Compromised System [Solved]

Hi all,

My laptop is slow, has been for a while. When I bring up Task Manager (Windows 10 upgraded recently from 8.1) I see multiple com surrogates in my process list. I also have a "Hidden Network" active in my WiFi list that is there most places I travel.

My HiJackThis log is posted below. Any help is much appreciated.

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 10:22:33 PM, on 10/27/2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10240.16412)

FIREFOX: 41.0.2 (x86 en-US)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Users\Will\AppData\Roaming\Spotify\SpotifyWebHelper.exe
C:\Users\Will\AppData\Roaming\Spotify\Spotify.exe
C:\Users\Will\AppData\Roaming\Spotify\SpotifyCrashService.exe
C:\Users\Will\AppData\Roaming\Spotify\Spotify.exe
C:\Users\Will\AppData\Roaming\Spotify\Spotify.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Will\Downloads\HijackThis(1).exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
F2 - REG:system.ini: UserInit=
O2 - BHO: Soda PDF 7 Helper - {1D31AA81-4D4B-4BFB-B3AF-B6DDD6DF43B1} - C:\Program Files (x86)\Soda PDF 7\creator-ie-helper.dll
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Will\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [Spotify] "C:\Users\Will\AppData\Roaming\Spotify\Spotify.exe" -autostart -minimized
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: Intel Bluetooth Service (iBtSiva) - Intel Corporation - c:\windows\syswow64\ibtsiva.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService2.0.0.0) - Unknown owner - C:\WINDOWS\system32\igfxCUIService.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Lenovo WiFiHotspot Service (LenovoWiFiHotspotSvr) - Unknown owner - C:\Windows\System32\LenovoWiFiHotspotSvr.exe (file missing)
O23 - Service: LiveUpdate (LiveUpdateSvc) - IObit - C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\System32\ngcsvc.dll,-100 (NgcSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\WINDOWS\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: SODA Manager - LULU Software Limited - C:\ProgramData\LULU Software\Soda Manager\Soda Manager.exe
O23 - Service: Soda PDF 7 - LULU SOFTWARE LIMITED - C:\Program Files (x86)\Soda PDF 7\ws.exe
O23 - Service: Soda PDF 7 CrashHandler - LULU SOFTWARE LIMITED - C:\Program Files (x86)\Soda PDF 7\crash-handler-ws.exe
O23 - Service: Soda PDF 7 Creator - LULU SOFTWARE LIMITED - C:\Program Files (x86)\Soda PDF 7\creator-ws.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 9101 bytes
 

Thank you. Here are my log files in the order they were requested:

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2015-11-01 13:44:53
—————————–
13:44:53.596    OS Version: Windows x64 6.2.9200
13:44:53.597    Number of processors: 8 586 0x3C03
13:44:53.597    ComputerName: NACHOMAN  UserName: Will
13:44:55.918    Initialize success
13:44:55.952    VM: initialized successfully
13:44:55.952    VM: Intel CPU BiosDisabled
14:08:56.623    AVAST engine defs: 15110101
14:10:28.040    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000033
14:10:28.042    Disk 0 Vendor: WDC_WD10S21X-24R1BT0-SSHD-8GB 03.01A01 Size: 953869MB BusType: 11
14:10:28.100    Disk 0 MBR read successfully
14:10:28.105    Disk 0 MBR scan
14:10:28.114    Disk 0 unknown MBR code
14:10:28.117    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
14:10:28.170    Disk 0 scanning C:\WINDOWS\system32\drivers
14:10:41.182    Service scanning
14:11:12.124    Modules scanning
14:11:12.128    Disk 0 trace - called modules:
14:11:12.134    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll iaStorA.sys
14:11:12.138    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe000768b1060]
14:11:12.141    3 CLASSPNP.SYS[fffff8004e6a46c5] -> nt!IofCallDriver -> \Device\00000033[0xffffe00073f2e060]
14:11:15.515    AVAST engine scan C:\WINDOWS
14:11:19.766    AVAST engine scan C:\WINDOWS\system32
14:15:31.227    AVAST engine scan C:\WINDOWS\system32\drivers
14:15:51.940    AVAST engine scan C:\Users\Will
14:30:04.108    AVAST engine scan C:\ProgramData
14:31:42.766    Disk 0 statistics 4732417/0/0 @ 3.15 MB/s
14:31:42.770    Scan finished successfully
14:31:50.550    Disk 0 MBR has been saved successfully to "C:\Users\Will\Desktop\MBR.dat"
14:31:50.558    The log file has been saved successfully to "C:\Users\Will\Desktop\aswMBR.txt"

——————————————————

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:31-10-2015
Ran by [removed] (administrator) on NACHOMAN (01-11-2015 14:14:12)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 10 Home (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft) C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe
(Intel Corporation) C:\Windows\SysWOW64\ibtsiva.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
(IObit) C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(LULU Software Limited) C:\ProgramData\LULU Software\Soda Manager\Soda Manager.exe
(LULU SOFTWARE LIMITED) C:\Program Files (x86)\Soda PDF 7\creator-ws.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek semiconductor) C:\Windows\RTFTrack.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(Spotify Ltd) C:\Users\Will\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Spotify Ltd) C:\Users\Will\AppData\Roaming\Spotify\Spotify.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Spotify Ltd) C:\Users\Will\AppData\Roaming\Spotify\SpotifyCrashService.exe
(Spotify Ltd) C:\Users\Will\AppData\Roaming\Spotify\Spotify.exe
(Spotify Ltd) C:\Users\Will\AppData\Roaming\Spotify\Spotify.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_19_0_0_226.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_19_0_0_226.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1026.13580.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
() C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
(AVAST Software) C:\Users\Will\Desktop\aswMBR.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14021336 2015-07-18] (Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-07-18] (Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg_LENOVO_DOLBYDRAGON] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-07-18] (Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-07-18] (Realtek Semiconductor)
HKLM\…\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [9299672 2015-09-28] (Realtek semiconductor)
HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-20] (NVIDIA Corporation)
HKLM\…\Run: [ShadowPlay] => C:\windows\system32\rundll32.exe C:\windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\…\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [16093512 2014-10-19] (Lenovo(beijing) Limited)
HKLM\…\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [8235848 2014-10-19] (Lenovo(beijing) Limited)
HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3935912 2015-09-28] (Synaptics Incorporated)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\Run: [Spotify Web Helper] => C:\Users\Will\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2030912 2015-10-24] (Spotify Ltd)
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\Run: [Spotify] => C:\Users\Will\AppData\Roaming\Spotify\Spotify.exe [7736128 2015-10-24] (Spotify Ltd)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{0623d693-8520-44c1-9869-0f99ee013326}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{98e19589-f5bd-49c4-8ef4-4a0027bcf9fb}: [DhcpNameServer] 169.254.224.91

Internet Explorer:
==================
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://home.lenovo.com
BHO-x32: Soda PDF 7 Helper -> {1D31AA81-4D4B-4BFB-B3AF-B6DDD6DF43B1} -> C:\Program Files (x86)\Soda PDF 7\creator-ie-helper.dll [2015-08-05] (LULU SOFTWARE LIMITED)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File

FireFox:
========
FF ProfilePath: C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\uq64d3r6.default
FF DefaultSearchEngine.US: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-16] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-16] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Soda PDF 7 -> C:\Program Files (x86)\Soda PDF 7\np-previewer.dll [2015-08-05] (LULU SOFTWARE LIMITED)
FF user.js: detected! => C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\uq64d3r6.default\user.js [2015-07-18]
FF Extension: Adblock Plus - C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\uq64d3r6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-09-24]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Soda PDF 7\resources\sodapdf7firefoxextension => not found

