox.exe
    FirewallRules: [TCP Query User{953ADF8A-4BEC-4521-9AAA-AC2BDD9D2633}C:\program files (x86)\mozilla firefox\firefox.exe] => C:\program files (x86)\mozilla firefox\firefox.exe
    FirewallRules: [UDP Query User{D3D8BB10-2B1B-4596-8537-2EE72DC3483C}C:\program files (x86)\mozilla firefox\firefox.exe] => C:\program files (x86)\mozilla firefox\firefox.exe
    FirewallRules: [{AAFD3818-CCB5-473A-A3A3-EBCD3F239493}] => C:\Program Files\iTunes\iTunes.exe
    FirewallRules: [{D14E0B29-182A-4EFF-ACF1-0DD20B7A3D4D}] => C:\Users\graymassie\AppData\Local\Chromium\Application\chrome.exe
    FirewallRules: [{43A549F4-B465-43A7-9569-B9F9187227D3}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    ==================== Restore Points =========================

    25-11-2016 21:20:28 Windows Update

    ==================== Faulty Device Manager Devices =============

    Name: BHDrvx64
    Description: BHDrvx64
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: BHDrvx64
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name: Symantec Iron Driver
    Description: Symantec Iron Driver
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: SymIRON
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name: Avast! Firewall Driver
    Description: Avast! Firewall Driver
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: aswNdisFlt
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (12/02/2016 03:17:21 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
    Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

    Error: (12/02/2016 03:17:21 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
    Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

    Error: (12/02/2016 03:07:29 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
    Description: A problem prevented Customer Experience Improvement Program data from being consolidated into files that can be sent to Microsoft, (Error 80004005).

    Error: (11/26/2016 04:51:23 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
    Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: WindowsLive.Writer.BrowserControl, Version=14.0.8089.726, Culture=neutral, PublicKeyToken=31bf3856ad364e35 . Error code = 0x80070020

    Error: (11/26/2016 04:51:02 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
    Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: WindowsLive.Writer.PostEditor, Version=14.0.8089.726, Culture=neutral, PublicKeyToken=31bf3856ad364e35 . Error code = 0x80070020

    Error: (11/26/2016 03:39:19 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
    Description: A problem prevented Customer Experience Improvement Program data from being consolidated into files that can be sent to Microsoft, (Error 80004005).

    Error: (11/25/2016 11:27:21 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
    Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - Failed to compile: Mcx2Dvcs, Version=6.1.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 . Error code = 0x80070020

    Error: (11/25/2016 11:24:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 15646

    Error: (11/25/2016 11:24:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 15646

    Error: (11/25/2016 11:24:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second


    System errors:
    =============
    Error: (12/02/2016 03:00:26 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    aswNdisFlt
    BHDrvx64
    cdrom
    SymIRON

    Error: (12/02/2016 02:59:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The avast! Firewall service failed to start due to the following error:
    The service did not respond to the start or control request in a timely fashion.

    Error: (12/02/2016 02:59:58 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: A timeout was reached (30000 milliseconds) while waiting for the avast! Firewall service to connect.

    Error: (12/02/2016 02:59:34 PM) (Source: atikmdag) (EventID: 10261) (User: )
    Description: Display is not active

    Error: (12/02/2016 02:59:34 PM) (Source: atikmdag) (EventID: 19468) (User: )
    Description: CPLIB :: General - Invalid Parameter

    Error: (11/26/2016 03:24:49 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    aswNdisFlt
    BHDrvx64
    cdrom
    SymIRON

    Error: (11/26/2016 03:24:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The avast! Firewall service failed to start due to the following error:
    The service did not respond to the start or control request in a timely fashion.

    Error: (11/26/2016 03:24:11 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: A timeout was reached (30000 milliseconds) while waiting for the avast! Firewall service to connect.

    Error: (11/26/2016 03:22:49 PM) (Source: atikmdag) (EventID: 10261) (User: )
    Description: Display is not active

    Error: (11/26/2016 03:22:49 PM) (Source: atikmdag) (EventID: 19468) (User: )
    Description: CPLIB :: General - Invalid Parameter


    CodeIntegrity:
    ===================================
    Date: 2013-10-01 21:18:15.953
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-10-01 21:09:30.566
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-10-01 21:01:36.062
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-10-01 20:18:06.132
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-10-01 19:14:20.473
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-10-01 15:56:26.051
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-09-30 13:45:36.583
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-09-30 13:12:46.618
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-09-29 19:12:01.230
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-09-29 19:01:22.849
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: AMD Athlon(tm) Neo X2 Dual Core Processor L325
    Percentage of memory in use: 87%
    Total physical RAM: 1790.36 MB
    Available physical RAM: 216.05 MB
    Total Virtual: 3580.72 MB
    Available Virtual: 1947 MB

    ==================== Drives ================================

    Drive c: (TI105238W0E) (Fixed) (Total:287.73 GB) (Free:166.17 GB) NTFS ==>[system with boot components (obtained from drive)]
    Drive d: (USB20FD) (Removable) (Total:119.19 GB) (Free:30.17 GB) FAT32

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: B7784A6C)
    Partition 1: (Active) - (Size=1.5 GB) - (Type=27)
    Partition 2: (Not Active) - (Size=287.7 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=8.9 GB) - (Type=17)

    ========================================================
    Disk: 1 (Size: 119.2 GB) (Disk ID: 67B99DAF)
    Partition 1: (Not Active) - (Size=119.2 GB) - (Type=0B)

    ==================== End of Addition.txt ============================
     
    BillB,
    #4
  6. 2016/12/02
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =================================

    [​IMG] Do NOT create multiple topics.
    From now on continue right here.

    [​IMG] 2GB of RAM is very little. I strongly suggest you add more RAM.

    [​IMG] You're running two AV programs, Avast and Symantec (Norton).
    You must uninstall one of them.
    If Norton use this tool: Download Norton Removal Tool - MajorGeeks

    [​IMG] Uninstall following unwanted programs:

    Catalina Savings Printer
    DomaIQ
    Download Updater
    SelectionLinks
    Strongvault Online Backup

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2
    • Close all the running programs
    • Double click on downloaded setup.exe file to install the program.
    • Click on Start Scan button.
    • Click on another Start Scan button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.

