Issues:
- I'm getting lots of (Not responding…) on Firefox.
- Some plugins don't work that have always seemed fine. This could be unrelated, of course, but I thought I'd mention it.
- CPU fan seems to pick up in rpm at times when I'm not doing anything heavy with the computer
- Bizarre delays with typing into the simplest of text boxes, like in a forum.
- Once or twice there has been strange behaviour outside browsers. Picture folders that take too long to refresh, a screen colour profile that turns off even though it's programmed to stay on. (again, I know these could be related to software issues separate from this but thought I'd mention it.
aswMBR log…
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2016-05-28 10:31:10
—————————–
10:31:10.233 OS Version: Windows x64 6.2.9200
10:31:10.234 Number of processors: 4 586 0x2A07
10:31:10.234 ComputerName: DESKTOP UserName: Home
10:31:10.485 Initialize success
10:31:11.443 VM: initialized successfully
10:31:11.443 VM: Intel CPU supported
10:31:22.723 VM: disk I/O storahci.sys
10:33:30.121 AVAST engine defs: 16052701
10:34:56.454 The log file has been saved successfully to "C:\Users\Home\Desktop\aswMBR.txt"
FRST logs…
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:25-05-2016 01
Ran by [removed] (administrator) on DESKTOP (28-05-2016 10:35:03)
Running from C:\Users\[removed]\Downloads
[removed]
Platform: Windows 10 Pro Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Avid Technology, Inc.) C:\Program Files\Avid\Editor Transcode\TranscodeService\rnc-central\AvidEditorTranscodeStatus.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe
(Ellora Assets Corp.) C:\Program Files (x86)\WEB\Freemake\CaptureLib\CaptureLibService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(PACE Anti-Piracy, Inc.) C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe
() C:\Windows\SysWOW64\spdsvc.exe
(SafeNet, Inc.) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe
(SafeNet, Inc.) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
() C:\Windows\SysWOW64\SecUPDUtilSvc.exe
(SafeNet, Inc) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
(TeamViewer GmbH) C:\Program Files (x86)\WEB\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\xrdd.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\msoia.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
() C:\Program Files\MISC\Ditto\Ditto.exe
() C:\Program Files (x86)\HARDWARE\ColorMunki Display\ColorMunkiDisplayTray.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE
() C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
(Mozilla Corporation) C:\Program Files\WEB\Mozilla Firefox\firefox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\CSISYNCCLIENT.EXE
(Microsoft Corporation) C:\Windows\System32\inetsrv\w3wp.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Mozilla Corporation) C:\Program Files\WEB\Mozilla Firefox\plugin-container.exe
(AVAST Software) C:\Users\Home\Downloads\aswMBR.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\…\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [503856 2015-09-23] (Acronis)
HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14021336 2015-06-18] (Realtek Semiconductor)
HKLM\…\Run: [Fences] => C:\Program Files (x86)\MISC\Stardock\Fences\Fences.exe [4031152 2013-11-26] (Stardock Corporation)
HKLM\…\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [464608 2014-09-08] ()
HKLM\…\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [5006536 2016-03-21] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [651560 2015-09-23] (Acronis International GmbH)
HKLM-x32\…\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7568104 2015-09-23] ()
HKLM-x32\…\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\…\Run: [LWS] => C:\Program Files (x86)\HARDWARE\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM-x32\…\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe [75264 2016-03-28] ()
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation)
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\Run: [Ditto] => C:\Program Files\MISC\Ditto\Ditto.exe [1717872 2012-11-08] ()
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\Run: [Xmarks] => C:\Program Files (x86)\WEB\Xmarks\xmarkssync.exe [1178680 2014-11-06] (Xmarks.com)
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\Run: [CCleaner Monitoring] => C:\Program Files\SYSTEM\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\Run: [Skype] => C:\Program Files (x86)\MEDIA\Skype\Phone\Skype.exe [50670720 2016-03-01] (Skype Technologies S.A.)
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\Policies\Explorer: [NoStrCmpLogical] 0
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\MountPoints2: {995b99dd-e382-11e5-9b98-50e5493aeaa2} - "H:\Setup.exe"
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => No File
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => No File
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => No File
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2015-09-10] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2015-09-10] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2015-09-10] (Acronis)
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => No File
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => No File
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ColorMunki Display Tray.lnk [2015-12-08]
ShortcutTarget: ColorMunki Display Tray.lnk -> C:\Program Files (x86)\HARDWARE\ColorMunki Display\ColorMunkiDisplayTray.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\XRGamma.lnk [2015-12-08]
ShortcutTarget: XRGamma.lnk -> C:\Program Files (x86)\HARDWARE\ColorMunki Display\XRGamma.exe (LOGO Kommunikations- und Drucktechnik GmbH & Co. KG)
Startup: C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2016-05-16]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk /m /f \Device\HarddiskVolume10autocheck autochk *
GroupPolicyScripts: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: [S-1-5-21-186901184-3626248880-2543553819-1000] => [removed]:15151
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] [removed]
Tcpip\..\Interfaces\{c098044c-828c-493f-a811-24ad5d4a1dcd}: [DhcpNameServer] [removed]
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://home.microsoft.com/access/allinone.asp
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://bing.com/
SearchScopes: HKU\S-1-5-21-186901184-3626248880-2543553819-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2016-05-15] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-05-12] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\GROOVEEX.DLL [2016-05-15] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-12] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-186901184-3626248880-2543553819-1000 -> No Name - {CB8A255D-A8A5-4FD5-8EA5-7E049CB413E2} - No File
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-186901184-3626248880-2543553819-1000 -> hxxp://bing.com/
FireFox:
========
FF ProfilePath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\wz8zqihx.default
FF NewTab:
FF DefaultSearchEngine: Bing
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Homepage: bing.com
FF Keyword.URL: hxxp://www.bing.com/search?FORM=U313DF&PC;=U313&q;=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-13] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-05-15] (Microsoft Corporation)
FF Plugin: @Skype Technologies S.A..com/Skype Web Plugin -> C:\Program Files (x86)\SkypeWebPlugin\3.2.0.23388\npSkypeWebPlugin64.dll [2014-11-03] (Skype)
FF Plugin: @unity3d.com/UnityPlayer64,version=1.0 -> C:\Program Files\Unity\WebPlayer64\loader-x64\npUnity3D64.dll [2015-06-08] (Unity Technologies ApS)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-03-09] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-13] ()
FF Plugin-x32: @Diginext.fr/VirtualGeoGP -> C:\Program Files (x86)\WEB\VirtualGeo3-GP\WebPlugin\Win32\npQtAPI3DPlugin.dll [2015-05-07] (DIGINEXT)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-05-12] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-12] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2016-05-15] (Microsoft Corporation)
FF Plugin-x32: @Skype Technologies S.A..com/Skype Web Plugin -> C:\Program Files (x86)\SkypeWebPlugin\3.2.0.23388\npSkypeWebPlugin.dll [2014-11-03] (Skype)
FF Plugin-x32: @verimatrix.com/ViewRightWeb -> C:\Program Files (x86)\Verimatrix\ViewRight Web\\npViewRight.dll [2014-06-10] (Verimatrix, Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-03] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-03-09] (Adobe Systems)
FF Plugin HKU\S-1-5-21-186901184-3626248880-2543553819-1000: @hola.org/vlc,version=1.8.204 -> C:\Users\Home\AppData\Local\Hola\firefox\app\vlc [2015-06-07] ()
FF Plugin HKU\S-1-5-21-186901184-3626248880-2543553819-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Home\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [No File]
FF Plugin HKU\S-1-5-21-186901184-3626248880-2543553819-1000: @talk.google.com/O1DPlugin -> C:\Users\Home\AppData\Roaming\Mozilla\plugins\npo1d.dll [No File]
FF Plugin HKU\S-1-5-21-186901184-3626248880-2543553819-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Home\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-186901184-3626248880-2543553819-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Home\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-186901184-3626248880-2543553819-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Home\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-16] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-186901184-3626248880-2543553819-1000: @verimatrix.com/ViewRightWeb -> C:\Program Files (x86)\Verimatrix\ViewRight Web\\npViewRight.dll [2014-06-10] (Verimatrix, Inc.)
FF Plugin HKU\S-1-5-21-186901184-3626248880-2543553819-1000: electronicarts.com/GameFacePlugin -> C:\Users\Home\AppData\Roaming\Electronic Arts\Game Face\npGameFacePlugin.dll [2012-12-20] (Electronic Arts)
FF SearchPlugin: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\wz8zqihx.default\searchplugins\bing-.xml [2015-11-29]
FF Extension: Pocket - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\wz8zqihx.default\extensions\[removed] [2015-05-30]
FF Extension: DownThemAll! - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\wz8zqihx.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2016-04-15]
FF Extension: Google Translator for Firefox - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\wz8zqihx.default\extensions\[removed] [2016-04-29]
FF Extension: Xmarks - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\wz8zqihx.default\extensions\[removed] [2016-05-26]
FF Extension: MEGA - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\wz8zqihx.default\Extensions\[removed] [2016-05-18]
FF Extension: Pushbullet - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\wz8zqihx.default\Extensions\[removed] [2016-03-30]
FF Extension: Adblock Plus - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\wz8zqihx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-04-29]
StartMenuInternet: FIREFOX.EXE - C:\Program Files\WEB\Mozilla Firefox\firefox.exe
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 Avid DMF Service; C:\Program Files\Avid\Editor Transcode\Dynamic Media Files\DMFService.exe [464712 2013-06-24] (Avid Technology, Inc.)
S2 Avid Editor Broker; C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorMSE.exe [465224 2013-06-24] (Avid Technology, Inc.)
S2 Avid Editor Db Engine; C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorDbEngine.exe [464712 2013-06-24] (Avid Technology, Inc.)
S3 Avid Editor Transcode Service; C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorTranscode.exe [465224 2013-06-24] (Avid Technology, Inc.)