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 iBtSiva; c:\windows\syswow64\ibtsiva.exe [120016 2014-04-03] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [351120 2015-07-17] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-16] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-10-19] (Lenovo(beijing) Limited)
R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2909472 2015-07-30] (IObit)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 NovaPdfServer; C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe [41760 2015-07-14] (Microsoft)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-20] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-20] (NVIDIA Corporation)
R2 SODA Manager; C:\ProgramData\LULU Software\Soda Manager\Soda Manager.exe [868688 2015-01-29] (LULU Software Limited)
S3 Soda PDF 7; C:\Program Files (x86)\Soda PDF 7\ws.exe [2129176 2015-08-05] (LULU SOFTWARE LIMITED)
S3 Soda PDF 7 CrashHandler; C:\Program Files (x86)\Soda PDF 7\crash-handler-ws.exe [847640 2015-08-05] (LULU SOFTWARE LIMITED)
R2 Soda PDF 7 Creator; C:\Program Files (x86)\Soda PDF 7\creator-ws.exe [650520 2015-08-05] (LULU SOFTWARE LIMITED)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [237568 2015-07-10] (Microsoft Corporation)
R1 HWiNFO32; C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-07-18] (REALiX™)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [263952 2015-07-14] (Intel Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [184608 2015-09-28] (Intel Corporation)
R3 NETwNb64; C:\Windows\System32\drivers\Netwbw02.sys [3497240 2015-07-18] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38048 2015-07-18] (NVIDIA Corporation)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [895256 2015-09-28] (Realtek                                            )
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [752856 2015-09-28] (Realsil Semiconductor Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [3049176 2015-09-28] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33960 2015-09-28] (Synaptics Incorporated)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)
U3 aswMBR; C:\Users\Will\AppData\Local\Temp\aswMBR.sys [62728 2015-11-01] () [File not signed]
U3 aswVmm; C:\Users\Will\AppData\Local\Temp\aswVmm.sys [224896 2015-11-01] ()
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-01 14:14 - 2015-11-01 14:14 - 00013556 _____ C:\Users\Will\Desktop\FRST.txt
2015-11-01 14:13 - 2015-11-01 14:14 - 00000000 ____D C:\FRST
2015-11-01 14:00 - 2015-11-01 14:00 - 99814627 _____ C:\Users\Will\Downloads\240P_316K_2072933.mp4.part
2015-11-01 14:00 - 2015-11-01 14:00 - 00000000 _____ C:\Users\Will\Downloads\240P_316K_2072933.mp4
2015-11-01 13:20 - 2015-11-01 13:20 - 00008084 _____ C:\WINDOWS\system32\NACHOMAN_Will_HistoryPrediction.bin
2015-11-01 04:20 - 2015-11-01 04:20 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-10-31 14:57 - 2015-10-31 15:23 - 61337553 _____ C:\Users\Will\Downloads\240P_400k_26350692.mp4
2015-10-31 09:51 - 2015-11-01 14:13 - 02198016 _____ (Farbar) C:\Users\Will\Desktop\FRST64.exe
2015-10-31 09:50 - 2015-11-01 13:44 - 05198336 _____ (AVAST Software) C:\Users\Will\Desktop\aswMBR.exe
2015-10-29 22:51 - 2015-10-27 15:38 - 21871616 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-10-29 22:51 - 2015-10-27 15:16 - 18801664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-10-29 22:51 - 2015-10-21 04:45 - 00541024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll
2015-10-29 22:51 - 2015-10-21 04:44 - 00459104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2015-10-29 22:51 - 2015-10-21 04:43 - 01392480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-10-29 22:51 - 2015-10-21 04:39 - 03621248 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-10-29 22:51 - 2015-10-21 04:00 - 24595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-10-29 22:51 - 2015-10-21 04:00 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-10-29 22:51 - 2015-10-21 03:59 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2015-10-29 22:51 - 2015-10-21 03:57 - 02418688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-10-29 22:51 - 2015-10-21 03:52 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2015-10-29 22:51 - 2015-10-21 03:50 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2015-10-29 22:51 - 2015-10-21 03:48 - 01068032 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-10-29 22:51 - 2015-10-21 03:47 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll
2015-10-29 22:51 - 2015-10-21 03:46 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2015-10-29 22:51 - 2015-10-21 03:46 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-10-29 22:51 - 2015-10-21 03:44 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2015-10-29 22:51 - 2015-10-21 03:44 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2015-10-29 22:51 - 2015-10-21 03:43 - 02675200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll
2015-10-29 22:51 - 2015-10-21 03:42 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2015-10-29 22:51 - 2015-10-21 03:41 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2015-10-29 22:51 - 2015-10-21 03:40 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2015-10-29 22:51 - 2015-10-21 03:38 - 00502272 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll
2015-10-29 22:51 - 2015-10-20 21:53 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2015-10-29 22:51 - 2015-10-20 21:49 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-10-29 22:51 - 2015-10-20 21:13 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-10-29 22:51 - 2015-10-20 21:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2015-10-29 22:51 - 2015-10-20 21:08 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-10-29 22:51 - 2015-10-20 21:05 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2015-10-29 22:51 - 2015-10-20 21:03 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-10-29 22:51 - 2015-10-20 21:03 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll
2015-10-29 22:51 - 2015-10-20 20:58 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll
2015-10-29 22:51 - 2015-10-20 20:58 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2015-10-29 22:51 - 2015-10-20 20:55 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll
2015-10-29 22:51 - 2015-10-09 23:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-10-29 22:51 - 2015-10-05 19:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-10-29 22:51 - 2015-10-05 18:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-10-29 22:51 - 2015-09-30 20:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-10-29 22:51 - 2015-09-30 20:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-10-29 22:51 - 2015-09-30 20:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-10-29 22:51 - 2015-09-30 20:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-10-29 22:51 - 2015-09-30 20:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-10-29 22:51 - 2015-09-30 19:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2015-10-29 22:51 - 2015-09-24 20:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2015-10-29 22:51 - 2015-09-24 20:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2015-10-29 22:51 - 2015-09-24 19:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-10-29 22:51 - 2015-09-24 19:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2015-10-29 22:51 - 2015-09-24 19:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2015-10-29 22:51 - 2015-09-24 19:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-10-29 22:51 - 2015-09-24 19:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll
2015-10-29 22:51 - 2015-09-24 19:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll
2015-10-29 22:51 - 2015-09-24 19:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-10-29 22:51 - 2015-09-24 19:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2015-10-29 22:51 - 2015-09-24 19:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-10-29 22:51 - 2015-09-24 19:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2015-10-29 22:51 - 2015-09-24 19:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2015-10-29 22:51 - 2015-09-24 19:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-10-29 22:51 - 2015-09-24 19:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2015-10-29 22:51 - 2015-09-24 19:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-10-29 22:51 - 2015-09-24 19:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2015-10-29 22:51 - 2015-09-24 19:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-10-29 22:51 - 2015-09-24 19:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-10-29 22:51 - 2015-09-24 19:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2015-10-29 22:51 - 2015-09-24 19:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-10-29 22:51 - 2015-09-24 19:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll
2015-10-29 22:51 - 2015-09-24 19:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll
2015-10-29 22:51 - 2015-09-24 18:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2015-10-29 22:51 - 2015-09-24 18:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
2015-10-29 22:51 - 2015-09-24 18:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll
2015-10-29 22:51 - 2015-09-24 18:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-10-29 22:51 - 2015-09-24 18:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-10-29 22:51 - 2015-09-24 18:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2015-10-29 22:51 - 2015-09-24 18:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-10-29 22:51 - 2015-09-24 18:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-10-29 22:51 - 2015-09-24 18:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2015-10-29 22:51 - 2015-09-24 18:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2015-10-29 22:51 - 2015-09-24 18:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-10-29 22:51 - 2015-09-24 18:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2015-10-29 22:51 - 2015-09-24 18:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2015-10-29 22:51 - 2015-09-24 18:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll
2015-10-29 22:51 - 2015-09-24 18:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll
2015-10-29 22:51 - 2015-09-24 18:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll
2015-10-29 22:51 - 2015-09-24 18:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll
2015-10-29 22:51 - 2015-09-24 18:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll
2015-10-29 22:51 - 2015-09-24 18:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2015-10-29 22:51 - 2015-09-24 18:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll
2015-10-28 17:54 - 2015-10-28 17:54 - 00008501 _____ C:\Users\Will\Desktop\EBSCOhost.htm
2015-10-28 17:54 - 2015-10-28 17:54 - 00000000 ____D C:\Users\Will\Desktop\EBSCOhost_files
2015-10-27 21:21 - 2015-10-27 21:22 - 00388608 _____ (Trend Micro Inc.) C:\Users\Will\Downloads\HijackThis(1).exe
2015-10-27 09:58 - 2015-10-27 10:26 - 205912600 _____ C:\Users\Will\Desktop\v57Mimi19.mov
2015-10-25 15:30 - 2015-10-25 15:34 - 07193118 _____ C:\Users\Will\Desktop\v13Was097.mov.part
2015-10-25 15:07 - 2015-10-25 15:30 - 342058422 _____ C:\Users\Will\Desktop\v47Star2.mov
2015-10-25 10:47 - 2015-10-25 11:16 - 46345056 _____ C:\Users\Will\Desktop\v22Aikowasv89.mov
2015-10-25 10:06 - 2015-10-25 10:47 - 400540199 _____ C:\Users\Will\Desktop\v48Star22DSLR.mov
2015-10-25 10:05 - 2015-10-25 10:05 - 00000039 _____ C:\Users\Will\Desktop\SASIAN.txt
2015-10-21 19:57 - 2015-10-15 19:10 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-10-21 19:57 - 2015-10-15 19:10 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-10-21 19:34 - 2015-10-21 19:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-10-21 19:34 - 2015-10-21 19:34 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-10-21 19:34 - 2015-10-21 19:34 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-10-21 19:29 - 2015-10-21 19:34 - 13155552 _____ (Microsoft Corporation) C:\Users\Will\Downloads\Silverlight_x64(1).exe
2015-10-19 20:31 - 2015-10-19 21:03 - 08588639 _____ C:\Users\Will\Desktop\Eichmann in Jerusalem_3.pdf.part
2015-10-19 20:30 - 2015-10-19 20:52 - 05864680 _____ C:\Users\Will\Desktop\Eichmann in Jerusalem_2.pdf.part
2015-10-19 20:29 - 2015-10-19 21:02 - 07736671 _____ C:\Users\Will\Desktop\Eichmann in Jerusalem_1.pdf.part
2015-10-17 12:06 - 2015-10-17 12:06 - 00000000 ____D C:\Users\Will\Desktop\photo
2015-10-16 21:30 - 2015-10-16 21:30 - 03996360 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2015-10-16 21:16 - 2015-10-17 11:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-08 19:02 - 2015-10-08 19:02 - 00333152 _____ C:\WINDOWS\Minidump\100815-27421-01.dmp
2015-10-06 21:05 - 2015-10-06 22:21 - 329973318 _____ C:\Users\Will\Downloads\480P_600K_37838011.mp4
2015-10-06 21:05 - 2015-10-06 21:59 - 306038009 _____ C:\Users\Will\Downloads\480P_600K_34174831.mp4
2015-10-03 13:08 - 2015-10-03 13:08 - 00001202 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-10-03 13:08 - 2015-06-18 07:42 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-10-03 13:08 - 2015-06-18 07:41 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-10-03 13:08 - 2015-06-18 07:41 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-10-03 13:06 - 2015-10-03 13:09 - 00000000 ____D C:\Users\Will\Downloads\backups
2015-10-03 13:03 - 2015-10-27 21:22 - 00009102 _____ C:\Users\Will\Downloads\hijackthis.log
2015-10-03 13:01 - 2015-10-03 13:02 - 00388608 _____ (Trend Micro Inc.) C:\Users\Will\Downloads\HijackThis.exe
2015-10-03 13:00 - 2015-10-03 13:00 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Will\Downloads\mbam-setup-2.1.8.1057.exe
2015-10-03 13:00 - 2015-10-03 13:00 - 00017448 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.140008.6348.log
2015-10-03 13:00 - 2015-10-03 13:00 - 00017382 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.140016.4824.log
2015-10-03 13:00 - 2015-10-03 13:00 - 00000022 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.140016.4824.zip
2015-10-03 13:00 - 2015-10-03 13:00 - 00000022 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.140008.6348.zip
2015-10-03 12:58 - 2015-10-03 12:59 - 00017382 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.135832.6568.log
2015-10-03 12:58 - 2015-10-03 12:58 - 00224968 _____ (ESET) C:\Users\Will\Downloads\ESETPoweliksCleaner.exe
2015-10-03 12:58 - 2015-10-03 12:58 - 00000022 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.135832.6568.zip
2015-10-03 12:50 - 2015-10-03 12:50 - 01457952 _____ C:\Users\Will\Downloads\Process Monitor - CHIP-Installer.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-01 14:10 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\system32\sru
2015-11-01 13:28 - 2015-07-25 14:59 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-11-01 12:46 - 2015-09-18 18:47 - 00000000 ____D C:\Users\Will\AppData\Roaming\Spotify
2015-11-01 04:28 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-11-01 04:26 - 2015-08-05 22:50 - 00875126 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-11-01 04:21 - 2015-09-18 18:56 - 00000000 ____D C:\Users\Will\AppData\Local\Spotify
2015-11-01 04:21 - 2015-07-18 21:35 - 00000000 ____D C:\ProgramData\ProductData
2015-11-01 04:20 - 2015-08-05 22:35 - 00000000 ____D C:\Users\Will
2015-11-01 04:20 - 2015-07-10 04:22 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log
2015-11-01 04:20 - 2015-07-10 04:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-10-30 17:29 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-10-30 02:54 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\rescache
2015-10-30 02:32 - 2015-07-10 01:05 - 00786432 ___SH C:\WINDOWS\system32\config\BBI
2015-10-30 02:31 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-10-29 23:11 - 2015-07-10 02:55 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-10-27 10:29 - 2015-07-18 22:20 - 00000000 ____D C:\Users\Will\AppData\Roaming\vlc
2015-10-22 21:18 - 2015-09-18 18:56 - 00001856 _____ C:\Users\Will\Desktop\Spotify.lnk
2015-10-21 19:57 - 2015-07-18 18:46 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-10-21 19:55 - 2015-07-18 18:46 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-10-17 11:15 - 2015-09-14 18:45 - 00346646 _____ C:\WINDOWS\PFRO.log
2015-10-17 11:15 - 2015-07-16 00:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-10-12 18:16 - 2014-10-19 16:44 - 00000000 ____D C:\ProgramData\Energy Manager
2015-10-08 19:02 - 2015-09-14 20:28 - 661356053 _____ C:\WINDOWS\MEMORY.DMP
2015-10-08 19:02 - 2015-09-04 20:20 - 00000000 ____D C:\WINDOWS\Minidump
2015-10-03 13:13 - 2015-07-18 21:30 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-10-03 13:08 - 2015-07-18 21:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-10-03 13:08 - 2015-07-18 21:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-10-03 13:02 - 2015-07-15 23:55 - 00000000 ____D C:\Users\Will\AppData\Local\VirtualStore
2015-10-02 00:01 - 2015-07-10 03:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2015-10-02 00:01 - 2015-07-10 03:04 - 00000000 ___SD C:\WINDOWS\system32\F12
2015-10-02 00:01 - 2015-07-10 03:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2015-10-02 00:01 - 2015-07-10 03:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-10-02 00:01 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2015-10-02 00:01 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-10-02 00:01 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\Provisioning
2015-10-02 00:00 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\L2Schemas