    [​IMG] Please download Malwarebytes Anti-Malware to your desktop.
    • Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
    • Click Finish.
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.

    Already installed:
    2.0 Threat Scan
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.
    How to get logs:
    (Export log to save as txt)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the scan log which shows the Date and time of the scan just performed.
    • Click 'Export'.
    • Click 'Text file (*.txt)'
    • In the Save File dialog box which appears, click on Desktop.
    • In the File name: box type a name for your scan log.
    • A message box named 'File Saved' should appear stating "Your file has been successfully exported ".
    • Click Ok
    • Attach that saved log to your next reply.
    (Copy to clipboard for pasting into forum replies or tickets)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the scan log which shows the Date and time of the scan just performed.
    • Click 'Copy to Clipboard'
    • Paste the contents of the clipboard into your reply.

    [​IMG] Please download AdwCleaner by Xplode and save to your Desktop.
    • Double click on AdwCleaner.exe to run the tool.
      Vista/Windows 7/8 users right-click and select Run As Administrator
    • The tool will start to update the database if one is required.
    • Click on the Scan button.
    • AdwCleaner will begin...be patient as the scan may take some time to complete.
    • After the scan has finished, click on the Logfile button.
    • A window will open which lists the logs of your scans.
    • Click on the Scan tab.
    • Double-click the most recent scan which will be at the top of the list....the log will appear.
    • Review the results...see note below
    • After reviewing the log, click on the Clean button.
    • Press OK when asked to close all programs and follow the onscreen prompts.
    • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
    • After rebooting, a logfile report (AdwCleaner[CX].txt) will open automatically (where the largest value of X represents the most recent report).
    • To open a Cleaning log, launch AdwareClearer, click on the Logfile button, click on the Cleaning tab and double-click the log at the top of the list.
    • Copy and paste the contents of AdwCleaner[CX].txt in your next reply.
    • A copy of all logfiles are saved to C:\AdwCleaner.

    -- Note: The contents of the AdwCleaner log file may be confusing. Unless you see a program name or entry that you recognize and know should not be removed, don't worry about it. If you see an entry you want to keep, return to AdwCleaner before cleaning...all detected items will be listed (and checked) in each tab. Click on and uncheck any items you want to keep.


    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
     
    broni,
    #5
  7. 2016/12/04
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    Hi Broni,

    Here's where I am so far, I downloaded the norton removal tool but it will not run saying the file is unsigned. I even tried getting it from Symantec and had the same issue.

    I was able to uninstall catalina savings printer, download updater. domaiq and selection links said they were already uninstalled and were removed from program list. Strongvault said it was missing a file and it would not continue.

    Thought I would post this before going further since the norton tool would not run.
     
    BillB,
    #6
  8. 2016/12/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    What is the EXACT message about the file being unsigned?
     
    broni,
    #7
  9. 2016/12/05
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    There's a pop-up window with the title, SymNRT:Invalid Signature, inside the window is the message; This file is not signed so it won't run. When I click ok, it goes away and nothing happens.
     
    BillB,
    #8
  10. 2016/12/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    It looks like there is no workaround so....

    Revo Uninstaller is more thorough in deleting programs on your computer than using the Add/Remove option in Windows. Since it is a more powerful tool, please be sure to follow the instructions carefully.

    Please note there is a chance when you look for this program to uninstall through Revo it might not be listed because of the previous uninstall. If that is the case simply stop and let me know.
    • Please download and install Revo Uninstaller Free
    • Double click Revo Uninstaller to run it.
    • From the list of programs double click on the program you want to remove
    • When prompted if you want to uninstall click Yes.
    • Be sure the Moderate option is selected then click Next.
    • The program will run, If prompted again click Yes
    • When the built-in uninstaller is finished click on Next
    • Once the program has searched for leftovers click Next.
    • Check the items in bold only on the list then click Delete. You may have to expand some folders by clicking the "+" mark.
    • When prompted click on Yes and then on Next.
    • Put a check on any folders that are found and select Delete
    • When prompted select Yes then Next
    • Once done click Finish.
     
    broni,
    #9
  11. 2016/12/07
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    Broni,

    Revo didn't find any Symantec or Norton programs to uninstall.
     
    BillB,
    #10
  12. 2016/12/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    broni,
    #11
  13. 2016/12/07
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    That didn't find it either.
     
    BillB,
    #12
  14. 2016/12/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    OK. We'll remove it manually later.
    Proceed with other steps.
     
    broni,
    #13
  15. 2016/12/09
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    Broni,

    Here are the logs you requested, Malware bytes found nothing to cleanup.
    RogueKiller V12.8.3.0 (x64) [Nov 28 2016] (Free) by Adlice Software
    mail : Contact - Adlice Software
    Feedback : Adlice forum - Home
    Website : RogueKiller Anti-Malware Free Download - Official Website
    Blog : Adlice Software

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : graymassie [Administrator]
    Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
    Mode : Delete -- Date : 12/08/2016 14:25:01 (Duration : 02:06:42)