R2 Avid Editor Transcode Status; C:\Program Files\Avid\Editor Transcode\TranscodeService\rnc-central\AvidEditorTranscodeStatus.exe [100680 2013-06-24] (Avid Technology, Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2911472 2016-05-15] (Microsoft Corporation)
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [File not signed]
R2 FreemakeVideoCapture; C:\Program Files (x86)\WEB\Freemake\CaptureLib\CaptureLibService.exe [9216 2016-03-28] (Ellora Assets Corp.) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IpOverUsbSvc; C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe [21184 2015-11-20] (Microsoft Corporation)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2011-03-04] (Hewlett-Packard Company) [File not signed]
S3 Media Center 20 Service; C:\Program Files (x86)\MEDIA\J River\Media Center 20\JRService.exe [397896 2015-12-07] (JRiver, Inc.) [File not signed]
S4 mmsminisrv; C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe [4884064 2015-08-11] (Acronis)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2120712 2016-05-09] (Electronic Arts)
S3 PAExec; C:\Windows\PAExec.exe [207872 2015-01-15] (Power Admin LLC) [File not signed]
R2 Samsung Printer Dianostics Service; C:\WINDOWS\SysWOW64\\spdsvc.exe [491328 2015-12-05] ()
R2 SamsungUPDUtilSvc; C:\Windows\SysWOW64\SecUPDUtilSvc.exe [143664 2015-12-14] ()
R2 SentinelKeysServer; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [376832 2013-01-09] (SafeNet, Inc.) [File not signed]
R2 SentinelProtectionServer; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe [1259872 2013-01-09] (SafeNet, Inc)
R2 SentinelSecurityRuntime; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe [293216 2013-01-09] (SafeNet, Inc.)
S2 SkypeUpdate; C:\Program Files (x86)\MEDIA\Skype\Updater\Updater.exe [327296 2016-01-29] (Skype Technologies)
R2 TeamViewer; C:\Program Files (x86)\WEB\TeamViewer\TeamViewer_Service.exe [5419792 2014-11-28] (TeamViewer GmbH)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
R2 xrdd.exe; C:\Program Files (x86)\X-Rite\Devices\Services\xrdd.exe [83312 2014-04-10] (X-Rite Inc.)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [23240 2016-03-21] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [111120 2016-03-01] (Advanced Micro Devices)
R2 BrPar; C:\Windows\System32\drivers\BrPar64a.sys [30528 2006-11-06] (Brother Industries Ltd.)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-04-26] (Disc Soft Ltd)
S3 EMVSCARD; C:\Windows\System32\Drivers\EMVSCARD.sys [28544 2006-12-13] (USB Smart Card Reader) [File not signed]
R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [323040 2015-11-29] (Acronis International GmbH)
R3 jrvad_service; C:\Windows\system32\drivers\JRiverWDMDriver.sys [36872 2014-12-08] (JRiver, Inc.)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [52320 2014-05-03] (hxxp://libusb-win32.sourceforge.net)
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [935168 2015-11-19] (Realtek )
R3 rusb3hub; C:\Windows\System32\drivers\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\system32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-09-17] (SafeNet, Inc.)
S0 Si3114r5; C:\Windows\System32\drivers\Si3114r5.sys [327720 2008-04-29] (Silicon Image, Inc)
S0 Si3531; C:\Windows\System32\drivers\Si3531.sys [333864 2009-02-09] (Silicon Image, Inc)
R0 SiFilter; C:\Windows\System32\drivers\SiWinAcc.sys [22568 2008-04-29] (Silicon Image, Inc.)
R0 SiRemFil; C:\Windows\System32\drivers\SiRemFil.sys [16936 2008-04-29] (Silicon Image, Inc.)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1057728 2015-11-29] (Acronis International GmbH)
R2 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198088 2015-11-29] (Acronis International GmbH)
S3 tnd; C:\Windows\System32\DRIVERS\tnd.sys [553912 2015-11-29] (Acronis International GmbH)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
R2 WinI2C-DDC; C:\Windows\system32\drivers\DDCDrv.sys [20832 2011-06-23] (Nicomsoft Ltd.)
R2 WinI2C-DDC; C:\Windows\SysWOW64\drivers\DDCDrv.sys [10240 2011-10-12] (Nicomsoft Ltd.) [File not signed]
U3 aswMBR; C:\Users\Home\AppData\Local\Temp\aswMBR.sys [62728 2016-05-28] () [File not signed]
U3 aswVmm; C:\Users\Home\AppData\Local\Temp\aswVmm.sys [224896 2016-05-28] ()
U3 idsvc; no ImagePath
S3 SzCCID; \SystemRoot\system32\DRIVERS\SzCCID.sys [X]
U3 wpcsvc; no ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-05-28 10:35 - 2016-05-28 10:35 - 00025285 _____ C:\Users\Home\Downloads\FRST.txt
2016-05-28 10:34 - 2016-05-28 10:34 - 00000591 _____ C:\Users\Home\Desktop\aswMBR.txt
2016-05-28 10:33 - 2016-05-28 10:35 - 00000000 ____D C:\FRST
2016-05-28 10:33 - 2016-05-28 10:33 - 02383360 _____ (Farbar) C:\Users\Home\Downloads\FRST64.exe
2016-05-28 10:30 - 2016-05-28 10:30 - 05198336 _____ (AVAST Software) C:\Users\Home\Downloads\aswMBR.exe
2016-05-26 23:27 - 2016-05-27 00:19 - 00000000 ____D C:\Users\Home\AppData\Roaming\Hoyle Card Games 2012
2016-05-26 23:27 - 2016-05-26 23:28 - 00000000 ____D C:\Users\Home\AppData\Roaming\Hoyle FaceCreator
2016-05-26 23:27 - 2016-05-26 23:27 - 00002741 _____ C:\Users\Public\Desktop\Hoyle Card Games.lnk
2016-05-26 23:27 - 2016-05-26 23:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hoyle
2016-05-22 23:12 - 2016-05-22 23:25 - 00024011 _____ C:\Users\Home\Desktop\favoritePlace
2016-05-20 11:02 - 2016-05-20 11:02 - 04498888 _____ (HTTrack ) C:\Users\Home\Downloads\httrack_x64-3.48.22.exe
2016-05-20 08:55 - 2016-05-20 08:55 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2016-05-18 12:02 - 2016-05-18 12:04 - 00000000 ____D C:\Users\Home\AppData\Roaming\Inspyder Web2Disk
2016-05-18 12:02 - 2016-05-18 12:02 - 14160896 _____ (Inspyder Software Inc. ) C:\Users\Home\Downloads\Web2Disk5TrialSetup.exe
2016-05-16 01:01 - 2016-05-16 01:01 - 00071872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME852.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME837.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00027320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME84C.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00025280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME899.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00025280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME893.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00023744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME87E.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00023232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME7EA.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00021696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME8AF.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00021696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME78D.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00021184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME805.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME868.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME81B.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME7D4.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME821.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME7B9.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00019640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME8C4.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00019640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME7F0.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00019640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME7A3.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00019136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME7BF.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00019136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME778.tmp
2016-05-16 01:01 - 2016-05-16 01:01 - 00019136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBME762.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00069824 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME865.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00028344 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME83A.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00027320 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME84F.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00025280 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME8AC.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00025280 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME896.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00023744 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME881.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00023232 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME7ED.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00021696 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME8B2.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00021696 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME790.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00021184 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME808.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME87B.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME81E.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME7D7.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME8C7.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME834.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME802.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME7BC.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME7A6.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00019136 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME77B.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00019136 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME775.tmp
2016-05-16 01:00 - 2016-05-16 01:00 - 00019128 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBME7D1.tmp
2016-05-11 10:07 - 2016-04-30 08:31 - 03591168 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-05-11 10:07 - 2016-04-23 08:12 - 01401024 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-05-11 10:07 - 2016-04-23 08:12 - 00713920 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-05-11 10:07 - 2016-04-23 08:12 - 00190144 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2016-05-11 10:07 - 2016-04-23 07:28 - 01542816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-05-11 10:07 - 2016-04-23 07:24 - 07474528 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-05-11 10:07 - 2016-04-23 07:24 - 01819208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-05-11 10:07 - 2016-04-23 07:10 - 02919832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-05-11 10:07 - 2016-04-23 07:09 - 22561256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-05-11 10:07 - 2016-04-23 07:09 - 21123320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-05-11 10:07 - 2016-04-23 07:09 - 05240960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2016-05-11 10:07 - 2016-04-23 07:09 - 04074160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-05-11 10:07 - 2016-04-23 07:08 - 06605504 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2016-05-11 10:07 - 2016-04-23 07:08 - 04515256 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-05-11 10:07 - 2016-04-23 07:01 - 01996640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-05-11 10:07 - 2016-04-23 06:39 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsCSP.dll
2016-05-11 10:07 - 2016-04-23 06:32 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapsupdatetask.dll
2016-05-11 10:07 - 2016-04-23 06:31 - 13018112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-05-11 10:07 - 2016-04-23 06:31 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosStorage.dll
2016-05-11 10:07 - 2016-04-23 06:30 - 22379008 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-05-11 10:07 - 2016-04-23 06:30 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvc.dll
2016-05-11 10:07 - 2016-04-23 06:29 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshost.dll
2016-05-11 10:07 - 2016-04-23 06:28 - 16984576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-05-11 10:07 - 2016-04-23 06:26 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosStorage.dll
2016-05-11 10:07 - 2016-04-23 06:25 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapsBtSvc.dll
2016-05-11 10:07 - 2016-04-23 06:23 - 11545088 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-05-11 10:07 - 2016-04-23 06:22 - 09918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-05-11 10:07 - 2016-04-23 06:22 - 00460800 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2016-05-11 10:07 - 2016-04-23 06:20 - 19344384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-05-11 10:07 - 2016-04-23 06:20 - 18676224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-05-11 10:07 - 2016-04-23 06:20 - 00606720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2016-05-11 10:07 - 2016-04-23 06:19 - 07977472 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2016-05-11 10:07 - 2016-04-23 06:19 - 01056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2016-05-11 10:07 - 2016-04-23 06:19 - 00970752 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-05-11 10:07 - 2016-04-23 06:19 - 00853504 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2016-05-11 10:07 - 2016-04-23 06:19 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2016-05-11 10:07 - 2016-04-23 06:18 - 24604672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-05-11 10:07 - 2016-04-23 06:18 - 00988160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2016-05-11 10:07 - 2016-04-23 06:18 - 00939520 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2016-05-11 10:07 - 2016-04-23 06:18 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2016-05-11 10:07 - 2016-04-23 06:18 - 00349696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2016-05-11 10:07 - 2016-04-23 06:16 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2016-05-11 10:07 - 2016-04-23 06:15 - 00792064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-05-11 10:07 - 2016-04-23 06:15 - 00784896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll
2016-05-11 10:07 - 2016-04-23 06:15 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2016-05-11 10:07 - 2016-04-23 06:14 - 13383168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-05-11 10:07 - 2016-04-23 06:14 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2016-05-11 10:07 - 2016-04-23 06:13 - 07200256 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2016-05-11 10:07 - 2016-04-23 06:13 - 06295552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2016-05-11 10:07 - 2016-04-23 06:10 - 12125696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-05-11 10:07 - 2016-04-23 06:09 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-05-11 10:07 - 2016-04-23 06:09 - 02582016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2016-05-11 10:07 - 2016-04-23 06:08 - 05324288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-05-11 10:07 - 2016-04-23 06:08 - 02061824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2016-05-11 10:07 - 2016-04-23 06:07 - 05205504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2016-05-11 10:07 - 2016-04-23 06:06 - 06974464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-05-11 10:07 - 2016-04-23 06:05 - 05502976 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2016-05-11 10:07 - 2016-04-23 06:05 - 02166784 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-05-11 10:07 - 2016-04-23 06:05 - 01946112 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2016-05-11 10:07 - 2016-04-23 06:04 - 04759040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2016-05-11 10:07 - 2016-04-23 06:03 - 05660160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-05-11 10:07 - 2016-04-23 06:03 - 04894208 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-05-11 10:07 - 2016-04-23 06:03 - 02280960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-05-11 10:07 - 2016-04-23 06:03 - 02000896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2016-05-11 10:07 - 2016-04-23 06:02 - 07832576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-05-11 10:07 - 2016-04-23 06:02 - 02444288 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2016-05-11 10:06 - 2016-05-06 06:53 - 00095072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdport.sys
2016-05-11 10:06 - 2016-05-06 06:05 - 00241664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2016-05-11 10:06 - 2016-05-06 06:03 - 00649216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2016-05-11 10:06 - 2016-05-06 05:53 - 00351232 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2016-05-11 10:06 - 2016-05-06 05:49 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnrSvc.dll
2016-05-11 10:06 - 2016-05-06 05:44 - 00582656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll
2016-05-11 10:06 - 2016-05-06 05:43 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2016-05-11 10:06 - 2016-05-06 05:23 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll
2016-05-11 10:06 - 2016-04-30 08:42 - 01387520 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-05-11 10:06 - 2016-04-23 08:12 - 01184960 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-05-11 10:06 - 2016-04-23 08:12 - 00514752 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-05-11 10:06 - 2016-04-23 08:12 - 00294592 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-05-11 10:06 - 2016-04-23 08:12 - 00092352 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-05-11 10:06 - 2016-04-23 08:12 - 00046784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-05-11 10:06 - 2016-04-23 07:28 - 01557768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-05-11 10:06 - 2016-04-23 07:26 - 00707608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2016-05-11 10:06 - 2016-04-23 07:24 - 01997328 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-05-11 10:06 - 2016-04-23 07:24 - 00754664 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2016-05-11 10:06 - 2016-04-23 07:24 - 00638816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2016-05-11 10:06 - 2016-04-23 07:24 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2016-05-11 10:06 - 2016-04-23 07:24 - 00099680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2016-05-11 10:06 - 2016-04-23 07:22 - 01161120 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2016-05-11 10:06 - 2016-04-23 07:18 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-05-11 10:06 - 2016-04-23 07:13 - 00502104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-05-11 10:06 - 2016-04-23 07:13 - 00306832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2016-05-11 10:06 - 2016-04-23 07:13 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-05-11 10:06 - 2016-04-23 07:12 - 00925064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2016-05-11 10:06 - 2016-04-23 07:12 - 00451928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2016-05-11 10:06 - 2016-04-23 07:12 - 00413536 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2016-05-11 10:06 - 2016-04-23 07:11 - 01092464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2016-05-11 10:06 - 2016-04-23 07:11 - 00696672 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-05-11 10:06 - 2016-04-23 07:11 - 00498960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2016-05-11 10:06 - 2016-04-23 07:11 - 00390496 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2016-05-11 10:06 - 2016-04-23 07:11 - 00131424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ufxsynopsys.sys
2016-05-11 10:06 - 2016-04-23 07:11 - 00115040 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-05-11 10:06 - 2016-04-23 07:10 - 03673424 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-05-11 10:06 - 2016-04-23 07:10 - 00330072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2016-05-11 10:06 - 2016-04-23 07:09 - 00569744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
2016-05-11 10:06 - 2016-04-23 07:09 - 00565600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2016-05-11 10:06 - 2016-04-23 07:09 - 00465760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2016-05-11 10:06 - 2016-04-23 07:09 - 00303216 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
2016-05-11 10:06 - 2016-04-23 07:09 - 00255168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe
2016-05-11 10:06 - 2016-04-23 07:08 - 00725776 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
2016-05-11 10:06 - 2016-04-23 07:07 - 01848072 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2016-05-11 10:06 - 2016-04-23 07:07 - 01536088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2016-05-11 10:06 - 2016-04-23 07:07 - 00204048 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2016-05-11 10:06 - 2016-04-23 07:07 - 00183904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
2016-05-11 10:06 - 2016-04-23 07:06 - 00291360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininit.exe
2016-05-11 10:06 - 2016-04-23 07:02 - 00188256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2016-05-11 10:06 - 2016-04-23 07:01 - 00650304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2016-05-11 10:06 - 2016-04-23 07:01 - 00619296 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll
2016-05-11 10:06 - 2016-04-23 07:01 - 00577368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2016-05-11 10:06 - 2016-04-23 07:01 - 00522176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2016-05-11 10:06 - 2016-04-23 07:01 - 00513368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll
2016-05-11 10:06 - 2016-04-23 07:01 - 00393568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2016-05-11 10:06 - 2016-04-23 07:01 - 00217440 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2016-05-11 10:06 - 2016-04-23 07:00 - 01776768 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2016-05-11 10:06 - 2016-04-23 07:00 - 01594920 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2016-05-11 10:06 - 2016-04-23 07:00 - 01522152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2016-05-11 10:06 - 2016-04-23 07:00 - 01399224 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2016-05-11 10:06 - 2016-04-23 07:00 - 01372304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2016-05-11 10:06 - 2016-04-23 07:00 - 01337240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2016-05-11 10:06 - 2016-04-23 07:00 - 00550656 _____ (Microsoft Corporation) C:\WINDOWS\system32\directmanipulation.dll
2016-05-11 10:06 - 2016-04-23 07:00 - 00453472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\directmanipulation.dll
2016-05-11 10:06 - 2016-04-23 07:00 - 00058208 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwminit.dll
2016-05-11 10:06 - 2016-04-23 06:56 - 00534872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2016-05-11 10:06 - 2016-04-23 06:35 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosHostClient.dll
2016-05-11 10:06 - 2016-04-23 06:34 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbser.sys
2016-05-11 10:06 - 2016-04-23 06:34 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\hmkd.dll
2016-05-11 10:06 - 2016-04-23 06:34 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2016-05-11 10:06 - 2016-04-23 06:33 - 00089600 _____ (Microsoft Corporation) C:\WINDOWS\system32\NFCProvisioningPlugin.dll
2016-05-11 10:06 - 2016-04-23 06:33 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshbth.dll
2016-05-11 10:06 - 2016-04-23 06:33 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmCx.sys
2016-05-11 10:06 - 2016-04-23 06:33 - 00038400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ByteCodeGenerator.exe
2016-05-11 10:06 - 2016-04-23 06:32 - 00134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
2016-05-11 10:06 - 2016-04-23 06:32 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseDesktopAppMgmtCSP.dll
2016-05-11 10:06 - 2016-04-23 06:30 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosHostClient.dll
2016-05-11 10:06 - 2016-04-23 06:29 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2016-05-11 10:06 - 2016-04-23 06:29 - 00151040 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2016-05-11 10:06 - 2016-04-23 06:29 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\filecrypt.sys
2016-05-11 10:06 - 2016-04-23 06:29 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe
2016-05-11 10:06 - 2016-04-23 06:29 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hmkd.dll
2016-05-11 10:06 - 2016-04-23 06:29 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ByteCodeGenerator.exe
2016-05-11 10:06 - 2016-04-23 06:29 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2016-05-11 10:06 - 2016-04-23 06:28 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudDomainJoinDataModelServer.dll
2016-05-11 10:06 - 2016-04-23 06:28 - 00127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2016-05-11 10:06 - 2016-04-23 06:28 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll
2016-05-11 10:06 - 2016-04-23 06:28 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-05-11 10:06 - 2016-04-23 06:28 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wshbth.dll
2016-05-11 10:06 - 2016-04-23 06:27 - 00155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys
2016-05-11 10:06 - 2016-04-23 06:27 - 00039424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfdprov.dll
2016-05-11 10:06 - 2016-04-23 06:26 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2016-05-11 10:06 - 2016-04-23 06:26 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll
2016-05-11 10:06 - 2016-04-23 06:25 - 00630784 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2016-05-11 10:06 - 2016-04-23 06:25 - 00617984 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2016-05-11 10:06 - 2016-04-23 06:25 - 00210432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2016-05-11 10:06 - 2016-04-23 06:25 - 00207360 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-05-11 10:06 - 2016-04-23 06:24 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2016-05-11 10:06 - 2016-04-23 06:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2016-05-11 10:06 - 2016-04-23 06:24 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2016-05-11 10:06 - 2016-04-23 06:24 - 00287232 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2016-05-11 10:06 - 2016-04-23 06:24 - 00181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll
2016-05-11 10:06 - 2016-04-23 06:24 - 00166400 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll
2016-05-11 10:06 - 2016-04-23 06:24 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEDataLayerHelpers.dll
2016-05-11 10:06 - 2016-04-23 06:23 - 00414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-05-11 10:06 - 2016-04-23 06:23 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ListSvc.dll
2016-05-11 10:06 - 2016-04-23 06:23 - 00179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\BrowserSettingSync.dll