==================== Files in the root of some directories =======

2015-08-27 18:46 - 2015-08-27 18:46 - 0020609 _____ () C:\Users\Will\AppData\Local\recently-used.xbel
2015-08-05 22:30 - 2015-08-05 22:30 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-10-28 17:03

==================== End of FRST.txt ============================

—————————-

Additional scan result of Farbar Recovery Scan Tool (x64) Version:31-10-2015
Ran by [removed] (2015-11-01 14:14:58)
Running from C:\Users\[removed]\Desktop
Windows 10 Home (X64) (2015-08-06 14:41:46)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2176356827-3411835133-1445305849-500 - Administrator - Disabled) => C:\Users\Administrator
DefaultAccount (S-1-5-21-2176356827-3411835133-1445305849-503 - Limited - Disabled)
Guest (S-1-5-21-2176356827-3411835133-1445305849-501 - Limited - Disabled)
Will (S-1-5-21-2176356827-3411835133-1445305849-1001 - Administrator - Enabled) => C:\Users\Will

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Digital Editions 4.0 (HKLM-x32\…\Adobe Digital Editions 4.0) (Version: 4.0.3 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)
Audacity 2.1.1 (HKLM-x32\…\Audacity®_is1) (Version: 2.1.1 - Audacity Team)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Home Theater (HKLM\…\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
doPDF (Version: 8.3.934 - Softland) Hidden
doPDF 8 (HKLM-x32\…\{0ebed438-cc81-46f7-914b-a4c93d5780f2}) (Version: 8.3.934 - Softland)
Driver Booster 2.4 (HKLM-x32\…\Driver Booster_is1) (Version: 2.4 - IObit)
Echo of Soul (HKLM-x32\…\Steam App 290140) (Version:  - Nvius)
Energy Manager (HKLM-x32\…\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.5.0.23 - Lenovo)
Energy Manager (x32 Version: 1.5.0.23 - Lenovo) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
GIMP 2.8.14 (HKLM\…\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\…\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3540 - Intel Corporation)
Intel(R) Wireless Bluetooth(R) 4.0 (HKLM-x32\…\{96C730E4-F055-4118-BDF3-6E071763853C}) (Version: 3.0.1342.02 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\…\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Lenovo EasyCamera (HKLM-x32\…\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10291 - Realtek Semiconductor Corp.)
Lenovo EasyCamera (HKLM-x32\…\{E399A5B3-ED53-4DEA-AF04-8011E1EB1EAC}) (Version: 6.3.9600.11103 - Realtek Semiconductor Corp.)
Magic Transfer (HKLM\…\{AD2B2BD1-A1D7-4798-8FDD-B2A58FD94E68}) (Version: 1.1.1.11 - )
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Metric Collection SDK 35 (x32 Version: 1.2.0001.00 - Lenovo Group Limited) Hidden
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\…\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 41.0.2 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 41.0.2 (x86 en-US)) (Version: 41.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 41.0.2.5765 - Mozilla)
novaPDF 8 Printer Driver (HKLM\…\{1CC99933-93FC-40BA-A3DD-286FB87CBF2F}) (Version: 8.3.934 - Softland)
novaPDF 8 SDK COM (x64) (HKLM\…\{A8A71610-DE04-4C9E-AE89-60BCA8E20453}) (Version: 8.3.934 - Softland)
novaPDF 8 SDK COM (x86) (HKLM-x32\…\{0FD5EC80-F729-442E-8745-F60315842D9B}) (Version: 8.3.934 - Softland)
NVIDIA GeForce Experience 1.8.2 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2 - NVIDIA Corporation)
NVIDIA Graphics Driver 332.50 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.50 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.0927 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0927 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\…\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.21243 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7541 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.7.306 - NVIDIA Corporation) Hidden
Skype™ 7.0 (HKLM-x32\…\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Soda Manager (x32 Version: 7.0.0.21720 - LULU Software Limited) Hidden
Soda PDF 7 (HKLM-x32\…\Soda7) (Version: 7.3.9.23867 - LULU Software Limited)
Soda PDF 7 Asian Fonts Pack (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Convert Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Create Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Edit Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Forms Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Insert Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 OCR Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Review Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Secure Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 View Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Spotify (HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\Spotify) (Version: 1.0.16.104.g3b776c9e - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\…\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 19.0.13.0 - Synaptics Incorporated)
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.1 - VideoLAN)
Windows Driver Package - Lenovo (ACPIVPC) System  (09/24/2013 19.29.2.34) (HKLM\…\EE9B1F2037C580F36D92FA431CC02BFF04C31F15) (Version: 09/24/2013 19.29.2.34 - Lenovo)
Windows Driver Package - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30.0.288) (HKLM\…\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