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 45 ¤¤¤
    [PUP] (X64) HKEY_LOCAL_MACHINE\Software\Tarma Installer -> Deleted
    [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Conduit -> Deleted
    [PUP] (X86) HKEY_LOCAL_MACHINE\Software\InfoAtoms -> Deleted
    [PUP] (X86) HKEY_LOCAL_MACHINE\Software\MetaStream -> Deleted
    [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Viewpoint -> Deleted
    [PUP] (X86) HKEY_LOCAL_MACHINE\Software\W3i -> Deleted
    [PUP] (X64) HKEY_USERS\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Conduit -> Deleted
    [PUP] (X64) HKEY_USERS\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\eSupport.com -> Deleted
    [PUP] (X64) HKEY_USERS\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Zugo -> Deleted
    [PUP] (X86) HKEY_USERS\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Conduit -> Deleted
    [PUP] (X86) HKEY_USERS\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\eSupport.com -> Deleted
    [PUP] (X86) HKEY_USERS\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Zugo -> Deleted
    [PUP] (X64) HKEY_USERS\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\AppDataLow\Software\Conduit -> Deleted
    [PUP] (X86) HKEY_USERS\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\AppDataLow\Software\Conduit -> Deleted
    [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer -> Deleted
    [PUM.Proxy] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NlaSvc\Parameters\Internet\ManualProxies | (default) : -> Deleted
    [PUM.Proxy] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\NlaSvc\Parameters\Internet\ManualProxies | (default) : -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {242F35A1-276E-445B-AF76-861E2175DDB8} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS7129.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {0DCF21BE-9234-42E7-BD25-36009A62F91B} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS7129.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {729907F5-9F4D-4C8A-B754-6A710ADA759E} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS758C.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {B7556A45-45FD-47B2-A810-B2B94E762120} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS758C.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {17A35869-7336-44F9-A0F7-481C5FA691CD} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS68B1.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {B94D8620-809C-4A7D-8193-C5151FF9F435} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS68B1.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {BBE79352-E5AC-4871-95DE-5C58DCCA23B4} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSDF28.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {B998751F-5529-4233-A179-5CCA1EAA0E93} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSDF28.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {FCA16218-BAF4-47A7-AA58-B5D5FEEC8593} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSAD7E.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {BD06F837-4E63-4D17-B6C1-7724A5AFDBB1} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSAD7E.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {A6C54EC2-D56B-41CC-9437-DFF2B5BFEAEE} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSB74E.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {436A0606-F65C-4426-AD42-FE533552F339} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSB74E.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {86C896A7-8960-495A-817D-2E6BE1CAC9C1} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS3F7F.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {3DE46E32-0764-41B5-9011-3163F07880A4} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS3F7F.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {242F35A1-276E-445B-AF76-861E2175DDB8} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS7129.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {0DCF21BE-9234-42E7-BD25-36009A62F91B} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS7129.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {729907F5-9F4D-4C8A-B754-6A710ADA759E} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS758C.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {B7556A45-45FD-47B2-A810-B2B94E762120} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS758C.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {17A35869-7336-44F9-A0F7-481C5FA691CD} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS68B1.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {B94D8620-809C-4A7D-8193-C5151FF9F435} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS68B1.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {BBE79352-E5AC-4871-95DE-5C58DCCA23B4} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSDF28.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {B998751F-5529-4233-A179-5CCA1EAA0E93} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSDF28.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {FCA16218-BAF4-47A7-AA58-B5D5FEEC8593} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSAD7E.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {BD06F837-4E63-4D17-B6C1-7724A5AFDBB1} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSAD7E.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {A6C54EC2-D56B-41CC-9437-DFF2B5BFEAEE} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSB74E.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {436A0606-F65C-4426-AD42-FE533552F339} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zSB74E.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {86C896A7-8960-495A-817D-2E6BE1CAC9C1} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS3F7F.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {3DE46E32-0764-41B5-9011-3163F07880A4} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\graymassie\AppData\Local\Temp\7zS3F7F.tmp\SymNRT.exe|Name=Norton Removal Tool| [x] -> Deleted

    ¤¤¤ Tasks : 2 ¤¤¤
    [Suspicious.Path] %WINDIR%\Tasks\iMeshNAG.job -- C:\Users\GRAYMA~1\AppData\Local\Temp\iMesh_setup.exe (NAGMETHOD=Schedule) -> Deleted
    [Suspicious.Path] \iMeshNAG -- C:\Users\GRAYMA~1\AppData\Local\Temp\iMesh_setup.exe (NAGMETHOD=Schedule) -> Deleted