2016-05-11 10:06 - 2016-04-23 06:23 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll
2016-05-11 10:06 - 2016-04-23 06:22 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2016-05-11 10:06 - 2016-04-23 06:21 - 00479232 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-05-11 10:06 - 2016-04-23 06:21 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
2016-05-11 10:06 - 2016-04-23 06:20 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2016-05-11 10:06 - 2016-04-23 06:20 - 00484352 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2016-05-11 10:06 - 2016-04-23 06:20 - 00356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll
2016-05-11 10:06 - 2016-04-23 06:20 - 00307200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2016-05-11 10:06 - 2016-04-23 06:20 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll
2016-05-11 10:06 - 2016-04-23 06:19 - 00395264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlansec.dll
2016-05-11 10:06 - 2016-04-23 06:19 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BrowserSettingSync.dll
2016-05-11 10:06 - 2016-04-23 06:18 - 00988672 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2016-05-11 10:06 - 2016-04-23 06:18 - 00804352 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-05-11 10:06 - 2016-04-23 06:18 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-05-11 10:06 - 2016-04-23 06:18 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2016-05-11 10:06 - 2016-04-23 06:18 - 00515072 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
2016-05-11 10:06 - 2016-04-23 06:18 - 00471552 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll
2016-05-11 10:06 - 2016-04-23 06:18 - 00436736 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2016-05-11 10:06 - 2016-04-23 06:18 - 00219648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2016-05-11 10:06 - 2016-04-23 06:17 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-05-11 10:06 - 2016-04-23 06:17 - 00529920 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2016-05-11 10:06 - 2016-04-23 06:17 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-05-11 10:06 - 2016-04-23 06:17 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanmsm.dll
2016-05-11 10:06 - 2016-04-23 06:16 - 01319424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2016-05-11 10:06 - 2016-04-23 06:16 - 00848896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-05-11 10:06 - 2016-04-23 06:15 - 01073152 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2016-05-11 10:06 - 2016-04-23 06:15 - 00865792 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2016-05-11 10:06 - 2016-04-23 06:15 - 00673280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2016-05-11 10:06 - 2016-04-23 06:15 - 00400896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll
2016-05-11 10:06 - 2016-04-23 06:14 - 00870912 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2016-05-11 10:06 - 2016-04-23 06:14 - 00821760 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2016-05-11 10:06 - 2016-04-23 06:14 - 00647680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-05-11 10:06 - 2016-04-23 06:14 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-05-11 10:06 - 2016-04-23 06:14 - 00354304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupShim.dll
2016-05-11 10:06 - 2016-04-23 06:14 - 00342528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2016-05-11 10:06 - 2016-04-23 06:13 - 00705536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2016-05-11 10:06 - 2016-04-23 06:13 - 00489984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2016-05-11 10:06 - 2016-04-23 06:13 - 00434688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2016-05-11 10:06 - 2016-04-23 06:12 - 00667648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2016-05-11 10:06 - 2016-04-23 06:10 - 00639488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2016-05-11 10:06 - 2016-04-23 06:07 - 02598912 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2016-05-11 10:06 - 2016-04-23 06:07 - 01500160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-05-11 10:06 - 2016-04-23 06:07 - 00848896 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2016-05-11 10:06 - 2016-04-23 06:05 - 02066432 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2016-05-11 10:06 - 2016-04-23 06:05 - 01626624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2016-05-11 10:06 - 2016-04-23 06:05 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2016-05-11 10:06 - 2016-04-23 06:05 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2016-05-11 10:06 - 2016-04-23 06:05 - 00103936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2016-05-11 10:06 - 2016-04-23 06:04 - 01731072 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-05-11 10:06 - 2016-04-23 06:03 - 02193408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2016-05-11 10:06 - 2016-04-23 06:03 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2016-05-11 10:06 - 2016-04-23 06:03 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
2016-05-11 10:06 - 2016-04-23 06:01 - 04775424 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2016-05-11 10:06 - 2016-04-23 06:00 - 01390080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-05-11 10:06 - 2016-04-23 06:00 - 00984576 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2016-05-11 10:06 - 2016-04-23 05:45 - 00461824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2016-05-11 10:06 - 2016-04-23 04:10 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2016-05-11 10:06 - 2016-04-23 04:10 - 00002186 _____ C:\WINDOWS\system32\AppxProvisioning.xml
2016-05-11 10:06 - 2016-04-19 00:30 - 00002186 _____ C:\WINDOWS\SysWOW64\AppxProvisioning.xml
2016-05-10 23:28 - 2016-05-10 23:28 - 00000000 ____D C:\Users\Home\AppData\Local\TShell
2016-05-10 17:33 - 2016-05-10 17:33 - 01344344 _____ (Ellora Assets Corporation ) C:\Users\Home\Downloads\FreemakeVideoConverterSetup.exe
2016-05-10 11:42 - 2016-05-10 11:42 - 03081072 _____ C:\Users\Home\Downloads\mp3tagv277setup.exe
2016-05-02 09:16 - 2016-05-02 09:16 - 00071864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF5EF.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00069824 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF5F2.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00029880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF5C4.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00028344 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF5D7.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00027328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF5DA.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00027328 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF5DD.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00025280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF627.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00025280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF621.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00025280 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF639.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00025280 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF624.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00023744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF60B.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00023744 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF60E.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00023232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF577.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00023232 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF58A.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00021696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF63C.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00021696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF51B.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00021696 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF63F.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00021696 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF52D.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00021184 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF5A5.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00021176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF593.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF5F5.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF5A8.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF571.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF5AB.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF574.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00020152 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF608.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF5BE.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF58D.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF546.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF530.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF655.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF590.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF559.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019648 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF543.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF652.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019640 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF5C1.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF55C.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF515.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBMF4FF.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019136 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF55F.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019136 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF502.tmp
2016-05-02 09:16 - 2016-05-02 09:16 - 00019128 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBMF518.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00072088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM7844.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00070040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM7847.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00030088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM7819.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00028552 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM782B.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00027552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM782E.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00027552 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM7831.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00025488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM787B.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00025488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM7875.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00025488 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM788E.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00025488 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM7878.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00023960 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM7863.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00023952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM7860.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00023448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM77CC.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00023448 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM77CF.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00021936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM7760.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00021936 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM7763.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00021896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM7891.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00021896 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM7894.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00021408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM77F7.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00021408 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM77FA.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00020376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM784A.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00020376 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM785D.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00020368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM77B6.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00020368 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM77B9.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00020360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM77FD.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00020360 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM7810.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM7775.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019896 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM7778.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM77E2.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019880 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM77E5.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM78A7.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019864 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM78AA.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM7813.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM778B.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019856 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM7816.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019856 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM778E.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM77A1.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019360 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM77A4.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM7735.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019344 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM774D.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019344 _____ (Microsoft Corporation) C:\WINDOWS\system32\TBM7738.tmp