08-10-2015 19:55:52 Scheduled Checkpoint
18-10-2015 21:23:16 Scheduled Checkpoint
26-10-2015 19:38:52 Scheduled Checkpoint
29-10-2015 23:08:19 Windows Update
29-10-2015 23:09:18 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 05:25 - 2013-08-22 05:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {11208D9E-BF4F-4602-8599-4F14EF5D3ACB} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)
Task: {21524C87-B819-4EAB-AA78-D44822C0F7A3} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE
Task: {27B7D489-DAE2-4FF1-9988-8390D9A0FADC} - System32\Tasks\doPDF Update => C:\Program Files\Softland\novaPDF 8\Driver\UpdateApplication.exe [2015-07-14] ()
Task: {3C57486A-036C-48E8-A36C-BECF60936C09} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-10-21] (Microsoft Corporation)
Task: {599BF555-3744-44BF-ACF7-E4B562201B90} - \Safer-Networking\Spybot - Search and Destroy\Refresh immunization -> No File <==== ATTENTION
Task: {6BA20132-5BD2-4FF7-82C9-870FF65E9B27} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {700D5E46-9592-4C28-BBCF-B2A8B0D09DC9} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {7BB3157D-EC96-44B4-8389-A0A978ED4103} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {80DFE310-812D-43BD-A2F9-37AC4F1F981B} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2015-09-28] (Synaptics Incorporated)
Task: {8DF1AA84-3AC0-4D3A-B2C1-BB281815D2DB} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {8E4FEA58-4D9C-4436-9B9F-FAE4901246D9} - System32\Tasks\Driver Booster Scan => C:\Program Files (x86)\IObit\Driver Booster\Scheduler.exe [2015-07-06] (IObit)
Task: {9710F1A8-D65E-4CD7-BD26-BF2C256C2A6A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {9982845F-40B1-4D3A-BDF0-EF094F2CE734} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {A995B8B9-01E5-4891-B502-A9A41EDE1192} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {AA6E1200-65F8-408A-953E-45EA67971C94} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {B054A0BD-E53D-4D2F-A71B-C9C29A3C0644} - System32\Tasks\Driver Booster Update => C:\Program Files (x86)\IObit\Driver Booster\AutoUpdate.exe [2015-07-06] (IObit)
Task: {B26877BB-DCC9-4445-9CD9-DDD1B83A3BD5} - \Safer-Networking\Spybot - Search and Destroy\Check for updates -> No File <==== ATTENTION
Task: {B7BED873-EB76-4719-B558-7784B39148A5} - System32\Tasks\Driver Booster SkipUAC (Will) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe [2015-07-06] (IObit)
Task: {D30C7455-B2B3-46AC-916B-B2642D2FD162} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {D955AE02-94F6-4AB1-99E3-F0B111694E5F} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {DC181402-F32A-4920-8595-206ACDF1A7EA} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)
Task: {DC228AA7-30E6-4996-BB63-9EAE824C8A2E} - System32\Tasks\DolbySelectorTask => C:\Program Files\Dolby Digital Plus\ddp.exe
Task: {E1AA2FE7-958D-4F03-8DA8-D342888D3D92} - \Safer-Networking\Spybot - Search and Destroy\Scan the system -> No File <==== ATTENTION
Task: {E580C4C4-47F0-4E60-8ABB-5508A7644154} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-05-30] (Lenovo)
Task: {F02CD1B8-49D3-444F-A869-BA66D0E1F5EE} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-16] (Adobe Systems Incorporated)
Task: {F2B73C63-4055-4C27-8D2D-2C25D4282E19} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2015-08-05 23:14 - 2015-08-05 23:14 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll
2015-08-05 22:32 - 2015-07-22 17:10 - 00116552 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-08-19 19:04 - 2015-08-11 01:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll
2015-07-14 11:34 - 2015-07-14 11:34 - 00137368 _____ () C:\Program Files\Softland\novaPDF 8\Server\AgileDotNetRT64.dll
2015-09-30 18:19 - 2015-09-16 22:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-09-30 18:19 - 2015-09-16 22:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2015-09-30 18:18 - 2015-09-16 21:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-09-30 18:18 - 2015-09-16 22:04 - 00642048 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\MtcUvc.dll
2015-09-30 18:19 - 2015-09-16 21:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-09-30 18:18 - 2015-09-16 21:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-09-30 18:18 - 2015-09-16 21:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-09-30 18:19 - 2015-09-16 21:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2014-03-26 11:50 - 2014-10-19 16:44 - 00058864 _____ () C:\Program Files (x86)\Lenovo\Energy Manager\kbdhook.dll
2015-10-26 17:33 - 2015-10-26 17:35 - 00012800 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1026.13580.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2015-10-26 17:33 - 2015-10-26 17:35 - 10958848 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1026.13580.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2015-10-26 17:33 - 2015-10-26 17:35 - 00245760 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1026.13580.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2015-07-18 23:43 - 2015-07-18 23:43 - 00124440 _____ () C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
2015-07-18 21:37 - 2014-10-16 09:26 - 00622880 _____ () C:\Program Files (x86)\IObit\LiveUpdate\ProductStatistics.dll
2015-10-24 15:28 - 2015-10-24 15:28 - 50678592 _____ () C:\Users\Will\AppData\Roaming\Spotify\libcef.dll
2015-10-24 15:28 - 2015-10-24 15:28 - 01880896 _____ () C:\Users\Will\AppData\Roaming\Spotify\libglesv2.dll
2015-10-24 15:28 - 2015-10-24 15:28 - 00081216 _____ () C:\Users\Will\AppData\Roaming\Spotify\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:B3503B59

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\1001movie.com -> 1001movie.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\1001night.biz -> 1001night.biz
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\100gal.net -> 100gal.net
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\100sexlinks.com -> 100sexlinks.com

There are 4788 more sites.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Will\AppData\Local\Microsoft\Windows\INetCache\IE\U1IMOB7W\IMG_4322[1].JPG
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\…\StartupApproved\Run32: => "IObit Malware Fighter"
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\StartupApproved\Run: => "Advanced SystemCare 8"
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\StartupApproved\Run: => "OneDrive"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{6A1624B6-B99E-439D-9DD1-44608D5A4C46}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{D892288D-C404-4C0A-912F-C4C7279D2715}] => (Allow) LPort=1900
FirewallRules: [{3E3CA3F0-876F-438B-AF73-E7843C64249E}] => (Allow) LPort=2869
FirewallRules: [{87D1932E-4F0F-40D0-8B57-D4DBA4408831}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{3B6E3C0A-5337-4A1D-BD9E-216EE10D19E6}] => (Allow) C:\Users\Will\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{E2BE0D38-C927-430E-A9A4-DED4AABC82DE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Echo of Soul\EOSLauncher.exe
FirewallRules: [{1AF01789-BC82-44F5-B85B-352409B973E9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Echo of Soul\EOSLauncher.exe
FirewallRules: [{F218B7E5-C882-4732-BB64-D291C1234D70}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{9DA4038F-3E5F-4FD4-B159-39E745CD53F6}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{950864CE-BDA7-46CE-8DFE-04F55573C2AE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1818016D-4335-41FF-96B5-67ABD6F56757}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F66CBAE9-FFFE-45D2-8347-5C641A632FAD}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{D0EF40B1-CDFF-4F1F-8ABB-251424005BC1}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F200BFE1-3435-4061-B431-FEC2800E8625}] => (Allow) C:\Program Files\Lenovo PhotoMasterImport\PhotoMasterImport.exe
FirewallRules: [{D174B03B-ADD2-4C1C-9236-9715C13AEB80}] => (Allow) LPort=55100
FirewallRules: [{638CA194-B3D5-4B37-AE4F-BB16D30DDB47}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{9F6CF7BE-4360-41DB-84EC-6581F2585703}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{DD10F961-A5E3-476E-89D0-D12274C36D12}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{39200CCE-525A-417F-A478-07EBFD6BC264}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{0D36EEFD-CAC1-4929-97F0-8B44E63489AF}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{94255C29-62B0-4C41-8F83-0140D206094B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{BF864626-531E-4EEC-BB74-F5847D4CBA67}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{90B0DF68-13F7-4A4B-9B02-C88899A8E371}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{38AC29A0-6ABD-41DD-A850-0A33CB218576}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{92242951-C317-43C0-8211-AD2CEBC64CF4}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{20E13B38-31C7-4C14-8BFE-A66EAD148CC7}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{1BF3D4B6-4335-41DF-8227-F14E0E13622B}] => (Allow) LPort=8501
FirewallRules: [{F4FC1C05-9D04-4315-844E-BAF3899D11B9}] => (Allow) LPort=8501
FirewallRules: [TCP Query User{BEC9E62B-77F3-4FCD-BC6A-2E04439E8026}C:\users\will\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\will\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{3CB7FFA4-8025-4910-858B-4113605C16F9}C:\users\will\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\will\appdata\roaming\spotify\spotify.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/29/2015 11:09:42 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (10/29/2015 11:08:29 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (10/28/2015 05:57:48 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: NACHOMAN)
Description: Activation of app Microsoft.Windows.Photos_8wekyb3d8bbwe!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (10/27/2015 09:21:32 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (5948) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.

Error: (10/27/2015 09:21:32 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (5948) An attempt to create the file "C:\WINDOWS\system32\edbtmp.log" failed with system error 5 (0x00000005): "Access is denied. ".  The create file operation will fail with error -1032 (0xfffffbf8).

Error: (10/27/2015 09:21:22 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (5948) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.

Error: (10/27/2015 09:21:22 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (5948) An attempt to create the file "C:\WINDOWS\system32\edbtmp.log" failed with system error 5 (0x00000005): "Access is denied. ".  The create file operation will fail with error -1032 (0xfffffbf8).

Error: (10/27/2015 09:21:11 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (5948) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.

Error: (10/27/2015 09:21:11 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (5948) An attempt to create the file "C:\WINDOWS\system32\edbtmp.log" failed with system error 5 (0x00000005): "Access is denied. ".  The create file operation will fail with error -1032 (0xfffffbf8).

Error: (10/27/2015 09:21:01 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (5948) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.


System errors:
=============
Error: (11/01/2015 04:28:29 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070002: Twitter.

Error: (11/01/2015 04:28:29 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80073cf9: Twitter.

Error: (11/01/2015 04:28:24 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070002: Twitter.

Error: (11/01/2015 04:28:24 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80073cf9: Twitter.

Error: (11/01/2015 04:28:21 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070002: Twitter.

Error: (11/01/2015 04:28:21 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80073cf9: Twitter.

Error: (11/01/2015 04:28:14 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070002: Twitter.

Error: (11/01/2015 04:23:45 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}

Error: (11/01/2015 04:22:07 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (11/01/2015 04:22:06 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable


CodeIntegrity:
===================================
  Date: 2015-11-01 04:36:26.415
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-31 04:36:04.716
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-28 18:04:34.162
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-28 06:58:34.434
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-26 19:57:10.348
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-24 00:24:56.803
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-20 22:01:05.855
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-20 18:08:01.564
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-18 21:13:52.192
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-16 21:08:45.289
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-4700HQ CPU @ 2.40GHz
Percentage of memory in use: 53%
Total physical RAM: 8104.27 MB
Available physical RAM: 3802.56 MB
Total Virtual: 9384.27 MB
Available Virtual: 4710.8 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:888.87 GB) (Free:797.72 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:24.9 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: B408360E)

Partition: GPT.

==================== End of Addition.txt ============================

Not looking at anything earth shattering on your logs.