    ¤¤¤ Files : 19 ¤¤¤
    [PUP][Folder] C:\ProgramData\AOL Toolbar -> Removed at reboot [91]
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\aoltb.cfg -> Removed at reboot [5]
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\aoltbres.dll -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\buttons\defaultButtons.xml -> Deleted
    [PUP][Folder] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\buttons -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\local\search.html -> Deleted
    [PUP][Folder] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\local -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\rss\bullet.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\rss\qap.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\rss\rss.css -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\rss\rss.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\rss\rss.js -> Deleted
    [PUP][Folder] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\rss -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ticker\rss_close.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ticker\rss_close_over.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ticker\rss_open.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ticker\rss_open_over.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ticker\rss_right.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ticker\rss_tile.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ticker\ticker.css -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ticker\ticker.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ticker\ticker.js -> Deleted
    [PUP][Folder] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ticker -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\00.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\01.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\02.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\03.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\04.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\05.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\06.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\07.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\08.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\09.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\about.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\addbuddybutton.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\addcustombutton.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\addcustombutton_confirm.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\ani_media_icon.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\blocker.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\blue_input_down_0.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\blue_input_down_1.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\blue_input_down_2.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\blue_input_normal_0.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\blue_input_normal_1.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\blue_input_normal_2.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\blue_input_over_0.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\blue_input_over_1.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\blue_input_over_2.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\branding.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\buddy.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\buttonManager.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\buttons.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\buttons_frame.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_movedowndisabled.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_movedowndown.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_movedownover.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_movedownup.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_moveupdisabled.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_moveupdown.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_moveupover.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_moveupup.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_nextdown.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_nextover.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_nextup.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_prevdown.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_prevover.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\button_prevup.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\clearprints.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\clearprints_confirm.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\content.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\custombutton.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\customize_icon.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\defaultsearch.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\disabled_input_0.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\disabled_input_1.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\disabled_input_2.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\dot.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\dropcustombutton.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\firsttimepage.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\footprints.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\footprints_frame.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\general_icon.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\green_input_down_0.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\green_input_down_1.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\green_input_down_2.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\green_input_normal_0.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\green_input_normal_1.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\green_input_normal_2.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\green_input_over_0.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\green_input_over_1.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\green_input_over_2.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\latest.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\metrics.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\olderversion.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\options.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\options_frame.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_bottom_left.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_bottom_right.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_bottom_tile.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_left_tile.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_right_tile.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_top_left.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_top_left_bot.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_top_left_large.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_top_right.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_top_right_bot.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_top_right_large.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\pan_top_tile.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\popups_frame.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\popups_icon.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\popup_icon.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\preferences.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\preferences.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\privacy_icon.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\renamecustombutton.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\resettoolbar.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\search.js -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\search_frame.htm -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\search_icon.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\SettingTabActive.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\SettingTabNormal.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\SettingTabOver.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\sidebar_bg.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\sidebar_bottom.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\sidebar_left.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\sidebar_top.gif -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui\stylesheet.css -> Deleted
    [PUP][Folder] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\ui -> Deleted
    [PUP][Folder] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US -> Removed at reboot [91]
    [PUP][Folder] C:\ProgramData\AOL Toolbar\ieToolbar\resources -> Removed at reboot [91]
    [PUP][Folder] C:\ProgramData\AOL Toolbar\ieToolbar -> Removed at reboot [91]
    [PUP][Folder] C:\ProgramData\BrowserDefender -> Deleted
    [PUP][Folder] C:\ProgramData\Partner -> Deleted
    [PUP][File] C:\ProgramData\Partner\debug.log -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\ComponentRegistry.ini -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\HostRegistry.ini -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\MetaStreamConfig.ini -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-672059697.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-681648789.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-716026614.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\URLCache.ini -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1588488936.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-1697589072.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1024896942.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1136233701.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\290547230.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\URLCache.ini -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-207333975.mtx -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\346840136.mtx -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\407034558.ini -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\648662744.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\URLCache.ini -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-299234580.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-347626359.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\2091149108.swf -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\URLCache.ini -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\UpdateVersionList_v2.mtx -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\Welcome\BH00 -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources\Welcome -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\Resources -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9\FLFBootStrap.mtx -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9 -> Deleted
    [PUP][File] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9Plus\FLFBootStrap.mtx -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9Plus -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology\UserShell -> Deleted
    [PUP][Folder] C:\ProgramData\Viewpoint\Viewpoint Experience Technology -> Deleted
    [PUP][Folder] C:\Users\graymassie\AppData\Roaming\ShopAtHome -> Deleted
    [PUP][File] C:\Users\graymassie\AppData\Roaming\ShopAtHome\ShopAtHomeAppInstaller_C98143037_D1_R92316.exe -> Deleted
    [PUP][Folder] C:\Users\graymassie\AppData\Local\AOL Toolbar -> Deleted
    [PUP][File] C:\Users\graymassie\AppData\Local\AOL Toolbar\ieToolbar\en-US\aolnewstopstories -> Deleted
    [PUP][File] C:\Users\graymassie\AppData\Local\AOL Toolbar\ieToolbar\en-US\buttons.xml -> Deleted
    [PUP][File] C:\Users\graymassie\AppData\Local\AOL Toolbar\ieToolbar\en-US\default_aol.xml -> Deleted
    [PUP][File] C:\Users\graymassie\AppData\Local\AOL Toolbar\ieToolbar\en-US\domains.xml -> Deleted
    [PUP][File] C:\Users\graymassie\AppData\Local\AOL Toolbar\ieToolbar\en-US\ietbconfig.xml -> Deleted
    [PUP][File] C:\Users\graymassie\AppData\Local\AOL Toolbar\ieToolbar\en-US\pagealerts.xml -> Deleted
    [PUP][File] C:\Users\graymassie\AppData\Local\AOL Toolbar\ieToolbar\en-US\publish.xml -> Deleted
    [PUP][Folder] C:\Users\graymassie\AppData\Local\AOL Toolbar\ieToolbar\en-US -> Deleted
    [PUP][Folder] C:\Users\graymassie\AppData\Local\AOL Toolbar\ieToolbar -> Deleted
    [PUP][Folder] C:\Users\graymassie\AppData\Local\PackageAware -> Deleted
    [PUP][Folder] C:\Users\graymassie\AppData\Local\SwvUpdater -> Deleted
    [PUP][File] C:\Users\graymassie\AppData\Local\SwvUpdater\status.cfg -> Deleted
    [PUP][Folder] C:\ProgramData\AOL Toolbar -> Deleted
    [PUP][File] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US\aoltb.cfg -> Deleted
    [PUP][Folder] C:\ProgramData\AOL Toolbar\ieToolbar\resources\en-US -> Deleted
    [PUP][Folder] C:\ProgramData\AOL Toolbar\ieToolbar\resources -> Deleted
    [PUP][Folder] C:\ProgramData\AOL Toolbar\ieToolbar -> Deleted
    [PUP][Folder] C:\ProgramData\BrowserDefender -> ERROR [3]
    [PUP][Folder] C:\ProgramData\Partner -> ERROR [3]
    [PUP][Folder] C:\ProgramData\Viewpoint -> ERROR [3]
    [PUP][Folder] C:\Program Files\DomaIQ Uninstaller -> Deleted
    [PUP][File] C:\Program Files\DomaIQ Uninstaller\Uninstall.xml -> Deleted
    [PUP][Folder] C:\Program Files (x86)\AOL Toolbar -> Deleted
    [PUP][File] C:\Program Files (x86)\AOL Toolbar\aoltb.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\AOL Toolbar\aoltbServer.exe -> Deleted
    [PUP][File] C:\Program Files (x86)\AOL Toolbar\aoltbServerPS.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\AOL Toolbar\apopup.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\AOL Toolbar\install.log -> Deleted
    [PUP][File] C:\Program Files (x86)\AOL Toolbar\msvcr71.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\AOL Toolbar\uninstall.exe -> Deleted
    [PUP][File] C:\Program Files (x86)\AOL Toolbar\xprt5.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\AOL Toolbar\xprt6.dll -> Deleted
    [PUP][Folder] C:\Program Files (x86)\Conduit -> Deleted
    [PUP][Folder] C:\Program Files (x86)\DriverRestore -> Deleted
    [PUP][Folder] C:\Program Files (x86)\OApps -> Deleted
    [PUP][File] C:\Program Files (x86)\OApps\chrome-sl.crx -> Deleted
    [PUP][File] C:\Program Files (x86)\OApps\dler.exe -> Deleted
    [PUP][File] C:\Program Files (x86)\OApps\status2.txt -> Deleted
    [PUP][File] C:\Program Files (x86)\OApps\status3.txt -> Deleted
    [PUP][Folder] C:\Program Files (x86)\PC Health Kit -> Deleted
    [PUP][File] C:\Program Files (x86)\PC Health Kit\English.ini -> Deleted
    [PUP][File] C:\Program Files (x86)\PC Health Kit\PCHealthKit.exe -> Deleted
    [PUP][File] C:\Program Files (x86)\PC Health Kit\PCHKGuard.exe -> Deleted
    [PUP][File] C:\Program Files (x86)\PC Health Kit\PCHKLauncher.exe -> Deleted
    [PUP][File] C:\Program Files (x86)\PC Health Kit\PCHKReminder.exe -> Deleted
    [PUP][File] C:\Program Files (x86)\PC Health Kit\PCHKSchedule.exe -> Deleted
    [PUP][File] C:\Program Files (x86)\PC Health Kit\PCHKSmartScan.exe -> Deleted
    [PUP][File] C:\Program Files (x86)\PC Health Kit\sqlite3.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\PC Health Kit\unins000.exe -> Deleted
    [PUP][Folder] C:\Program Files (x86)\Viewpoint -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\ClassIDs.ini -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\ComponentMgr.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\AOLArt.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\AOLShell.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\AOLUserShell.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\Cursors.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\DataTracking.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\GifReader.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\JpegReader.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\LensFlares.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\Mts3Reader.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\ObjectMovie.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\SceneComponent.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\ServiceComponent.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\SreeDMMX.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\SWFView.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\VectorView.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\VMPAudio.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\VMPExtras.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\VMPSpeech.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\WaveletReader.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components\ZoomView.dll -> Deleted
    [PUP][Folder] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\Components -> Deleted
    [PUP][Folder] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\DownloadedComponents -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\MtsAxInstaller.exe -> Deleted
    [PUP][Folder] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\NewComponents -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll -> Deleted
    [PUP][File] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.xpt -> Deleted
    [PUP][Folder] C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology -> Deleted