2016-04-28 05:30 - 2016-04-28 05:30 - 00019336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TBM774A.tmp
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-05-28 10:27 - 2014-04-30 21:14 - 00000000 ____D C:\Users\Home\AppData\Roaming\Ditto
2016-05-28 10:27 - 2014-04-26 03:38 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-05-28 09:50 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-05-28 02:18 - 2014-04-27 15:07 - 00000000 ____D C:\Users\Home\AppData\Roaming\foobar2000
2016-05-28 02:00 - 2015-01-07 00:21 - 00000000 ____D C:\Users\Home\AppData\Local\Adobe
2016-05-27 20:58 - 2015-12-13 16:30 - 00898006 _____ C:\WINDOWS\system32\perfh00C.dat
2016-05-27 20:58 - 2015-12-13 16:30 - 00185456 _____ C:\WINDOWS\system32\perfc00C.dat
2016-05-27 20:58 - 2015-12-06 02:27 - 02081762 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-05-27 20:58 - 2015-10-30 09:21 - 00000000 ____D C:\WINDOWS\INF
2016-05-27 17:52 - 2015-10-30 09:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-05-27 12:53 - 2014-05-06 23:40 - 00000000 ____D C:\Users\Home\AppData\Roaming\Mp3tag
2016-05-27 11:04 - 2016-03-11 19:39 - 00003540 _____ C:\WINDOWS\System32\Tasks\AutoKMS
2016-05-27 11:04 - 2015-12-06 02:33 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-27 11:04 - 2014-06-06 01:44 - 00000000 ____D C:\ProgramData\PACE
2016-05-27 11:03 - 2015-10-30 08:28 - 01048576 ___SH C:\WINDOWS\system32\config\BBI
2016-05-27 11:03 - 2014-04-27 00:56 - 00000000 ____D C:\Users\Home\AppData\Roaming\uTorrent
2016-05-27 08:00 - 2015-12-08 15:07 - 00000412 _____ C:\WINDOWS\Tasks\X-Rite Device Services Software Updater.job
2016-05-26 13:30 - 2015-12-06 02:39 - 00000000 ____D C:\Users\Home\AppData\Local\Packages
2016-05-26 02:46 - 2015-11-29 00:39 - 00000000 ____D C:\ProgramData\Origin
2016-05-24 11:35 - 2015-05-26 15:13 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-05-22 22:41 - 2014-04-27 02:47 - 00000000 ____D C:\Users\Home\AppData\Local\Microsoft Help
2016-05-21 16:40 - 2016-02-04 16:21 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-20 17:33 - 2015-12-06 02:41 - 00002397 _____ C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-05-20 11:02 - 2014-09-09 11:54 - 00000971 _____ C:\Users\Home\Desktop\HTTrack Website Copier.lnk
2016-05-20 08:55 - 2015-10-30 09:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-05-20 08:55 - 2015-10-30 09:24 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-05-20 08:54 - 2014-04-27 02:47 - 00000000 ____D C:\Program Files\Microsoft Office
2016-05-18 12:02 - 2014-09-09 11:53 - 00000000 ____D C:\Program Files\WEB
2016-05-15 20:02 - 2015-12-06 02:27 - 00000000 ____D C:\Users\Home
2016-05-14 11:53 - 2015-10-30 09:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-05-12 10:55 - 2015-11-28 22:06 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-05-12 10:43 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\rescache
2016-05-12 03:41 - 2014-04-25 23:53 - 00000000 ____D C:\ProgramData\Oracle
2016-05-12 03:39 - 2014-10-20 14:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-05-12 03:39 - 2014-04-25 23:53 - 00000000 ____D C:\Program Files (x86)\Java
2016-05-12 03:38 - 2015-08-28 17:47 - 00000000 ____D C:\Users\Home\.oracle_jre_usage
2016-05-12 03:38 - 2014-10-20 14:08 - 00097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2016-05-12 03:32 - 2015-12-06 02:39 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-05-12 03:16 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\SysWOW64\en-GB
2016-05-12 03:15 - 2015-10-30 11:07 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-12 03:15 - 2015-10-30 09:24 - 00015703 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2016-05-12 03:15 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-05-12 03:15 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\en-GB
2016-05-12 03:15 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-05-12 03:15 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\Provisioning
2016-05-12 03:15 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-05-11 21:57 - 2015-10-30 09:26 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-05-11 21:57 - 2015-10-30 09:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2016-05-11 11:09 - 2014-04-27 14:12 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-05-11 11:02 - 2014-04-27 14:12 - 139319312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-05-10 18:16 - 2015-02-03 01:44 - 37769216 _____ C:\Users\Home\Documents\Mon Dossier Invoicing6.0FR03_0895452f-b7c1-4c00-a316-c6a6d0ea4bf4.sdf
2016-05-10 18:15 - 2015-02-05 02:36 - 00000000 ____D C:\Users\Home\AppData\Local\StimulsoftReportsResources
2016-05-10 17:37 - 2014-04-27 22:02 - 00001499 _____ C:\Users\Public\Desktop\Freemake Video Downloader.lnk
2016-05-10 17:37 - 2014-04-27 22:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake
2016-05-10 17:37 - 2014-04-27 22:02 - 00000000 ____D C:\ProgramData\Freemake
2016-05-10 17:36 - 2015-04-01 00:22 - 01345112 _____ (Ellora Assets Corporation ) C:\Users\Home\Downloads\FreemakeVideoDownloaderSetup.exe
2016-05-10 17:34 - 2014-04-27 22:05 - 00001487 _____ C:\Users\Public\Desktop\Freemake Video Converter.lnk
2016-05-10 11:42 - 2014-07-03 15:05 - 00001158 _____ C:\Users\Public\Desktop\Mp3tag.lnk
2016-05-10 11:42 - 2014-04-27 01:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIA
2016-05-09 16:23 - 2015-11-29 00:39 - 00000000 ____D C:\Program Files (x86)\Origin
==================== Files in the root of some directories =======
2015-05-12 06:04 - 2015-05-12 06:04 - 0000079 _____ () C:\Program Files (x86)\prefs.js
2016-03-21 19:11 - 2016-03-21 19:15 - 0000132 _____ () C:\Users\Home\AppData\Roaming\Adobe PNG Format CC Prefs
2016-01-08 20:07 - 2016-04-15 14:11 - 0001040 _____ () C:\Users\Home\AppData\Roaming\burnaware.ini
2014-06-06 01:40 - 2014-06-06 01:41 - 4923728 _____ () C:\Users\Home\AppData\Roaming\EditorTranscode_Install.log
2016-02-25 16:53 - 2016-02-25 16:53 - 0000112 _____ () C:\Users\Home\AppData\Roaming\JP2K CS6 Prefs
2016-01-26 19:59 - 2016-01-26 19:59 - 0000600 _____ () C:\Users\Home\AppData\Roaming\PUTTY.RND
2016-01-26 19:13 - 2016-01-26 21:17 - 0000600 _____ () C:\Users\Home\AppData\Local\PUTTY.RND
2014-12-01 17:26 - 2014-12-01 17:26 - 0000017 _____ () C:\Users\Home\AppData\Local\resmon.resmoncfg
2015-05-06 19:13 - 2015-05-06 19:13 - 0000798 _____ () C:\Users\Home\AppData\Local\Temp-log.txt
2015-05-12 18:46 - 2015-05-12 18:46 - 0000000 _____ () C:\Users\Home\AppData\Local\Temp.dat
Some files in TEMP:
====================
C:\Users\Home\AppData\Local\Temp\FreemakeVideoConverterFull.exe
C:\Users\Home\AppData\Local\Temp\FreemakeVideoDownloaderFull.exe
C:\Users\Home\AppData\Local\Temp\jre-8u91-windows-au.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-05-23 09:57
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version:25-05-2016 01
Ran by [removed] (2016-05-28 10:35:40)
Running from C:\Users\[removed]\Downloads
Windows 10 Pro Version 1511 (X64) (2015-12-06 00:38:58)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
A3AEC1330C7F41F68291 (S-1-5-21-186901184-3626248880-2543553819-1004 - Limited - Enabled)
Administrator (S-1-5-21-186901184-3626248880-2543553819-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-186901184-3626248880-2543553819-503 - Limited - Disabled)
Guest (S-1-5-21-186901184-3626248880-2543553819-501 - Limited - Enabled)
Home (S-1-5-21-186901184-3626248880-2543553819-1000 - Administrator - Enabled) => C:\Users\Home
HomeGroupUser$ (S-1-5-21-186901184-3626248880-2543553819-1002 - Limited - Enabled)
Nanar (S-1-5-21-186901184-3626248880-2543553819-1006 - Administrator - Enabled) => C:\Users\Nanar
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKLM-x32\…\uTorrent) (Version: 2.2.1 - )
7-Zip 9.20 (x64 edition) (HKLM\…\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Acronis True Image 2016 (HKLM-x32\…\{5E5999D7-85DD-4B82-B48B-5F60BDFAC502}Visible) (Version: 19.0.5634 - Acronis)
Acronis True Image 2016 (x32 Version: 19.0.5634 - Acronis) Hidden
Adblock Plus for IE (32-bit and 64-bit) (HKLM\…\{1CAFFEC6-23B4-484B-B17B-3200BE5C5636}) (Version: 99.9 - Eyeo GmbH)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.016.20041 - Adobe Systems Incorporated)
Adobe Connect Add-in (HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\Adobe Connect Add-in) (Version: - )
Adobe Flash Player 21 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Media Encoder CC 2014 (HKLM-x32\…\{663DEEEF-EF34-4DCB-8687-73A7AA146E02}) (Version: 8.0.1 - Adobe Systems Incorporated)
Adobe Photoshop CC (HKLM-x32\…\{2D99B50E-431D-4AA8-85C1-172A6F8BCF09}) (Version: 14.0 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5 64-bit (HKLM\…\{6C1A010F-9108-4162-A26F-9FEC4AC0F0F0}) (Version: 5.0.1 - Adobe)
Adobe Premiere Pro CC 2014 (HKLM-x32\…\{07BE616F-9E42-4C90-AF4F-0F32A5B088E7}) (Version: 8.0.1 - Adobe Systems Incorporated)
Advanced Renamer (HKLM-x32\…\Advanced Renamer_is1) (Version: 3.65 - Hulubulu Software)
Agatha Christie - And Then There Were None (HKLM-x32\…\{E4628D0D-5DC8-49EC-985A-F0C12EDBF1D2}) (Version: 1.0 - )
Album Art Downloader XUI 1.02 (HKLM-x32\…\Album Art Downloader XUI) (Version: 1.02 - hxxp://sourceforge.net/projects/album-art)
All My Movies (HKLM-x32\…\{DEE77D4F-249F-46DF-8176-4BC4822D68AD}_is1) (Version: 7.5 - Bolide Software)
AMD Install Manager (HKLM\…\AMD Catalyst Install Manager) (Version: 9.0.000.4 - Advanced Micro Devices, Inc.)
Android SDK Tools (HKLM-x32\…\Android SDK Tools) (Version: 1.16 - Google Inc.)
Apple Application Support (HKLM-x32\…\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Assassin's Creed (HKLM-x32\…\{8CFA9151-6404-409A-AF22-4632D04582FD}) (Version: 1.00 - Ubisoft)
Assassins Creed Chronicles China (HKLM-x32\…\Assassins Creed Chronicles China_is1) (Version: - )
Assassins Creed Unity (HKLM-x32\…\Assassins Creed Unity_is1) (Version: - )
Audacity 1.3.13 (Unicode) (HKLM-x32\…\Audacity 1.3 Beta (Unicode)_is1) (Version: - Audacity Team)
Avid Editor Transcode (HKLM\…\{C38FD4F6-62AD-445B-83CE-3CAF2E9AD918}) (Version: 3.0.0 - Avid Technology, Inc.)
Avid License Control (HKLM-x32\…\{F187D064-F101-4E95-8D05-4027809AA0F8}) (Version: 3.0.1 - Avid Technology, Inc.)
Avid Media Composer (HKLM\…\{F56EA69D-81E2-4810-81FE-CC5F9C8DC18F}) (Version: 7.0.0 - Avid Technology, Inc.)
Avidemux 2.6 - 64 bits (HKLM-x32\…\Avidemux 2.6 - 64 bits (64-bit)) (Version: 2.6.10.150607 - )
Blackwell Legacy v1.4 (HKLM-x32\…\The Blackwell Legacy_is1) (Version: - Wadjet Eye Games)
Broken Sword 5 - the Serpent's Curse (HKLM-x32\…\GOGPACKBROKENSWORD5EP1EP2_is1) (Version: 2.0.0.2 - GOG.com)
BurnAware Free 8.7 (HKLM-x32\…\BurnAware Free_is1) (Version: - Burnaware)
calibre 64bit (HKLM\…\{90CE82DB-B7A9-4623-95D0-D95CA70C6D4D}) (Version: 2.46.0 - Kovid Goyal)
CameraHelperMsi (x32 Version: 13.51.815.0 - Logitech) Hidden
CanoScan Toolbox Ver4.9 (HKLM-x32\…\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version: - )
Catalyst Control Center Next Localization BR (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.0321.1015.16463 - Advanced Micro Devices, Inc.) Hidden
Collectorz.com Music Collector (HKLM-x32\…\Collectorz.com Music Collector) (Version: - )
ColorMunki Display 1.1.1 (HKLM-x32\…\ColorMunki Display_is1) (Version: - X-Rite)
ComicRack v0.9.176 (HKLM\…\ComicRack) (Version: v0.9.176 - cYo Soft)
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
Creation Master 16 Beta 2 (HKLM-x32\…\Creation Master 16_is1) (Version: - FIFA MASTER)
CrystalDiskInfo 6.1.12 Shizuku Edition (HKLM-x32\…\CrystalDiskInfo_is1) (Version: 6.1.12 - Crystal Dew World)
DAEMON Tools Lite (HKLM-x32\…\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
dBpoweramp (HKLM-x32\…\dBpoweramp) (Version: Release 15 - Illustrate)
dBpoweramp DSP Effects (HKLM-x32\…\dBpoweramp DSP Effects) (Version: Release 10 - Illustrate)
Delicious 7: Emily's True Love. Premium Edition (HKLM-x32\…\Delicious 7: Emily's True Love. Premium Edition_is1) (Version: - GameHouse)
Delicious Emilys Honeymoon Cruise 1.00 (HKLM-x32\…\Delicious Emilys Honeymoon Cruise 1.00) (Version: 1.00 - Games)
Device Doctor v3.1 (HKLM-x32\…\Device Doctor_is1) (Version: 3.1 - Device Doctor Software Inc.)
Ditto (HKLM\…\Ditto_is1) (Version: - Scott Brogden)
Don Bradman Cricket 14 (HKLM-x32\…\Don Bradman Cricket 14_is1) (Version: - Big Ant Studios)
Dropbox (HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\Dropbox) (Version: 2.0.22 - Dropbox, Inc.)