Hey ken545,

Here are my logs:

AdwCleaner[S1]:

# AdwCleaner v5.016 - Logfile created 01/11/2015 at 18:09:50
# Updated 01/11/2015 by Xplode
# Database : 2015-11-01.2 [Local]
# Operating system : Windows 10 Home  (x64)
# Username : Will - NACHOMAN
# Running from : C:\Users\Will\Desktop\AdwCleaner.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

Folder Found : C:\ProgramData\pokki

***** [ Files ] *****

File Found : C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\uq64d3r6.default\user.js

***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\Classes\pokki
Key Found : HKLM\SOFTWARE\Classes\AppID\{20B9C05C-99C9-4BAB-B596-FB0C0E1C9F55}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{100EB1FD-D03E-47FD-81F3-EE91287F9465}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{69A72A8A-84ED-4A75-8CE7-263DBEF3E5D3}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C900B400-CDFE-11D3-976A-00E02913A9E0}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E8DAAA30-6CAA-4B58-9603-8E54238219E2}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F9765480-72D1-11D4-A75A-004F49045A87}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FC87A650-207D-4392-A6A1-82ADBC56FA64}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E99D4D0C-EB54-46AF-B62A-3AA1F31D53E5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}

***** [ Web browsers ] *****


########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2080 bytes] ##########
 

————————-

AdwCleaner[C1]:

# AdwCleaner v5.016 - Logfile created 01/11/2015 at 18:10:24
# Updated 01/11/2015 by Xplode
# Database : 2015-11-01.2 [Local]
# Operating system : Windows 10 Home  (x64)
# Username : Will - NACHOMAN
# Running from : C:\Users\Will\Desktop\AdwCleaner.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\ProgramData\pokki

***** [ Files ] *****

[-] File Deleted : C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\uq64d3r6.default\user.js

***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Classes\pokki
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{20B9C05C-99C9-4BAB-B596-FB0C0E1C9F55}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{100EB1FD-D03E-47FD-81F3-EE91287F9465}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{69A72A8A-84ED-4A75-8CE7-263DBEF3E5D3}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C900B400-CDFE-11D3-976A-00E02913A9E0}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E8DAAA30-6CAA-4B58-9603-8E54238219E2}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F9765480-72D1-11D4-A75A-004F49045A87}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FC87A650-207D-4392-A6A1-82ADBC56FA64}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E99D4D0C-EB54-46AF-B62A-3AA1F31D53E5}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}

***** [ Web browsers ] *****


*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2261 bytes] ##########
 

—————

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Windows 10 Home x64
Ran by [removed] on Sun 11/01/2015 at 18:16:13.49
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks

Successfully deleted: [Task] C:\WINDOWS\system32\tasks\Driver Booster Scan
Successfully deleted: [Task] C:\WINDOWS\system32\tasks\Driver Booster SkipUAC (Will)
Successfully deleted: [Task] C:\WINDOWS\system32\tasks\Driver Booster Update