    ¤¤¤ WMI : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 1 ¤¤¤
    [PUM.HomePage][Firefox:Config] h79j4u84.default : user_pref( "browser.startup.homepage ", "Restore Browser Settings "); -> Replaced (about:home)

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: TOSHIBA MK3263GSX ATA Device +++++
    --- User ---
    [MBR] 8fd68767ae0d3034073e1826380ee792
    [BSP] 6f40e6870018457d42744ef6daa0de06 : HP MBR Code
    Partition table:
    0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 MB
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 3074048 | Size: 294638 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 606492672 | Size: 9106 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive1: PNY USB 2.0 FD USB Device +++++
    --- User ---
    [MBR] 6a0f9ee3844de468bb10b645afaa9910
    [BSP] 2ffc821f1970031b5e50cb108de04bb5 : Unknown|VT.Unknown MBR Code
    Partition table:
    0 - [XXXXXX] FAT32 (0xb) [VISIBLE] Offset (sectors): 2056 | Size: 122085 MB
    User = LL1 ... OK
    Error reading LL2 MBR! ([32] The request is not supported. )
     
    BillB,
    #14
  16. 2016/12/09
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    # AdwCleaner v6.040 - Logfile created 09/12/2016 at 11:05:06
    # Updated on 02/12/2016 by Malwarebytes
    # Database : 2016-12-09.1 [Server]
    # Operating System : Windows 7 Home Premium Service Pack 1 (X64)
    # Username : graymassie - GRAYMASSIE-PC
    # Running from : C:\Users\graymassie\Desktop\AdwCleaner.exe
    # Mode: Clean
    # Support : https://www.malwarebytes.com/support



    ***** [ Services ] *****



    ***** [ Folders ] *****

    [-] Folder deleted: C:\Users\graymassie\Documents\PC Health Kit
    [-] Folder deleted: C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klibnahbojhkanfgaglnlalfkgpcppfi


    ***** [ Files ] *****



    ***** [ DLL ] *****



    ***** [ WMI ] *****



    ***** [ Shortcuts ] *****



    ***** [ Scheduled Tasks ] *****



    ***** [ Registry ] *****

    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WT078475
    [#] Key deleted on reboot: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WT078475_is1
    [-] Key deleted: HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
    [-] Key deleted: HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
    [-] Key deleted: HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
    [#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
    [#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
    [#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
    [#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
    [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{B27D9527-3762-4D71-963D-FB7A94FDD678}
    [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
    [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
    [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
    [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
    [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
    [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
    [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
    [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
    [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
    [-] Key deleted: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}
    [#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}
    [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}
    [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
    [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\azlyrics.com
    [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com
    [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\dregol.com
    [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\mysearchresults.com
    [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\searchcompletion.com
    [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com
    [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\utorrent.en.softonic.com
    [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.azlyrics.com
    [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.dregol.com
    [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
    [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\azlyrics.com
    [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com
    [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\dregol.com
    [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\mysearchresults.com
    [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\searchcompletion.com
    [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com
    [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\utorrent.en.softonic.com
    [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.azlyrics.com
    [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.dregol.com
    [-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Shared Tools\MsConfig\StartupReg\PC Health Kit
    [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\IEHelperv2.5.0.DLL
    [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\SelectionLinks.DLL
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
    [-] Key deleted: HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
    [-] Key deleted: HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP


    ***** [ Web browsers ] *****

    [-] [C:\Users\graymassie\AppData\Local\Chromium\User Data\Default\Web data] [Search Provider] Deleted: dregol
    [-] [C:\Users\graymassie\AppData\Local\Chromium\User Data\Default] [extension] Deleted: ihokndmjeombjojnfkmapfnjeghjohim
    [-] [C:\Users\graymassie\AppData\Local\Chromium\User Data\Default] [extension] Deleted: ippkomaaonokjnfjoikaemidanojkfmm
    [-] [C:\Users\graymassie\AppData\Local\Chromium\User Data\Default] [extension] Deleted: klibnahbojhkanfgaglnlalfkgpcppfi
    [-] [C:\Users\graymassie\AppData\Local\Chromium\User Data\Default] [homepage] Deleted: hxxp://www.dregol.com/?f=1&a=drg_mdaffmarmar_15_30&cd=2XzuyEtN2Y1L1QzuyBtDtC0AtDyEzy0EyCzzzy0C0C0AtA0EtN0D0Tzu0StCtBzyyCtN1L2XzutAtFtCtBtFtCtFtCtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StC0BtDyD0CyB0D0CtGyC0ByBzztG0FtAtA0AtGtA0DtAyBtGzytB0F0FyC0D0D0Dzy0C0F0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EyD0BtDyD0A0FyDtGzzzytCyCtGyEyE0CyDtG0AyE0F0FtGyEyC0D0B0FyCyE0BzztCtD0A2QtN0A0LzuyE&cr=1768113399&ir=&uref=chmm
    [-] [C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: search.conduit.com
    [-] [C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
    [-] [C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
    [-] [C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: Dregol.com
    [-] [C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: ihokndmjeombjojnfkmapfnjeghjohim
    [-] [C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: ippkomaaonokjnfjoikaemidanojkfmm
    [-] [C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: klibnahbojhkanfgaglnlalfkgpcppfi