DVD Decrypter (Remove Only) (HKLM-x32\…\DVD Decrypter) (Version: - )
EA SPORTS Game Face Browser Plugin 1.8.0.0 (HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\EA SPORTS Game Face Browser Plugin) (Version: 1.8.0.0 - Electronic Arts)
EA SPORTS™ FIFA 15 (HKLM-x32\…\{3D4ADA2B-F028-4307-ADF4-6F9AA44725DA}) (Version: 1.4.0.0 - Electronic Arts)
EBP Auto-entrepreneur Pratic 2014 6.0 (OL Technology) (HKLM-x32\…\EBP Auto-entrepreneur Pratic 2014 6.0 (OL Technology)) (Version: 6.0.0 - EBP)
EBP Auto-entrepreneur Pratic 2014 6.0 (OL Technology) (Version: 6.0.0 - EBP) Hidden
Eco Driver Pack (HKLM-x32\…\Samsung Eco Driver Pack) (Version: 2.01.07.00 (10-02-15) - Samsung Electronics Co., Ltd.)
Emergency Download Driver (HKLM-x32\…\{3F0F5AB4-C9CE-4226-8393-E9CFF8369D9D}) (Version: 1.1.16.1526 - Microsoft)
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Etron USB3.0 Host Controller (HKLM-x32\…\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.118 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.118 - Etron Technology) Hidden
Exact Audio Copy 1.0beta3 (HKLM-x32\…\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
FFU Loader Driver 1.0.0 (HKLM-x32\…\{7209d085-ed88-4a08-beb2-c49db2b9e838}) (Version: 1.0.0 - Microsoft)
FFU Loader Driver 1.0.0 (x32 Version: 1.0.0 - Microsoft) Hidden
FIFA 16 (HKLM-x32\…\{28FA2805-7992-4A28-844B-040C57204718}) (Version: 1.4.64673.4 - Electronic Arts)
FIFA 16 CAREER & TORNAMENT MODE EDITOR TOOL (HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\FIFA 16 CAREER & TORNAMENT MODE EDITOR TOOL ) (Version: - )
FileZilla Client 3.14.0 (HKLM-x32\…\FileZilla Client) (Version: 3.14.0 - Tim Kosse)
FilmConvert Pro Vegas (HKLM\…\{B3B7AFC4-46CC-45C9-81C1-735747AB803B}) (Version: 1.3 - Rubber Monkey Software)
Final Draft (HKLM-x32\…\{E8FDC52C-83F4-4A0F-AA65-D0E8C0F3302F}) (Version: 9.0.0.163 - Final Draft, Inc.)
Firebird SQL Server - MAGIX Edition (HKLM-x32\…\Firebird SQL Server UK) (Version: 2.0.1.13 - MAGIX AG)
Flirc (HKLM-x32\…\Flirc) (Version: - )
foobar2000 v1.3.9 (HKLM-x32\…\foobar2000) (Version: 1.3.9 - Peter Pawlowski)
Freemake Video Converter version 4.1.9 (HKLM-x32\…\Freemake Video Converter_is1) (Version: 4.1.9 - Ellora Assets Corporation)
Freemake Video Downloader (HKLM-x32\…\Freemake Video Downloader_is1) (Version: 3.8.0 - Ellora Assets Corporation)
HCFR (HKLM-x32\…\HCFR Calibration_is1) (Version: - )
Hell's Kitchen 1.1.5 (HKLM-x32\…\Hell's Kitchen 1.1.5) (Version: - )
Horizon v2.7.9.0 (HKLM-x32\…\d4cfeebc-b821-40b7-9f81-d366b1466f03_is1) (Version: 2.7.9.0 - Daring Development Inc.)
Hoyle Card Games (HKLM-x32\…\{05F6571A-5205-4C81-8160-683BDCC3B272}) (Version: 1.00.0000 - Encore Software, Inc.)
Image Resizer for Windows (64 bit) (Version: 3.0.4802.35565 - Brice Lambson) Hidden
Image Resizer for Windows (HKLM-x32\…\{69d72156-6582-4556-8637-06f40aa7f85b}) (Version: 3.0.4802.35565 - Brice Lambson)
ImgBurn (HKLM-x32\…\ImgBurn) (Version: 2.5.5.0 - LIGHTNING UK!)
IrfanView (remove only) (HKLM-x32\…\IrfanView) (Version: 4.38 - Irfan Skiljan)
Java 8 Update 91 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.14 - Oracle Corporation)
JRiver Media Center 20 (HKLM-x32\…\Media Center 20) (Version: 20 - J. River, Inc.)
K-Lite Mega Codec Pack 10.4.5 (HKLM-x32\…\KLiteCodecPack_is1) (Version: 10.4.5 - )
LightScribe System Software (HKLM-x32\…\{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}) (Version: 1.18.22.2 - LightScribe)
Logitech Webcam Software (HKLM-x32\…\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.80 - Logitech Inc.)
Lumia UEFI Blue Driver (HKLM-x32\…\{9D2A75FE-8CE1-4297-AEC1-A097D47BACE9}) (Version: 1.1.10.1526 - Microsoft)
MAGIX 3D Maker (embeded) (HKLM-x32\…\MAGIX 3D Maker UK) (Version: 6.0.0.10 - MAGIX AG)
MAGIX Movie Edit Pro 15 Plus Download version 8.0.5.8 (UK) (HKLM-x32\…\MAGIX Movie Edit Pro 15 Plus Download version UK) (Version: 8.0.5.8 - MAGIX AG)
MAGIX Screenshare 4.3.6.1987 (UK) (HKLM-x32\…\MAGIX Screenshare UK) (Version: 4.3.6.1987 - MAGIX AG)
Major League Baseball 2K12 (HKLM-x32\…\{E6C29DA3-ADD6-4941-903A-43965CBB0F7C}) (Version: 1.0.0 - 2K Sports)
MakeMKV Batch Converter (HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\eb9b4b052cded054) (Version: 3.0.0.4 - Alex Gritton)
MakeMKV v1.8.10 (HKLM-x32\…\MakeMKV) (Version: v1.8.10 - GuinpinSoft inc)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
MediaInfo 0.7.81 (HKLM\…\MediaInfo) (Version: 0.7.81 - MediaArea.net)
Medieval CUE Splitter (HKLM-x32\…\{B96D2269-568B-4CBF-9332-12FAE8B158F7}) (Version: 1.2.0 - Medieval Software)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\…\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2016 - en-us (HKLM\…\ProplusRetail - en-us) (Version: 16.0.6868.2067 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\…\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\…\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\…\{14297226-E0A0-3781-8911-E9D529552663}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\…\{9B3F0A88-790D-3AD9-9F96-B19CF2746452}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x64 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\…\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\…\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
mIRC (HKLM-x32\…\mIRC) (Version: 7.19 - mIRC Co. Ltd.)
MKVToolNix 8.8.0 (64bit) (HKLM-x32\…\MKVToolNix) (Version: 8.8.0 - Moritz Bunkus)
Mozilla Firefox 45.0.1 (x64 en-GB) (HKLM\…\Mozilla Firefox 45.0.1 (x64 en-GB)) (Version: 45.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 45.0.1.5918 - Mozilla)
Mp3tag v2.77 (HKLM-x32\…\Mp3tag) (Version: v2.77 - Florian Heidenreich)
MSXML 4.0 SP3 Parser (HKLM-x32\…\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\…\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MusicBee 2.4 (HKLM-x32\…\MusicBee) (Version: 2.4 - Steven Mayall)
MVP Baseball 2005 (HKLM-x32\…\{57ABE5FC-9E26-49E0-00A3-CF45D750B1AB}) (Version: - )
MyFonts Order M53317 (HKLM-x32\…\{BAC9162B-47C5-6FC8-A4D2-A519803D51B3}) (Version: 1.0 - MyFonts.com, Inc.)
NexusFont 2.5 (ver 2.5.8.1582) (HKLM-x32\…\{EFEDD205-43FE-4208-B682-0937E803E19E}_is1) (Version: - xiles)
Noise Reduction Plug-In 2.0 (HKLM-x32\…\{36DF4580-D1B3-11E3-A23E-F04DA23A5C58}) (Version: 2.0.628 - Sony)
Notepad++ (HKLM-x32\…\Notepad++) (Version: 6.6.9 - Notepad++ Team)
NTFS Undelete 3.0.6.604 (HKLM-x32\…\NTFS Undelete_is1) (Version: - Copyright © 2011 eSupport.com • All Rights Reserved)
Octoshape add-in for Adobe Flash Player (HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\Octoshape add-in for Adobe Flash Player) (Version: - )
Office 16 Click-to-Run Extensibility Component (Version: 16.0.6828.1019 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.6828.1019 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (Version: 16.0.6828.1019 - Microsoft Corporation) Hidden
OpenAL (HKLM-x32\…\OpenAL) (Version: - )
Origin (HKLM-x32\…\Origin) (Version: 9.10.2.4863 - Electronic Arts, Inc.)
PACE License Support Win64 (HKLM\…\{72ad9d51-0903-4fe7-af5d-33b3185fa6e9}) (Version: 2.0.0.0256 - PACE Anti-Piracy, Inc.)
PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
Port Forward Network Utilities (HKLM-x32\…\{88B1D36C-7B70-4C48-8D2F-AAB956ECF4C3}) (Version: 2.0.5 - Portforward, LLC)
Postbox (4.0.1) (HKLM-x32\…\Postbox (4.0.1)) (Version: 4.0.1 (en-US) - Postbox, Inc.)
Pro Evolution Soccer 2016 (HKLM-x32\…\UHJvRXZvbHV0aW9uU29jY2VyMjAxNg==_is1) (Version: 1 - )
QuickTime 7 (HKLM-x32\…\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.6.1001.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7541 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\…\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.23.0 - Renesas Electronics Corporation) Hidden
Rugby Challenge 2 (HKLM-x32\…\Rugby Challenge 2_is1) (Version: - Sidhe Interactive)
Samsung Easy Printer Manager (HKLM-x32\…\Samsung Easy Printer Manager) (Version: 2.0.0.78 - Samsung Electronics Co., Ltd.)
Samsung Printer Center (HKLM-x32\…\Samsung Printer Center) (Version: 1.0.0.21 - Samsung Electronics Co., Ltd.)
Samsung Printer Diagnostics (HKLM-x32\…\Samsung Printer Diagnostics) (Version: 1.0.4.2 - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (x32 Version: 1.03.05.26 - Samsung Electronics Co., Ltd.) Hidden
SDFormatter (HKLM-x32\…\{179324FF-7B16-4BA8-9836-055CAAEE4F08}) (Version: 4.0.0 - SD Association)
Sentinel Protection Installer 7.6.6 (HKLM-x32\…\{8C2218AC-D1B1-4530-9E67-15164E0E52AB}) (Version: 7.6.6 - SafeNet, Inc.)