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1D31AA81-4D4B-4BFB-B3AF-B6DDD6DF43B1}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D31AA81-4D4B-4BFB-B3AF-B6DDD6DF43B1}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1D31AA81-4D4B-4BFB-B3AF-B6DDD6DF43B1}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\Program Files (x86)\iobit\driver booster
Successfully deleted: [Folder] C:\ProgramData\iobit\driver booster
Successfully deleted: [Folder] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\driver booster 2
Successfully deleted: [Folder] C:\ProgramData\productdata
Successfully deleted: [Folder] C:\Users\Will\AppData\Roaming\iobit\driver booster
Successfully deleted: [Folder] C:\Users\Will\AppData\Roaming\productdata



~~~ FireFox

Successfully deleted the following from C:\Users\Will\AppData\Roaming\mozilla\firefox\profiles\uq64d3r6.default\prefs.js

user_pref([removed]-event-fired, true);





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 11/01/2015 at 18:18:09.09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

——————

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/1/2015
Scan Time: 6:24 PM
Logfile:
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2015.11.01.05
Rootkit Database: v2015.10.28.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: Will

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 384774
Time Elapsed: 15 min, 30 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

Thank you

Here you go:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:31-10-2015
Ran by [removed] (administrator) on NACHOMAN (02-11-2015 11:16:45)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 10 Home (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Spotify Ltd) C:\Users\Will\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14021336 2015-07-18] (Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-07-18] (Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg_LENOVO_DOLBYDRAGON] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-07-18] (Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-07-18] (Realtek Semiconductor)
HKLM\…\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [9299672 2015-09-28] (Realtek semiconductor)
HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-20] (NVIDIA Corporation)
HKLM\…\Run: [ShadowPlay] => C:\windows\system32\rundll32.exe C:\windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\…\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [16093512 2014-10-19] (Lenovo(beijing) Limited)
HKLM\…\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [8235848 2014-10-19] (Lenovo(beijing) Limited)
HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3935912 2015-09-28] (Synaptics Incorporated)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\Run: [Spotify Web Helper] => C:\Users\Will\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2030912 2015-10-24] (Spotify Ltd)
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\Run: [Spotify] => C:\Users\Will\AppData\Roaming\Spotify\Spotify.exe [7736128 2015-10-24] (Spotify Ltd)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{0623d693-8520-44c1-9869-0f99ee013326}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{98e19589-f5bd-49c4-8ef4-4a0027bcf9fb}: [DhcpNameServer] 169.254.224.91

Internet Explorer:
==================
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://home.lenovo.com
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File

FireFox:
========
FF ProfilePath: C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\uq64d3r6.default
FF DefaultSearchEngine.US: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-16] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-16] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Soda PDF 7 -> C:\Program Files (x86)\Soda PDF 7\np-previewer.dll [2015-08-05] (LULU SOFTWARE LIMITED)
FF Extension: Adblock Plus - C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\uq64d3r6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-09-24]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Soda PDF 7\resources\sodapdf7firefoxextension => not found

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 iBtSiva; c:\windows\syswow64\ibtsiva.exe [120016 2014-04-03] (Intel Corporation)
S2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [351120 2015-07-17] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-16] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-10-19] (Lenovo(beijing) Limited)
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2909472 2015-07-30] (IObit)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S2 NovaPdfServer; C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe [41760 2015-07-14] (Microsoft)
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-20] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-20] (NVIDIA Corporation)
S2 SODA Manager; C:\ProgramData\LULU Software\Soda Manager\Soda Manager.exe [868688 2015-01-29] (LULU Software Limited)
S3 Soda PDF 7; C:\Program Files (x86)\Soda PDF 7\ws.exe [2129176 2015-08-05] (LULU SOFTWARE LIMITED)
S3 Soda PDF 7 CrashHandler; C:\Program Files (x86)\Soda PDF 7\crash-handler-ws.exe [847640 2015-08-05] (LULU SOFTWARE LIMITED)
S2 Soda PDF 7 Creator; C:\Program Files (x86)\Soda PDF 7\creator-ws.exe [650520 2015-08-05] (LULU SOFTWARE LIMITED)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [237568 2015-07-10] (Microsoft Corporation)
R1 HWiNFO32; C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-07-18] (REALiX™)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [263952 2015-07-14] (Intel Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [184608 2015-09-28] (Intel Corporation)
R3 NETwNb64; C:\Windows\System32\drivers\Netwbw02.sys [3497240 2015-07-18] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38048 2015-07-18] (NVIDIA Corporation)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [895256 2015-09-28] (Realtek                                            )
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [752856 2015-09-28] (Realsil Semiconductor Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [3049176 2015-09-28] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33960 2015-09-28] (Synaptics Incorporated)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-02 11:14 - 2015-11-02 11:14 - 00016148 _____ C:\WINDOWS\system32\NACHOMAN_Will_HistoryPrediction.bin
2015-11-01 22:28 - 2015-11-01 22:28 - 00000681 _____ C:\Users\Will\Desktop\JRT.txt
2015-11-01 19:58 - 2015-11-01 19:58 - 00000000 ____D C:\Program Files (x86)\ESET
2015-11-01 19:57 - 2015-11-01 19:58 - 02870984 _____ (ESET) C:\Users\Will\Desktop\esetsmartinstaller_enu.exe
2015-11-01 19:43 - 2015-11-01 19:43 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-11-01 19:28 - 2015-11-01 19:28 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2015-11-01 18:23 - 2015-11-01 18:23 - 00001202 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-11-01 18:23 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-11-01 18:23 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-11-01 18:23 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2015-11-01 18:15 - 2015-11-01 18:10 - 00002159 _____ C:\Users\Will\Desktop\AdwCleaner[S1].txt
2015-11-01 18:14 - 2015-11-01 18:10 - 00002340 _____ C:\Users\Will\Desktop\AdwCleaner[C1].txt
2015-11-01 18:09 - 2015-11-01 19:42 - 00000000 ____D C:\AdwCleaner
2015-11-01 18:07 - 2015-11-01 18:09 - 01708032 _____ C:\Users\Will\Desktop\AdwCleaner.exe
2015-11-01 18:05 - 2015-11-01 18:16 - 01801288 _____ (Malwarebytes) C:\Users\Will\Desktop\JRT.exe
2015-11-01 17:59 - 2015-11-01 18:00 - 00110080 _____ (Thomas Hoen - T-Tools) C:\Users\Will\Downloads\BitRemover.exe
2015-11-01 14:31 - 2015-11-01 14:31 - 00001843 _____ C:\Users\Will\Desktop\aswMBR.txt
2015-11-01 14:31 - 2015-11-01 14:31 - 00000512 _____ C:\Users\Will\Desktop\MBR.dat
2015-11-01 14:14 - 2015-11-02 11:16 - 00010579 _____ C:\Users\Will\Desktop\FRST.txt
2015-11-01 14:14 - 2015-11-01 14:15 - 00034641 _____ C:\Users\Will\Desktop\Addition.txt
2015-11-01 14:13 - 2015-11-02 11:16 - 00000000 ____D C:\FRST
2015-11-01 14:00 - 2015-11-01 14:17 - 113367298 _____ C:\Users\Will\Downloads\240P_316K_2072933.mp4
2015-10-31 14:57 - 2015-10-31 15:23 - 61337553 _____ C:\Users\Will\Downloads\240P_400k_26350692.mp4
2015-10-31 09:51 - 2015-11-01 14:13 - 02198016 _____ (Farbar) C:\Users\Will\Desktop\FRST64.exe
2015-10-31 09:50 - 2015-11-01 13:44 - 05198336 _____ (AVAST Software) C:\Users\Will\Desktop\aswMBR.exe
2015-10-29 22:51 - 2015-10-27 15:38 - 21871616 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-10-29 22:51 - 2015-10-27 15:16 - 18801664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-10-29 22:51 - 2015-10-21 04:45 - 00541024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll
2015-10-29 22:51 - 2015-10-21 04:44 - 00459104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2015-10-29 22:51 - 2015-10-21 04:43 - 01392480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-10-29 22:51 - 2015-10-21 04:39 - 03621248 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-10-29 22:51 - 2015-10-21 04:00 - 24595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-10-29 22:51 - 2015-10-21 04:00 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-10-29 22:51 - 2015-10-21 03:59 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2015-10-29 22:51 - 2015-10-21 03:57 - 02418688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-10-29 22:51 - 2015-10-21 03:52 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2015-10-29 22:51 - 2015-10-21 03:50 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2015-10-29 22:51 - 2015-10-21 03:48 - 01068032 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-10-29 22:51 - 2015-10-21 03:47 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll
2015-10-29 22:51 - 2015-10-21 03:46 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2015-10-29 22:51 - 2015-10-21 03:46 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-10-29 22:51 - 2015-10-21 03:44 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2015-10-29 22:51 - 2015-10-21 03:44 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2015-10-29 22:51 - 2015-10-21 03:43 - 02675200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll
2015-10-29 22:51 - 2015-10-21 03:42 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2015-10-29 22:51 - 2015-10-21 03:41 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2015-10-29 22:51 - 2015-10-21 03:40 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2015-10-29 22:51 - 2015-10-21 03:38 - 00502272 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll
2015-10-29 22:51 - 2015-10-20 21:53 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2015-10-29 22:51 - 2015-10-20 21:49 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-10-29 22:51 - 2015-10-20 21:13 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-10-29 22:51 - 2015-10-20 21:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2015-10-29 22:51 - 2015-10-20 21:08 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-10-29 22:51 - 2015-10-20 21:05 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2015-10-29 22:51 - 2015-10-20 21:03 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-10-29 22:51 - 2015-10-20 21:03 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll
2015-10-29 22:51 - 2015-10-20 20:58 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll
2015-10-29 22:51 - 2015-10-20 20:58 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2015-10-29 22:51 - 2015-10-20 20:55 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll
2015-10-29 22:51 - 2015-10-09 23:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-10-29 22:51 - 2015-10-05 19:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-10-29 22:51 - 2015-10-05 18:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-10-29 22:51 - 2015-09-30 20:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-10-29 22:51 - 2015-09-30 20:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-10-29 22:51 - 2015-09-30 20:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-10-29 22:51 - 2015-09-30 20:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-10-29 22:51 - 2015-09-30 20:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-10-29 22:51 - 2015-09-30 19:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2015-10-29 22:51 - 2015-09-24 20:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2015-10-29 22:51 - 2015-09-24 20:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2015-10-29 22:51 - 2015-09-24 19:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-10-29 22:51 - 2015-09-24 19:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2015-10-29 22:51 - 2015-09-24 19:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2015-10-29 22:51 - 2015-09-24 19:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-10-29 22:51 - 2015-09-24 19:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll
2015-10-29 22:51 - 2015-09-24 19:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll
2015-10-29 22:51 - 2015-09-24 19:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-10-29 22:51 - 2015-09-24 19:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2015-10-29 22:51 - 2015-09-24 19:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-10-29 22:51 - 2015-09-24 19:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2015-10-29 22:51 - 2015-09-24 19:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2015-10-29 22:51 - 2015-09-24 19:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-10-29 22:51 - 2015-09-24 19:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2015-10-29 22:51 - 2015-09-24 19:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-10-29 22:51 - 2015-09-24 19:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2015-10-29 22:51 - 2015-09-24 19:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-10-29 22:51 - 2015-09-24 19:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-10-29 22:51 - 2015-09-24 19:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2015-10-29 22:51 - 2015-09-24 19:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-10-29 22:51 - 2015-09-24 19:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll
2015-10-29 22:51 - 2015-09-24 19:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll
2015-10-29 22:51 - 2015-09-24 18:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll
2015-10-29 22:51 - 2015-09-24 18:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2015-10-29 22:51 - 2015-09-24 18:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
2015-10-29 22:51 - 2015-09-24 18:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll
2015-10-29 22:51 - 2015-09-24 18:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-10-29 22:51 - 2015-09-24 18:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-10-29 22:51 - 2015-09-24 18:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2015-10-29 22:51 - 2015-09-24 18:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-10-29 22:51 - 2015-09-24 18:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-10-29 22:51 - 2015-09-24 18:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2015-10-29 22:51 - 2015-09-24 18:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2015-10-29 22:51 - 2015-09-24 18:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-10-29 22:51 - 2015-09-24 18:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2015-10-29 22:51 - 2015-09-24 18:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2015-10-29 22:51 - 2015-09-24 18:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll
2015-10-29 22:51 - 2015-09-24 18:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll
2015-10-29 22:51 - 2015-09-24 18:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll
2015-10-29 22:51 - 2015-09-24 18:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll
2015-10-29 22:51 - 2015-09-24 18:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll
2015-10-29 22:51 - 2015-09-24 18:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2015-10-29 22:51 - 2015-09-24 18:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll
2015-10-28 17:54 - 2015-11-01 18:05 - 00000000 ____D C:\Users\Will\Desktop\EBSCOhost_files
2015-10-28 17:54 - 2015-10-28 17:54 - 00008501 _____ C:\Users\Will\Desktop\EBSCOhost.htm
2015-10-27 21:21 - 2015-10-27 21:22 - 00388608 _____ (Trend Micro Inc.) C:\Users\Will\Downloads\HijackThis(1).exe
2015-10-27 09:58 - 2015-10-27 10:26 - 205912600 _____ C:\Users\Will\Desktop\v57Mimi19.mov
2015-10-25 15:30 - 2015-10-25 15:34 - 07193118 _____ C:\Users\Will\Desktop\v13Was097.mov.part
2015-10-25 15:07 - 2015-10-25 15:30 - 342058422 _____ C:\Users\Will\Desktop\v47Star2.mov
2015-10-25 10:47 - 2015-10-25 11:16 - 46345056 _____ C:\Users\Will\Desktop\v22Aikowasv89.mov
2015-10-25 10:06 - 2015-10-25 10:47 - 400540199 _____ C:\Users\Will\Desktop\v48Star22DSLR.mov
2015-10-25 10:05 - 2015-10-25 10:05 - 00000039 _____ C:\Users\Will\Desktop\SASIAN.txt
2015-10-21 19:57 - 2015-10-15 19:10 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-10-21 19:57 - 2015-10-15 19:10 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-10-21 19:34 - 2015-10-21 19:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-10-21 19:34 - 2015-10-21 19:34 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-10-21 19:34 - 2015-10-21 19:34 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-10-21 19:29 - 2015-10-21 19:34 - 13155552 _____ (Microsoft Corporation) C:\Users\Will\Downloads\Silverlight_x64(1).exe
2015-10-19 20:31 - 2015-10-19 21:03 - 08588639 _____ C:\Users\Will\Desktop\Eichmann in Jerusalem_3.pdf.part
2015-10-19 20:30 - 2015-10-19 20:52 - 05864680 _____ C:\Users\Will\Desktop\Eichmann in Jerusalem_2.pdf.part
2015-10-19 20:29 - 2015-10-19 21:02 - 07736671 _____ C:\Users\Will\Desktop\Eichmann in Jerusalem_1.pdf.part
2015-10-17 12:06 - 2015-10-17 12:06 - 00000000 ____D C:\Users\Will\Desktop\photo
2015-10-16 21:30 - 2015-10-16 21:30 - 03996360 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2015-10-16 21:16 - 2015-10-17 11:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-08 19:02 - 2015-10-08 19:02 - 00333152 _____ C:\WINDOWS\Minidump\100815-27421-01.dmp
2015-10-06 21:05 - 2015-10-06 22:21 - 329973318 _____ C:\Users\Will\Downloads\480P_600K_37838011.mp4
2015-10-06 21:05 - 2015-10-06 21:59 - 306038009 _____ C:\Users\Will\Downloads\480P_600K_34174831.mp4
2015-10-03 13:06 - 2015-10-03 13:09 - 00000000 ____D C:\Users\Will\Downloads\backups
2015-10-03 13:03 - 2015-10-27 21:22 - 00009102 _____ C:\Users\Will\Downloads\hijackthis.log
2015-10-03 13:01 - 2015-10-03 13:02 - 00388608 _____ (Trend Micro Inc.) C:\Users\Will\Downloads\HijackThis.exe
2015-10-03 13:00 - 2015-10-03 13:00 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Will\Desktop\mbam-setup-2.1.8.1057.exe
2015-10-03 13:00 - 2015-10-03 13:00 - 00017448 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.140008.6348.log
2015-10-03 13:00 - 2015-10-03 13:00 - 00017382 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.140016.4824.log
2015-10-03 13:00 - 2015-10-03 13:00 - 00000022 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.140016.4824.zip
2015-10-03 13:00 - 2015-10-03 13:00 - 00000022 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.140008.6348.zip
2015-10-03 12:58 - 2015-10-03 12:59 - 00017382 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.135832.6568.log
2015-10-03 12:58 - 2015-10-03 12:58 - 00224968 _____ (ESET) C:\Users\Will\Downloads\ESETPoweliksCleaner.exe
2015-10-03 12:58 - 2015-10-03 12:58 - 00000022 _____ C:\Users\Will\Downloads\ESETPoweliksCleaner.exe_20151003.135832.6568.zip

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-02 11:16 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-11-02 11:15 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\system32\sru
2015-11-01 22:49 - 2015-09-18 18:56 - 00000000 ____D C:\Users\Will\AppData\Local\Spotify
2015-11-01 22:28 - 2015-07-25 14:59 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-11-01 22:27 - 2015-09-18 18:47 - 00000000 ____D C:\Users\Will\AppData\Roaming\Spotify
2015-11-01 19:47 - 2015-08-05 22:50 - 00875126 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-11-01 19:43 - 2015-07-10 04:22 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log
2015-11-01 19:43 - 2015-07-10 04:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-11-01 19:42 - 2015-07-10 01:05 - 00786432 ___SH C:\WINDOWS\system32\config\BBI
2015-11-01 18:24 - 2015-07-18 21:30 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-11-01 18:23 - 2015-07-18 21:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-11-01 18:23 - 2015-07-18 21:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-11-01 18:17 - 2015-07-18 21:33 - 00000000 ____D C:\Users\Will\AppData\Roaming\IObit
2015-11-01 18:17 - 2015-07-18 21:33 - 00000000 ____D C:\ProgramData\IObit
2015-11-01 18:17 - 2015-07-18 21:33 - 00000000 ____D C:\Program Files (x86)\IObit
2015-11-01 18:10 - 2015-08-05 22:35 - 00000000 ____D C:\Users\Will
2015-10-30 17:29 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-10-30 02:54 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\rescache
2015-10-30 02:31 - 2015-07-10 03:04 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-10-29 23:11 - 2015-07-10 02:55 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-10-27 10:29 - 2015-07-18 22:20 - 00000000 ____D C:\Users\Will\AppData\Roaming\vlc
2015-10-22 21:18 - 2015-09-18 18:56 - 00001856 _____ C:\Users\Will\Desktop\Spotify.lnk
2015-10-21 19:57 - 2015-07-18 18:46 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-10-21 19:55 - 2015-07-18 18:46 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-10-17 11:15 - 2015-09-14 18:45 - 00346646 _____ C:\WINDOWS\PFRO.log
2015-10-17 11:15 - 2015-07-16 00:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-10-12 18:16 - 2014-10-19 16:44 - 00000000 ____D C:\ProgramData\Energy Manager
2015-10-08 19:02 - 2015-09-14 20:28 - 661356053 _____ C:\WINDOWS\MEMORY.DMP
2015-10-08 19:02 - 2015-09-04 20:20 - 00000000 ____D C:\WINDOWS\Minidump
2015-10-03 13:02 - 2015-07-15 23:55 - 00000000 ____D C:\Users\Will\AppData\Local\VirtualStore

==================== Files in the root of some directories =======

2015-08-27 18:46 - 2015-08-27 18:46 - 0020609 _____ () C:\Users\Will\AppData\Local\recently-used.xbel
2015-08-05 22:30 - 2015-08-05 22:30 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\Will\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-10-28 17:03

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version:31-10-2015
Ran by [removed] (2015-11-02 11:17:21)
Running from C:\Users\[removed]\Desktop
Windows 10 Home (X64) (2015-08-06 14:41:46)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2176356827-3411835133-1445305849-500 - Administrator - Disabled) => C:\Users\Administrator
DefaultAccount (S-1-5-21-2176356827-3411835133-1445305849-503 - Limited - Disabled)
Guest (S-1-5-21-2176356827-3411835133-1445305849-501 - Limited - Disabled)
Will (S-1-5-21-2176356827-3411835133-1445305849-1001 - Administrator - Enabled) => C:\Users\Will

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Digital Editions 4.0 (HKLM-x32\…\Adobe Digital Editions 4.0) (Version: 4.0.3 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)
Audacity 2.1.1 (HKLM-x32\…\Audacity®_is1) (Version: 2.1.1 - Audacity Team)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Home Theater (HKLM\…\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
doPDF (Version: 8.3.934 - Softland) Hidden
doPDF 8 (HKLM-x32\…\{0ebed438-cc81-46f7-914b-a4c93d5780f2}) (Version: 8.3.934 - Softland)
Driver Booster 2.4 (HKLM-x32\…\Driver Booster_is1) (Version: 2.4 - IObit)
Echo of Soul (HKLM-x32\…\Steam App 290140) (Version:  - Nvius)
Energy Manager (HKLM-x32\…\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.5.0.23 - Lenovo)
Energy Manager (x32 Version: 1.5.0.23 - Lenovo) Hidden
ESET Online Scanner v3 (HKLM-x32\…\ESET Online Scanner) (Version:  - )
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
GIMP 2.8.14 (HKLM\…\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\…\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3540 - Intel Corporation)
Intel(R) Wireless Bluetooth(R) 4.0 (HKLM-x32\…\{96C730E4-F055-4118-BDF3-6E071763853C}) (Version: 3.0.1342.02 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\…\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Lenovo EasyCamera (HKLM-x32\…\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10291 - Realtek Semiconductor Corp.)
Lenovo EasyCamera (HKLM-x32\…\{E399A5B3-ED53-4DEA-AF04-8011E1EB1EAC}) (Version: 6.3.9600.11103 - Realtek Semiconductor Corp.)
Magic Transfer (HKLM\…\{AD2B2BD1-A1D7-4798-8FDD-B2A58FD94E68}) (Version: 1.1.1.11 - )
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Metric Collection SDK 35 (x32 Version: 1.2.0001.00 - Lenovo Group Limited) Hidden
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\…\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 41.0.2 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 41.0.2 (x86 en-US)) (Version: 41.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 41.0.2.5765 - Mozilla)
novaPDF 8 Printer Driver (HKLM\…\{1CC99933-93FC-40BA-A3DD-286FB87CBF2F}) (Version: 8.3.934 - Softland)
novaPDF 8 SDK COM (x64) (HKLM\…\{A8A71610-DE04-4C9E-AE89-60BCA8E20453}) (Version: 8.3.934 - Softland)
novaPDF 8 SDK COM (x86) (HKLM-x32\…\{0FD5EC80-F729-442E-8745-F60315842D9B}) (Version: 8.3.934 - Softland)
NVIDIA GeForce Experience 1.8.2 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2 - NVIDIA Corporation)
NVIDIA Graphics Driver 332.50 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.50 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.0927 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0927 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\…\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.21243 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7541 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.7.306 - NVIDIA Corporation) Hidden
Skype™ 7.0 (HKLM-x32\…\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Soda Manager (x32 Version: 7.0.0.21720 - LULU Software Limited) Hidden
Soda PDF 7 (HKLM-x32\…\Soda7) (Version: 7.3.9.23867 - LULU Software Limited)
Soda PDF 7 Asian Fonts Pack (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Convert Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Create Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Edit Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Forms Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Insert Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 OCR Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Review Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 Secure Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Soda PDF 7 View Module (x32 Version: 7.3.12.24159 - LULU Software Limited) Hidden
Spotify (HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\Spotify) (Version: 1.0.16.104.g3b776c9e - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\…\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 19.0.13.0 - Synaptics Incorporated)
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.1 - VideoLAN)
Windows Driver Package - Lenovo (ACPIVPC) System  (09/24/2013 19.29.2.34) (HKLM\…\EE9B1F2037C580F36D92FA431CC02BFF04C31F15) (Version: 09/24/2013 19.29.2.34 - Lenovo)
Windows Driver Package - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30.0.288) (HKLM\…\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

08-10-2015 19:55:52 Scheduled Checkpoint
18-10-2015 21:23:16 Scheduled Checkpoint
26-10-2015 19:38:52 Scheduled Checkpoint
29-10-2015 23:08:19 Windows Update
29-10-2015 23:09:18 Windows Update
01-11-2015 18:16:16 JRT Pre-Junkware Removal

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 05:25 - 2013-08-22 05:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {11208D9E-BF4F-4602-8599-4F14EF5D3ACB} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)
Task: {21524C87-B819-4EAB-AA78-D44822C0F7A3} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE
Task: {27B7D489-DAE2-4FF1-9988-8390D9A0FADC} - System32\Tasks\doPDF Update => C:\Program Files\Softland\novaPDF 8\Driver\UpdateApplication.exe [2015-07-14] ()
Task: {599BF555-3744-44BF-ACF7-E4B562201B90} - \Safer-Networking\Spybot - Search and Destroy\Refresh immunization -> No File <==== ATTENTION