    *************************

    :: "Tracing" keys deleted
    :: Winsock settings cleared

    *************************

    C:\AdwCleaner\AdwCleaner[C0].txt - [7743 Bytes] - [09/12/2016 11:05:06]
    C:\AdwCleaner\AdwCleaner[S0].txt - [7450 Bytes] - [09/12/2016 10:35:42]

    ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [7889 Bytes] ##########


    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 8.0.9 (09.30.2016)
    Operating System: Windows 7 Home Premium x64
    Ran by graymassie (Administrator) on Fri 12/09/2016 at 12:23:56.98
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    File System: 25

    Successfully deleted: C:\ai_recyclebin (Folder)
    Successfully deleted: C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gpdgdlcjhlbaphcjmagicjhhgfnkiihp_0.localstorage-journal (File)
    Successfully deleted: C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gpdgdlcjhlbaphcjmagicjhhgfnkiihp_0.localstorage (File)
    Successfully deleted: C:\Users\graymassie\Appdata\LocalLow\delta (Folder)
    Successfully deleted: C:\Users\graymassie\AppData\Roaming\registry mechanic (Folder)
    Successfully deleted: C:\Program Files (x86)\GUT34E2.tmp (File)
    Successfully deleted: C:\Program Files (x86)\GUTBC0F.tmp (File)
    Successfully deleted: C:\Program Files (x86)\GUTEC81.tmp (File)
    Successfully deleted: C:\Program Files (x86)\GUTF3D.tmp (File)
    Successfully deleted: C:\Users\graymassie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\graymassie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\graymassie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\80LA2F8K (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\graymassie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\815FSTXO (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\graymassie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\graymassie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KREK84QD (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\graymassie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\graymassie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y4DXGMW7 (Temporary Internet Files Folder)
    Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
    Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
    Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\80LA2F8K (Temporary Internet Files Folder)
    Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\815FSTXO (Temporary Internet Files Folder)
    Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
    Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KREK84QD (Temporary Internet Files Folder)
    Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)
    Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y4DXGMW7 (Temporary Internet Files Folder)



    Registry: 3

    Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{A34FF9F8-5169-44F8-8D60-DE66CAFE6E6C} (Registry Key)
    Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)
    Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)




    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Fri 12/09/2016 at 12:37:44.06
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
    BillB,
    #15
  17. 2016/12/09
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Malwarebytes log?
     
    broni,
    #16
  18. 2016/12/09
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    Sorry, there was nothing found so I didn't think you would want it, here it is;
    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 12/8/2016
    Scan Time: 4:54 PM
    Logfile: mbam-log-2016-12-08 (16-54-03).txt
    Administrator: Yes

    Version: 2.2.1.1043
    Malware Database: v2016.12.08.15
    Rootkit Database: v2016.11.20.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: graymassie

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 345614
    Time Elapsed: 47 min, 7 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Warn
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 0
    (No malicious items detected)

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
    BillB,
    #17
  19. 2016/12/09
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: Metadefender Endpoint Management
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: Downloading RKill
    iExplore.exe (renamed rKill.exe): Downloading RKill