Skype Web Plugin (HKLM-x32\…\{15AF46DB-9EBA-4662-AA52-29EF23585035}) (Version: 3.2.0.23388 - Skype Technologies S.A.)
Skype™ 7.21 (HKLM-x32\…\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.21.100 - Skype Technologies S.A.)
Sound Forge Pro 11.0 (HKLM-x32\…\{3F1EEA40-9515-11E4-9B3B-F04DA23A5C58}) (Version: 11.0.299 - Sony)
Stardock Fences 2 (HKLM-x32\…\Stardock Fences 2) (Version: 2.12 - Stardock Software, Inc.)
Stylish Driver Pack (HKLM-x32\…\Samsung Stylish UI Pack) (Version: 1.01.74.00 (09-02-15) - Samsung Electronics Co., Ltd.)
Subtitle Edit 3.4.11 (HKLM-x32\…\SubtitleEdit_is1) (Version: 3.4.11.0 - Nikse)
System Requirements Lab CYRI (HKLM-x32\…\{1110A014-1471-4B66-BFDC-E8EED120CC59}) (Version: 6.0.20.0 - Husdawg, LLC)
TeamViewer 10 (HKLM-x32\…\TeamViewer) (Version: 10.0.36244 - TeamViewer)
TeraCopy 2.3 (HKLM\…\TeraCopy_is1) (Version: - Code Sector)
The Vanishing of Ethan Carter (HKLM-x32\…\The Vanishing of Ethan Carter_is1) (Version: - )
The Walking Dead (HKLM-x32\…\The Walking Dead_is1) (Version: - )
The Walking Dead Michonne Episode 1 (HKLM-x32\…\The Walking Dead Michonne Episode 1_is1) (Version: - )
TiT for MLB 2k10 (HKLM-x32\…\TiT for MLB 2k10) (Version: - MLBmods)
TShell (HKLM-x32\…\{CAA89F0E-679C-42C4-8434-4219C4532EBE}) (Version: 8.0.12397 - Microsoft)
Uninstall Samsung Printer Software (HKLM-x32\…\TotalUninstaller) (Version: 4.0.0.13 - Samsung Electronics CO., LTD.)
Unity Web Player (HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\UnityWebPlayer) (Version: 5.0.1f1 - Unity Technologies ApS)
Unity Web Player (x64) (All users) (HKLM\…\UnityWebPlayer) (Version: 4.6.6f2 - Unity Technologies ApS)
Utilitaire de mise à jour des logiciels EBP 1.1.3 (HKLM-x32\…\Utilitaire de mise à jour des logiciels EBP 1.1.3) (Version: 1.1.3 - EBP)
Utilitaire de mise à jour des logiciels EBP 1.1.3 (Version: 1.1.3 - EBP) Hidden
Valiant Hearts The Great War (HKLM-x32\…\Valiant Hearts The Great War_R.G. Mechanics_is1) (Version: - R.G. Mechanics, spider91)
Vegas Pro 13.0 (64-bit) (HKLM\…\{1EEE0BEE-0BC8-11E5-A19E-F04DA23A5C58}) (Version: 13.0.453 - Sony)
View User's Guide (HKLM-x32\…\View User Guide) (Version: 4.0.0.6 - )
ViewRight Web PC 3.6.0.0 (HKLM-x32\…\{27961C9F-1965-48D9-A579-40F8EBEA0603}) (Version: 3.6.0.0 - Verimatrix, Inc.)
VirtualGeo³ pour le Géoportail (HKLM-x32\…\VGeo3 GP) (Version: 3.1.0.2040 - Diginext)
Volume Normalizer Master (HKLM-x32\…\Volume Normalizer Master_is1) (Version: - A4Video)
Watch Dogs (HKLM-x32\…\Watch Dogs_R.G. Mechanics_is1) (Version: - R.G. Mechanics, spider91)
Win32DiskImager version 0.9.5 (HKLM-x32\…\{D074CE74-912A-4AD3-A0BF-3937D9D01F17}_is1) (Version: 0.9.5 - ImageWriter Developers)
Winamp Detector Plug-in (HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
WinDirStat 1.1.2 (HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\WinDirStat) (Version: - )
Windows 7 USB/DVD Download Tool (HKLM-x32\…\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Device Recovery Tool 3.3.31 (HKLM-x32\…\{72cd5f22-a9d1-4c6b-8eea-5af52ac54574}) (Version: 3.3.31 - Microsoft)
Windows Driver Package - Microsoft USBDevice (02/19/2016 1.0.0.0) (HKLM\…\01D4AA89568B59E5941907D403E3B682EE413AB7) (Version: 02/19/2016 1.0.0.0 - Microsoft)
Windows IP Over USB (HKLM-x32\…\{FF0EA481-42DB-A8AE-8356-48C09F7D953D}) (Version: 10.1.10586.15 - Microsoft Corporation)
Windows Phone Adaptation Kit (MC_arm_chk) (HKLM-x32\…\{72471378-D9FA-46CD-B388-084C95D493C4}) (Version: 8.1.12393 - Microsoft Corporation)
Windows Phone Adaptation Kit (MC_arm_fre) (HKLM-x32\…\{29F26AA0-714C-45A7-B3FC-E656059F554E}) (Version: 8.1.12393 - Microsoft Corporation)
Windows Phone Blue Test Central Test Content (MC_arm_fre) (HKLM-x32\…\{02680862-6797-464D-9B4F-E4B59C4EEFAE}) (Version: 8.1.12397 - Microsoft Corporation)
Windows Phone Common Packaging and Test Tools (NT_x86_fre) (HKLM-x32\…\{78DFD84E-52C6-4AD2-9DE2-E096208C78FF}) (Version: 8.1.12397 - Microsoft Corporation)
Windows Phone Driver Kit (MC_arm_fre) (HKLM-x32\…\{05299235-3FEB-4EBC-A96A-C78277522312}) (Version: 8.1.12393 - Microsoft Corporation)
Windows Phone Driver Kit (NT_x86_fre) (HKLM-x32\…\{43549481-707D-407D-A69C-F022706BF41F}) (Version: 8.1.12393 - Microsoft Corporation)
Windows Phone Kit MSBuild Extensions (NT_x86_fre) (HKLM-x32\…\{0275EB6A-9E53-4650-9E73-E09991B2A4B7}) (Version: 8.1.12393 - Microsoft Corporation)
Windows Phone Symbols (12393 MC_arm_chk) (HKLM-x32\…\{B67CA09A-8455-49D6-BC77-3D94BAAC8029}) (Version: 8.1.12393 - Microsoft Corporation)
Windows Phone Symbols (12393 MC_arm_fre) (HKLM-x32\…\{F0868F0C-785F-445E-AD0E-351A07352764}) (Version: 8.1.12393 - Microsoft Corporation)
WinHTTrack Website Copier 3.48-22 (x64) (HKLM\…\WinHTTrack Website Copier_is1) (Version: 3.48.22 - HTTrack)
WinImage (HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\WinImage) (Version: - )
WinPcap 4.1.2 (HKLM-x32\…\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
WinUsb CoInstallers (HKLM-x32\…\{9755918A-CDF8-4F1E-8453-6359CF1A330A}) (Version: 1.1.12.1526 - Microsoft)
WinUSB Compatible ID Drivers (HKLM-x32\…\{A4A0B236-6046-4CAB-8177-1EAF61112C75}) (Version: 1.1.11.1526 - Microsoft)
WinUSB Drivers ext (HKLM-x32\…\{29BAAF65-09E5-4F52-8D15-2FAF2E23A8DC}) (Version: 1.1.24.1544 - Microsoft)
Xilisoft DVD Creator 6 (HKLM-x32\…\Xilisoft DVD Creator 6) (Version: 6.1.1.0610 - Xilisoft)
Xmarks for IE (HKLM-x32\…\{ABFA6EAE-C9C0-4B39-B722-02094EF6B889}) (Version: 127.0.177 - Xmarks)
XRD i1d3 (x32 Version: 1.0.135 - X-Rite) Hidden
X-Rite Device Services Manager (HKLM-x32\…\{2ECE8EE0-2DBB-444F-92F1-D7C7637CCF70}) (Version: 2.3.81 - X-Rite)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-186901184-3626248880-2543553819-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Home\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileCoAuth.exe (Microsoft Corporation)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {00595C63-854A-45AF-9818-4FD59EEA2EC7} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
Task: {0CB4B2F8-EB60-4FB9-9D01-5DBBFC2B9A07} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {0E32C073-4DED-4ECE-A2C1-668828FB2DD1} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-05-15] (Microsoft Corporation)
Task: {0E3E13BD-78FB-4E0B-B741-E7F65E7BC6CA} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {0FBE8CFB-DAA6-4061-87F6-52B50B0E749B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-05-11] (Microsoft Corporation)
Task: {18BDF91B-7E0E-4616-9C7B-B6F54F50C5A2} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {1A311C7C-C27B-4180-90BC-3719451705CA} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {1C78D167-9A1D-4120-AFAE-BF8FDA7C498F} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {288F8C67-EE87-48A1-A3D7-DC6E3889904F} - System32\Tasks\[removed] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-03-30] (Adobe Systems Incorporated)
Task: {31F5F10B-AE4C-4545-B7F0-66D392170956} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {4349AFED-EA07-408C-8399-1D8F71712735} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {4618D30A-5BE4-4F65-BE9C-323D2865809C} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {4958123E-CF61-44F4-A576-BE2F0074349B} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {4D4F3D61-8C64-4BE7-BE46-B003E9F5F167} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-05-17] (Microsoft Corporation)
Task: {4F696A7E-0DE6-4EFC-B93E-059A9A4F4176} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-05-13] (Adobe Systems Incorporated)
Task: {53604F99-2409-4EAE-999C-D7EE5116E85B} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {55A54888-F1EB-4716-8D7A-772D22FDC545} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {5824B979-C411-4FC8-880C-6E1E09750AFD} - System32\Tasks\{4687050D-7F42-47A4-932F-9A82EBEB62D8} => pcalua.exe -a C:\Users\Home\AppData\Local\TNT2\2.0.0.1702\TNT2User.exe -c /UNINSTALL PARTNER=10817
Task: {625EEA72-BB77-44D2-8EAD-825508D9B89B} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {62FC9A5D-89DF-4A63-8352-3EBF41E82343} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {6666E5D7-46BA-4F9E-B3A8-662EFA5B91FD} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-05-15] (Microsoft Corporation)
Task: {672D0770-2B12-4901-9B8D-E8A709F5F134} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {67C31F25-D84E-4B07-AFA5-0CECD4A37AE3} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {6F6DA71C-C468-4790-ACFA-1B9DE1A0DC66} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-05-17] (Microsoft Corporation)
Task: {74D56318-CBD6-45EE-B1B2-53D71E8FEDB8} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {784FF04C-A9C2-47F1-998A-2BDC2B0D13A8} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {8962C1B2-C9AD-4E86-9AB2-464D747AD105} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {8C43DD10-201A-4249-8448-EAE7E8ECE407} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {8D963B77-944E-4134-A8FC-870CF339C659} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {92A28159-6452-4A3D-81E6-14F6B345B118} - System32\Tasks\EPM Preload => C:\Program Files (x86)\Samsung\Easy Printer Manager\EPM2DotNetHandler.exe [2015-04-24] ()
Task: {999D2AFB-1FF1-4326-9196-1227405EDC06} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {9A4F233A-0F8E-4A1B-A2E9-F10D8C451F7A} - System32\Tasks\AMD Updater => C:\Program Files\AMD\CIM\\Bin64\InstallManagerApp.exe [2016-03-21] (Advanced Micro Devices, Inc.)