Task: {6BA20132-5BD2-4FF7-82C9-870FF65E9B27} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {700D5E46-9592-4C28-BBCF-B2A8B0D09DC9} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {7BB3157D-EC96-44B4-8389-A0A978ED4103} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {80DFE310-812D-43BD-A2F9-37AC4F1F981B} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2015-09-28] (Synaptics Incorporated)
Task: {8DF1AA84-3AC0-4D3A-B2C1-BB281815D2DB} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {8F6297F9-935B-441B-956F-496EE520FF9D} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-10-21] (Microsoft Corporation)
Task: {9710F1A8-D65E-4CD7-BD26-BF2C256C2A6A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {9982845F-40B1-4D3A-BDF0-EF094F2CE734} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {A995B8B9-01E5-4891-B502-A9A41EDE1192} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {AA6E1200-65F8-408A-953E-45EA67971C94} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {B26877BB-DCC9-4445-9CD9-DDD1B83A3BD5} - \Safer-Networking\Spybot - Search and Destroy\Check for updates -> No File <==== ATTENTION
Task: {D30C7455-B2B3-46AC-916B-B2642D2FD162} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {D955AE02-94F6-4AB1-99E3-F0B111694E5F} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {DC181402-F32A-4920-8595-206ACDF1A7EA} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)
Task: {DC228AA7-30E6-4996-BB63-9EAE824C8A2E} - System32\Tasks\DolbySelectorTask => C:\Program Files\Dolby Digital Plus\ddp.exe
Task: {E1AA2FE7-958D-4F03-8DA8-D342888D3D92} - \Safer-Networking\Spybot - Search and Destroy\Scan the system -> No File <==== ATTENTION
Task: {E580C4C4-47F0-4E60-8ABB-5508A7644154} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-05-30] (Lenovo)
Task: {F02CD1B8-49D3-444F-A869-BA66D0E1F5EE} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-16] (Adobe Systems Incorporated)
Task: {F2B73C63-4055-4C27-8D2D-2C25D4282E19} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

==================== Loaded Modules (Whitelisted) ==============

2015-08-05 23:14 - 2015-08-05 23:14 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll
2015-08-19 19:04 - 2015-08-11 01:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll
2015-09-30 18:19 - 2015-09-16 22:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-09-30 18:19 - 2015-09-16 22:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2015-09-30 18:18 - 2015-09-16 21:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-09-30 18:19 - 2015-09-16 21:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-09-30 18:18 - 2015-09-16 21:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-09-30 18:18 - 2015-09-16 21:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-09-30 18:19 - 2015-09-16 21:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-07-10 03:00 - 2015-07-10 05:14 - 00210432 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll
2015-08-05 22:32 - 2015-07-22 17:10 - 00116552 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:B3503B59

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\1001movie.com -> 1001movie.com
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\1001night.biz -> 1001night.biz
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\100gal.net -> 100gal.net
IE restricted site: HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\100sexlinks.com -> 100sexlinks.com

There are 4788 more sites.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Will\AppData\Local\Microsoft\Windows\INetCache\IE\U1IMOB7W\IMG_4322[1].JPG
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\…\StartupApproved\Run32: => "IObit Malware Fighter"
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\StartupApproved\Run: => "Advanced SystemCare 8"
HKU\S-1-5-21-2176356827-3411835133-1445305849-1001\…\StartupApproved\Run: => "OneDrive"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{6A1624B6-B99E-439D-9DD1-44608D5A4C46}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{D892288D-C404-4C0A-912F-C4C7279D2715}] => (Allow) LPort=1900
FirewallRules: [{3E3CA3F0-876F-438B-AF73-E7843C64249E}] => (Allow) LPort=2869
FirewallRules: [{87D1932E-4F0F-40D0-8B57-D4DBA4408831}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{3B6E3C0A-5337-4A1D-BD9E-216EE10D19E6}] => (Allow) C:\Users\Will\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{E2BE0D38-C927-430E-A9A4-DED4AABC82DE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Echo of Soul\EOSLauncher.exe
FirewallRules: [{1AF01789-BC82-44F5-B85B-352409B973E9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Echo of Soul\EOSLauncher.exe
FirewallRules: [{F218B7E5-C882-4732-BB64-D291C1234D70}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{9DA4038F-3E5F-4FD4-B159-39E745CD53F6}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{950864CE-BDA7-46CE-8DFE-04F55573C2AE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1818016D-4335-41FF-96B5-67ABD6F56757}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F66CBAE9-FFFE-45D2-8347-5C641A632FAD}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{D0EF40B1-CDFF-4F1F-8ABB-251424005BC1}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F200BFE1-3435-4061-B431-FEC2800E8625}] => (Allow) C:\Program Files\Lenovo PhotoMasterImport\PhotoMasterImport.exe
FirewallRules: [{D174B03B-ADD2-4C1C-9236-9715C13AEB80}] => (Allow) LPort=55100
FirewallRules: [{638CA194-B3D5-4B37-AE4F-BB16D30DDB47}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{9F6CF7BE-4360-41DB-84EC-6581F2585703}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{DD10F961-A5E3-476E-89D0-D12274C36D12}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{39200CCE-525A-417F-A478-07EBFD6BC264}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{0D36EEFD-CAC1-4929-97F0-8B44E63489AF}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{94255C29-62B0-4C41-8F83-0140D206094B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{BF864626-531E-4EEC-BB74-F5847D4CBA67}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{90B0DF68-13F7-4A4B-9B02-C88899A8E371}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{38AC29A0-6ABD-41DD-A850-0A33CB218576}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{92242951-C317-43C0-8211-AD2CEBC64CF4}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{20E13B38-31C7-4C14-8BFE-A66EAD148CC7}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{1BF3D4B6-4335-41DF-8227-F14E0E13622B}] => (Allow) LPort=8501
FirewallRules: [{F4FC1C05-9D04-4315-844E-BAF3899D11B9}] => (Allow) LPort=8501
FirewallRules: [TCP Query User{BEC9E62B-77F3-4FCD-BC6A-2E04439E8026}C:\users\will\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\will\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{3CB7FFA4-8025-4910-858B-4113605C16F9}C:\users\will\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\will\appdata\roaming\spotify\spotify.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/01/2015 07:58:03 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.

Error: (11/01/2015 07:58:02 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.

Error: (11/01/2015 07:58:01 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.

Error: (11/01/2015 07:58:00 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.

Error: (11/01/2015 07:57:53 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.

Error: (11/01/2015 07:57:49 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.

Error: (11/01/2015 07:34:34 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: NACHOMAN)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2147023170 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (11/01/2015 07:34:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SearchUI.exe, version: 10.0.10240.16515, time stamp: 0x55fa5578
Faulting module name: CortanaApi.dll, version: 0.0.0.0, time stamp: 0x55fa5354
Exception code: 0x80000003
Fault offset: 0x0000000000151a73
Faulting process id: 0xbf8
Faulting application start time: 0xSearchUI.exe0
Faulting application path: SearchUI.exe1
Faulting module path: SearchUI.exe2
Report Id: SearchUI.exe3
Faulting package full name: SearchUI.exe4
Faulting package-relative application ID: SearchUI.exe5

Error: (11/01/2015 07:31:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: NACHOMAN)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2147023170 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (11/01/2015 07:31:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SearchUI.exe, version: 10.0.10240.16515, time stamp: 0x55fa5578
Faulting module name: CortanaApi.dll, version: 0.0.0.0, time stamp: 0x55fa5354
Exception code: 0x80000003
Fault offset: 0x0000000000151a73
Faulting process id: 0xaa8
Faulting application start time: 0xSearchUI.exe0
Faulting application path: SearchUI.exe1
Faulting module path: SearchUI.exe2
Report Id: SearchUI.exe3
Faulting package full name: SearchUI.exe4
Faulting package-relative application ID: SearchUI.exe5


System errors:
=============
Error: (11/02/2015 11:16:35 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070002: Twitter.

Error: (11/02/2015 11:16:35 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80073cf9: Twitter.

Error: (11/02/2015 11:16:30 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070002: Twitter.

Error: (11/02/2015 11:16:30 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80073cf9: Twitter.

Error: (11/02/2015 11:16:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070002: Twitter.

Error: (11/02/2015 11:16:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80073cf9: Twitter.

Error: (11/02/2015 11:16:21 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070002: Twitter.

Error: (11/01/2015 10:27:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel(R) Dynamic Application Loader Host Interface Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (11/01/2015 10:27:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel(R) ME Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (11/01/2015 10:27:10 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Lenovo WiFiHotspot Service service terminated unexpectedly.  It has done this 1 time(s).


CodeIntegrity:
===================================
  Date: 2015-11-01 22:16:22.390
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-11-01 04:36:26.415
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-31 04:36:04.716
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-28 18:04:34.162
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-28 06:58:34.434
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-26 19:57:10.348
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-24 00:24:56.803
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-20 22:01:05.855
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-20 18:08:01.564
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-10-18 21:13:52.192
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-4700HQ CPU @ 2.40GHz
Percentage of memory in use: 30%
Total physical RAM: 8104.27 MB
Available physical RAM: 5667.11 MB
Total Virtual: 9384.27 MB
Available Virtual: 7017.94 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:888.87 GB) (Free:797.39 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:24.9 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: B408360E)

Partition: GPT.

==================== End of Addition.txt ============================

Thank you!

Here is my Fixlog:

Fix result of Farbar Recovery Scan Tool (x64) Version:31-10-2015
Ran by [removed] (2015-11-02 13:33:23) Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2909472 2015-07-30] (IObit)
2015-11-01 18:17 - 2015-07-18 21:33 - 00000000 ____D C:\Users\Will\AppData\Roaming\IObit
2015-11-01 18:17 - 2015-07-18 21:33 - 00000000 ____D C:\ProgramData\IObit
2015-11-01 18:17 - 2015-07-18 21:33 - 00000000 ____D C:\Program Files (x86)\IObit
Hosts:
CMD: ipconfig
/flushdns
EmptyTemp:
End
*****************

Processes closed successfully.
Restore point was successfully created.
LiveUpdateSvc => service removed successfully
C:\Users\Will\AppData\Roaming\IObit => moved successfully
C:\ProgramData\IObit => moved successfully
C:\Program Files (x86)\IObit => moved successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========  ipconfig =========


Windows IP Configuration


Ethernet adapter Ethernet:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Local Area Connection* 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Local Area Connection* 4:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::1033:15f:b819:7b99%2
   IPv4 Address. . . . . . . . . . . : 192.168.1.9
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1

Ethernet adapter Bluetooth Network Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.{0623D693-8520-44C1-9869-0F99EE013326}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . :
   IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fd:cb2:3445:e7ea:b66
   Link-local IPv6 Address . . . . . : fe80::cb2:3445:e7ea:b66%6
   Default Gateway . . . . . . . . . : ::

========= End of CMD: =========

/flushdns => Error: No automatic fix found for this entry.
EmptyTemp: => 961.2 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 13:35:22 ====

Here is my log from pasting the text correctly Yeah, things are going smooth. Thanks a lot for your help!

Fix result of Farbar Recovery Scan Tool (x64) Version:31-10-2015
Ran by [removed] (2015-11-02 15:50:48) Run:2
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2909472 2015-07-30] (IObit)
2015-11-01 18:17 - 2015-07-18 21:33 - 00000000 ____D C:\Users\Will\AppData\Roaming\IObit
2015-11-01 18:17 - 2015-07-18 21:33 - 00000000 ____D C:\ProgramData\IObit
2015-11-01 18:17 - 2015-07-18 21:33 - 00000000 ____D C:\Program Files (x86)\IObit
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End
*****************

Processes closed successfully.
Restore point was successfully created.
LiveUpdateSvc => service not found.
"C:\Users\Will\AppData\Roaming\IObit" => not found.
"C:\ProgramData\IObit" => not found.
"C:\Program Files (x86)\IObit" => not found.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========  ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

EmptyTemp: => 176.2 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 15:51:25 ====