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
    broni,
    #18
  20. 2016/12/11
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    ComboFix 16-12-06.01 - graymassie 12/11/2016 16:17:03.1.2 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1790.743 [GMT -5:00]
    Running from: c:\users\graymassie\Desktop\ComboFix.exe
    AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AV: Norton Internet Security *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
    FW: avast! Antivirus *Disabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
    FW: Norton Internet Security *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
    SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    SP: Norton Internet Security *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\programdata\Microsoft\Windows\DRM\906C.tmp
    c:\windows\msdownld.tmp
    .
    .
    ((((((((((((((((((((((((( Files Created from 2016-11-11 to 2016-12-11 )))))))))))))))))))))))))))))))
    .
    .
    2016-12-11 21:37 . 2016-12-11 21:37 -------- d-----w- c:\users\Default\AppData\Local\temp
    2016-12-11 21:32 . 2016-12-11 21:32 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{28D10669-B67A-421F-BE32-8EDAC189977A}\offreg.4524.dll
    2016-12-09 15:30 . 2016-12-09 16:05 -------- d-----w- C:\AdwCleaner
    2016-12-08 19:25 . 2016-12-08 19:25 28272 ----a-w- c:\windows\system32\drivers\TrueSight.sys
    2016-12-08 19:22 . 2016-12-08 19:23 -------- d-----w- c:\program files\RogueKiller
    2016-12-08 19:22 . 2016-12-08 21:39 -------- d-----w- c:\programdata\RogueKiller
    2016-12-07 20:31 . 2016-12-07 20:31 -------- d-----w- c:\program files\VS Revo Group
    2016-12-02 20:15 . 2016-12-02 20:30 -------- d-----w- C:\FRST
    2016-11-25 23:53 . 2016-02-02 18:57 511488 ----a-w- c:\windows\system32\rpcss.dll
    2016-11-25 23:53 . 2016-03-06 18:53 2048 ----a-w- c:\windows\system32\msxml3r.dll
    2016-11-25 23:53 . 2016-03-06 18:53 1885696 ----a-w- c:\windows\system32\msxml3.dll
    2016-11-25 23:53 . 2016-03-06 18:38 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
    2016-11-25 23:53 . 2016-03-06 18:38 1240576 ----a-w- c:\windows\SysWow64\msxml3.dll
    2016-11-25 23:53 . 2016-03-17 22:56 2084864 ----a-w- c:\windows\system32\ole32.dll
    2016-11-25 23:53 . 2016-03-17 22:28 1414144 ----a-w- c:\windows\SysWow64\ole32.dll
    2016-11-25 23:51 . 2016-04-09 07:01 986344 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
    2016-11-25 23:50 . 2016-05-13 22:15 382184 ----a-w- c:\windows\system32\atmfd.dll
    2016-11-25 23:49 . 2016-05-11 17:02 296448 ----a-w- c:\windows\system32\ws2_32.dll
    2016-11-25 23:49 . 2016-05-11 17:02 444928 ----a-w- c:\windows\system32\winhttp.dll
    2016-11-25 23:49 . 2016-05-11 17:02 327168 ----a-w- c:\windows\system32\mswsock.dll
    2016-11-25 23:49 . 2016-05-11 15:19 206336 ----a-w- c:\windows\SysWow64\ws2_32.dll
    2016-11-25 23:49 . 2016-05-11 15:19 351744 ----a-w- c:\windows\SysWow64\winhttp.dll
    2016-11-25 23:49 . 2016-05-11 15:19 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
    2016-11-25 23:49 . 2016-05-11 15:11 25088 ----a-w- c:\windows\system32\netbtugc.exe
    2016-11-25 23:49 . 2016-05-11 15:01 26624 ----a-w- c:\windows\SysWow64\netbtugc.exe
    2016-11-25 23:49 . 2016-05-11 14:58 262144 ----a-w- c:\windows\system32\drivers\netbt.sys
    2016-11-25 23:48 . 2016-01-22 06:18 961024 ----a-w- c:\windows\system32\CPFilters.dll
    2016-11-25 23:48 . 2016-01-22 06:18 723968 ----a-w- c:\windows\system32\EncDec.dll
    2016-11-25 23:48 . 2016-01-22 06:04 642048 ----a-w- c:\windows\SysWow64\CPFilters.dll
    2016-11-25 23:48 . 2016-01-22 06:04 535040 ----a-w- c:\windows\SysWow64\EncDec.dll
    2016-11-25 23:45 . 2016-04-09 07:01 5546216 ----a-w- c:\windows\system32\ntoskrnl.exe
    2016-11-25 23:44 . 2016-04-14 16:42 1941504 ----a-w- c:\windows\system32\authui.dll
    2016-11-25 23:44 . 2016-04-14 16:42 3243520 ----a-w- c:\windows\system32\msi.dll
    2016-11-25 23:44 . 2016-04-14 16:46 114408 ----a-w- c:\windows\system32\consent.exe
    2016-11-25 23:44 . 2016-04-14 15:33 2365440 ----a-w- c:\windows\SysWow64\msi.dll
    2016-11-25 23:44 . 2016-04-14 16:42 504320 ----a-w- c:\windows\system32\msihnd.dll
    2016-11-25 23:44 . 2016-04-14 16:42 25088 ----a-w- c:\windows\system32\msimsg.dll
    2016-11-25 23:44 . 2016-04-14 16:42 70144 ----a-w- c:\windows\system32\appinfo.dll
    2016-11-25 23:44 . 2016-04-14 15:33 337408 ----a-w- c:\windows\SysWow64\msihnd.dll
    2016-11-25 23:44 . 2016-04-14 15:33 25088 ----a-w- c:\windows\SysWow64\msimsg.dll
    2016-11-25 23:44 . 2016-04-14 15:33 1806848 ----a-w- c:\windows\SysWow64\authui.dll
    2016-11-25 23:44 . 2016-04-14 15:19 128000 ----a-w- c:\windows\system32\msiexec.exe
    2016-11-25 23:44 . 2016-04-14 15:11 73216 ----a-w- c:\windows\SysWow64\msiexec.exe
    2016-11-25 02:31 . 2016-11-25 02:31 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{28D10669-B67A-421F-BE32-8EDAC189977A}\offreg.216.dll
    2016-11-24 21:39 . 2016-12-09 20:17 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2016-11-24 21:38 . 2016-03-10 19:09 64896 ----a-w- c:\windows\system32\drivers\mwac.sys
    2016-11-24 21:38 . 2016-03-10 19:08 140672 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2016-11-24 21:38 . 2016-11-24 21:39 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
    2016-11-24 19:17 . 2016-11-24 19:17 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{28D10669-B67A-421F-BE32-8EDAC189977A}\offreg.5708.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2016-11-25 20:31 . 2012-08-05 05:24 796352 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2016-11-25 20:31 . 2012-01-17 15:33 142528 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2016-11-28 14:09 223552 ----a-w- c:\users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2016-11-28 14:09 223552 ----a-w- c:\users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2016-11-28 14:09 223552 ----a-w- c:\users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SUPERAntiSpyware "= "c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2016-11-07 7943072]
    "Dropbox Update "= "c:\users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe" [2016-04-16 143144]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC "= "c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-30 98304]
    "TWebCamera "= "c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-11-05 2446648]
    "NortonOnlineBackupReminder "= "c:\program files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" [2009-08-10 529256]
    "GrooveMonitor "= "c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
    "HostManager "= "c:\program files (x86)\Common Files\AOL\1266376774\ee\AOLSoftware.exe" [2010-03-08 41800]
    "APSDaemon "= "c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2015-03-20 60712]
    "NACAgentUI "= "c:\program files (x86)\Cisco\Cisco NAC Agent\NACAgentUI.exe" [2012-12-03 610776]
    "AvastUI.exe "= "c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-11-26 6133520]
    "QuickTime Task "= "c:\program files (x86)\QuickTime\QTTask.exe" [2014-10-02 421888]
    .
    c:\users\graymassie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dropbox.lnk - c:\users\graymassie\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2016-12-4 25838592]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin "= 5 (0x5)
    "ConsentPromptBehaviorUser "= 3 (0x3)
    "EnableUIADesktopToggle "= 0 (0x0)
    "SoftwareSASGeneration "= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
    "LoadAppInit_DLLs "=1 (0x1)
    "RequireSignedAppInit_DLLs "=0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=" "
    .
    R1 aswNdisFlt;Avast! Firewall Driver;c:\windows\system32\DRIVERS\aswNdisFlt.sys;c:\windows\SYSNATIVE\DRIVERS\aswNdisFlt.sys [x]
    R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100211.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100211.001\BHDrvx64.sys [x]
    R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1106000.020\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1106000.020\Ironx64.SYS [x]
    R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
    R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe;c:\program files\AVAST Software\Avast\afwServ.exe [x]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [x]
    R3 GamesAppIntegrationService;GamesAppIntegrationService;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [x]
    R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
    R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
    R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
    S0 aswRvrt;avast! Revert; [x]
    S0 aswVmm;avast! VM Monitor; [x]
    S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1106000.020\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1106000.020\SYMDS64.SYS [x]
    S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1106000.020\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1106000.020\SYMEFA64.SYS [x]
    S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys;c:\windows\SYSNATIVE\DRIVERS\thpdrv.sys [x]
    S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS;c:\windows\SYSNATIVE\DRIVERS\Thpevm.SYS [x]
    S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys;c:\windows\SYSNATIVE\drivers\aswKbd.sys [x]
    S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
    S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
    S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NISx64\1106000.020\ccHPx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1106000.020\ccHPx64.sys [x]
    S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100310.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100310.001\IDSvia64.sys [x]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
    S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NISx64\1106000.020\SYMTDIV.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1106000.020\SYMTDIV.SYS [x]
    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
    S2 Apple Mobile Device Service;Apple Mobile Device Service;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [x]
    S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
    S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [x]
    S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [x]
    S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
    S2 NACAgent;Cisco NAC Agent;c:\program files (x86)\Cisco\Cisco NAC Agent\NACAgent.exe;c:\program files (x86)\Cisco\Cisco NAC Agent\NACAgent.exe [x]
    S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\17.6.0.32\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security\Engine\17.6.0.32\ccSvcHst.exe [x]
    S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]
    S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]
    S2 Unchecky;Unchecky;c:\program files (x86)\Unchecky\bin\unchecky_svc.exe;c:\program files (x86)\Unchecky\bin\unchecky_svc.exe [x]
    S3 CnxtHdmiAudService;Conexant UAA HDMI Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDMI64.sys;c:\windows\SYSNATIVE\drivers\CHDMI64.sys [x]
    S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
    S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]
    S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys;c:\windows\SYSNATIVE\DRIVERS\QIOMem.sys [x]
    S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]
    S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
    LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2016-11-25 14:44 1364072 ----a-w- c:\program files (x86)\Google\Chrome\Application\54.0.2840.99\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2016-12-11 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-05 20:31]
    .
    2016-12-08 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000Core.job
    - c:\users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-30 15:42]
    .
    2016-12-11 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000UA.job
    - c:\users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-30 15:42]
    .
    2016-12-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-17 23:34]
    .
    2016-12-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-17 23:34]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @= "{472083B0-C522-11CF-8763-00608CC02F24} "
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2015-10-18 01:33 780616 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ThpSrv "= "c:\windows\system32\thpsrv" [X]
    "cAudioFilterAgent "= "c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-10-09 508472]
    "SmartAudio "= "c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-07-16 307768]
    "SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-05-30 1794856]
    "TosSENotify "= "c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-09-17 709976]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2015-04-07 169768]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = Google
    mStart Page = Google
    mLocal Page = c:\windows\SysWOW64\blank.htm
    mSearch Page = {searchTerms} - Google Search
    mSearch Bar = Google
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
    TCP: DhcpNameServer = 192.168.1.1
    DPF: {76CBDDBA-3897-4EAC-A1D3-CCC47DE82EFB} - hxxps://suri-ccas01.edmc.edu/auth/taweb.cab
    FF - ProfilePath - c:\users\graymassie\AppData\Roaming\Mozilla\Firefox\Profiles\h79j4u84.default\
    FF - prefs.js: browser.startup.homepage - about:homeabout:home
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    Wow6432Node-HKLM-Run-TUSBSleepChargeSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
    HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
    HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
    HKLM-Run-SmoothView - c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe
    HKLM-Run-00TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
    HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
    HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe
    HKLM-Run-ConexantAudioPatch - c:\program files (x86)\ConexantAudioPatch\Audioreset.exe
    HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
    HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
    AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
    AddRemove-AOL Toolbar - c:\program files (x86)\AOL Toolbar\uninstall.exe
    .
    .
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
    "ImagePath "= "\ "c:\program files (x86)\Norton Internet Security\Engine\17.6.0.32\ccSvcHst.exe\" /s \ "NIS\" /m \ "c:\program files (x86)\Norton Internet Security\Engine\17.6.0.32\diMaster.dll\" /prefetch:1 "
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_23_0_0_207_ActiveX.exe,-101 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled "=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @= "c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_23_0_0_207_ActiveX.exe "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker6 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_23_0_0_207_ActiveX.exe,-101 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled "=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @= "c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_23_0_0_207_ActiveX.exe "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @= "Shockwave Flash Object "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @= "c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_23_0_0_207.ocx "
    "ThreadingModel "= "Apartment "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @= "0 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @= "ShockwaveFlash.ShockwaveFlash.23 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @= "c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_23_0_0_207.ocx, 1 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @= "1.0 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @= "ShockwaveFlash.ShockwaveFlash "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @= "Macromedia Flash Factory Object "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @= "c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_23_0_0_207.ocx "
    "ThreadingModel "= "Apartment "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @= "FlashFactory.FlashFactory.1 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @= "c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_23_0_0_207.ocx, 1 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @= "1.0 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @= "FlashFactory.FlashFactory "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker6 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet\f*í*g%S%]
    "Successes "=dword:00000000
    "Failures "=dword:000007ff
    "{DC620884-DD72-484B-AB30-4B52A0B0022E} "=hex:00,1a,70,50,14,64
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2016-12-11 16:43:07
    ComboFix-quarantined-files.txt 2016-12-11 21:43
    .
    Pre-Run: 183,557,816,320 bytes free
    Post-Run: 185,975,521,280 bytes free
    .
    - - End Of File - - DB572CCFE600FB7E3349B15C265D0AD9
    5B5E648D12FCADC244C1EC30318E1EB9
     
    BillB,
    #19
  21. 2016/12/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

    • Double click to run it.
    • Make sure you checkmark Addition.txt box.
    • Press Scan button.
    • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.
     
    broni,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...