Task: {A4B91F6D-A77E-4DAB-8560-61936A23A7A0} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2014-04-27] ()
Task: {BAB01F67-5B4D-4A17-A278-EF2F891421EF} - System32\Tasks\{5F249D1A-CC86-4050-B11F-83AA7BDD899C} => pcalua.exe -a "C:\Program Files (x86)\MEDIA\J River\Media Center 20\JRMediaUninstall.exe"
Task: {C1FF5D48-F733-4ECC-93E3-8B1D074696A2} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {C3FCC4B9-83A4-4BD6-9CE2-174507BC7BF2} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {D13B3553-10D4-4FA2-AE46-65D79D3EAC09} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {D34C747E-180E-4F1A-9F0F-CA6C19A587F5} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {D67E2A70-785D-4C06-8D9E-D2F731FAA70A} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {DA09E59B-8D19-43B4-875C-180E00629472} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {DD8F59FA-BA48-49B3-B464-7D4C8EC0E7A9} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {E6789695-6F35-4738-A1E6-C9FC29FFC8DD} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {EA0A1CC8-FEDF-4791-835E-A6BD3198AAE6} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {ECB468E5-7554-42EB-A098-844EBC67B32A} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
Task: {F5374453-E69F-4524-89C9-B24283140AEA} - System32\Tasks\X-Rite Device Services Software Updater => C:\Program Files (x86)\X-Rite\Devices\Services\XRD Software Update.exe [2014-04-10] (X-Rite Inc.)
Task: {F5981F8D-1F0E-4E11-A5CE-9E90D2E403DF} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {FA8175CD-55C9-4111-ABA1-81C370E14534} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {FBDF6082-8787-44AA-BA9A-742956FDB3F6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\SYSTEM\CCleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)
Task: {FC385301-2EB5-410A-ACAD-C0AF80FA5164} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\X-Rite Device Services Software Updater.job => C:\Program Files (x86)\X-Rite\Devices\Services\XRD Software Update.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2015-10-16 15:14 - 2014-11-25 13:16 - 00022528 _____ () C:\WINDOWS\System32\us002lm.dll
2015-12-14 14:36 - 2015-03-12 04:43 - 00022528 _____ () C:\WINDOWS\System32\us003lm.dll
2015-10-16 15:14 - 2014-11-25 13:16 - 00022528 _____ () C:\WINDOWS\System32\us005lm.dll
2014-12-13 16:57 - 2014-11-06 16:35 - 00020240 _____ () C:\WINDOWS\system32\spool\PRTPROCS\x64\TeamViewer_PrintProcessor.dll
2016-01-01 04:12 - 2016-05-15 11:51 - 00417480 _____ () C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
2015-12-14 14:35 - 2015-12-05 13:02 - 00491328 ____N () C:\WINDOWS\SysWOW64\spdsvc.exe
2015-10-16 15:14 - 2015-12-14 14:36 - 00143664 ____N () C:\Windows\SysWOW64\SecUPDUtilSvc.exe
2015-10-30 09:18 - 2015-10-30 09:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-04-12 21:00 - 2016-03-29 12:20 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-04-12 21:00 - 2016-03-29 12:20 - 02656952 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-05-20 17:33 - 2016-05-20 17:33 - 00959168 _____ () C:\Users\Home\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\ClientTelemetry.dll
2015-12-09 00:22 - 2012-01-20 15:55 - 00678400 _____ () C:\Program Files\SYSTEM\TeraCopy\TeraCopyExt64.dll
2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\MISC\Notepad++\NppShell_06.dll
2016-05-11 10:06 - 2016-04-23 05:58 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-04-19 17:31 - 2016-04-19 17:31 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2015-12-17 22:44 - 2015-12-07 06:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-05-11 10:06 - 2016-04-23 06:25 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-05-11 10:06 - 2016-04-23 06:02 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-05-11 10:06 - 2016-04-23 05:58 - 00936960 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-05-11 10:07 - 2016-04-23 05:58 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-05-11 10:07 - 2016-04-23 06:01 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-06-25 17:34 - 2015-06-25 17:34 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick.2\qtquick2plugin.dll
2015-06-25 17:37 - 2015-06-25 17:37 - 00739840 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-06-25 17:35 - 2015-06-25 17:35 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Window.2\windowplugin.dll
2015-06-25 17:38 - 2015-06-25 17:38 - 00071168 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-06-25 16:53 - 2015-06-25 16:53 - 00011776 _____ () C:\Program Files\AMD\CNext\CNext\libEGL.dll
2015-06-25 16:51 - 2015-06-25 16:51 - 02013696 _____ () C:\Program Files\AMD\CNext\CNext\libGLESv2.dll
2014-04-30 21:13 - 2012-11-08 20:17 - 01717872 _____ () C:\Program Files\MISC\Ditto\Ditto.exe
2014-09-24 14:16 - 2014-06-18 15:58 - 02218496 _____ () C:\Program Files (x86)\HARDWARE\ColorMunki Display\ColorMunkiDisplayTray.exe
2016-05-10 17:34 - 2016-03-28 17:37 - 00075264 _____ () C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
2014-09-08 14:39 - 2014-09-08 14:39 - 00464608 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2016-05-13 16:27 - 2016-05-13 16:27 - 26774720 _____ () C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll
2015-10-16 15:15 - 2015-06-11 13:42 - 03055616 ____N () C:\WINDOWS\system32\DlgSearchEngine.dll
2013-06-21 14:29 - 2013-06-21 14:29 - 01588224 _____ () C:\Program Files (x86)\X-Rite\Devices\rm200\GoldenEye.dll
2013-06-21 14:29 - 2013-06-21 14:29 - 02633728 _____ () C:\Program Files (x86)\X-Rite\Devices\colormunki\colormunki.dll
2015-09-23 02:24 - 2015-09-23 02:24 - 00035792 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2015-09-23 02:25 - 2015-09-23 02:25 - 00445904 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2015-09-23 02:24 - 2015-09-23 02:24 - 00115664 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\EXPAT.dll
2016-04-19 17:31 - 2016-04-19 17:31 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-04-19 17:31 - 2016-04-19 17:31 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2016-05-20 17:33 - 2016-05-20 17:33 - 00679624 _____ () C:\Users\Home\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\ClientTelemetry.dll
2014-09-24 14:16 - 2014-06-18 14:12 - 44451328 _____ () C:\Program Files (x86)\HARDWARE\ColorMunki Display\Prism.dll
2014-09-24 14:16 - 2010-06-01 23:44 - 07982592 _____ () C:\Program Files (x86)\HARDWARE\ColorMunki Display\QtGui4.dll
2014-09-24 14:16 - 2010-12-14 13:25 - 02147328 _____ () C:\Program Files (x86)\HARDWARE\ColorMunki Display\QtCore4.dll
2014-09-24 14:16 - 2014-06-18 14:12 - 03449344 _____ () C:\Program Files (x86)\HARDWARE\ColorMunki Display\CxF2_VC90MD_2.1.dll
2014-09-24 14:16 - 2014-06-18 14:12 - 00898560 _____ () C:\Program Files (x86)\HARDWARE\ColorMunki Display\libxml2.dll
2014-09-24 14:16 - 2014-06-18 14:12 - 00073728 _____ () C:\Program Files (x86)\HARDWARE\ColorMunki Display\zlib1.dll
2014-09-24 14:16 - 2010-10-28 18:17 - 00131072 _____ () C:\Program Files (x86)\HARDWARE\ColorMunki Display\imageformats\qjpeg4.dll
2014-09-24 14:16 - 2010-10-28 18:17 - 00278528 _____ () C:\Program Files (x86)\HARDWARE\ColorMunki Display\imageformats\qtiff4.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\PACE:FA1A7ACF0B08DE62 [217]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE trusted site: HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\atos.net -> hxxp://*.aw.atos.net
IE trusted site: HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\atosorigin.com -> hxxp://*.aw.atosorigin.com
IE trusted site: HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\geoportail.fr -> hxxp://geoportail.fr
IE trusted site: HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\gouv.fr -> hxxp://*.geoportail.gouv.fr
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2015-11-29 16:50 - 00001268 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
127.0.0.1 na1r.services.adobe.com
127.0.0.1 hlrcv.stage.adobe.com
127.0.0.1 lmlicenses.wip4.adobe.com
127.0.0.1 lm.licenses.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 lmlicenses.wip4.adobe.com
127.0.0.1 lm.licenses.adobe.com
127.0.0.1 na1r.services.adobe.com
127.0.0.1 hlrcv.stage.adobe.com
127.0.0.1 activation.acronis.com
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Home\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{f65e9e69-d2ef-49a2-a4a3-3e27b256ddff}.jpg
DNS Servers: [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Avid Editor Service Manager.lnk => C:\Windows\pss\Avid Editor Service Manager.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ColorMunki Display Tray.lnk => C:\Windows\pss\ColorMunki Display Tray.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Planner Reminder.lnk => C:\Windows\pss\Event Planner Reminder.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TotalMedia Server.lnk => C:\Windows\pss\TotalMedia Server.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinTV Recording Status..lnk => C:\Windows\pss\WinTV Recording Status..lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^XRGamma.lnk => C:\Windows\pss\XRGamma.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Home^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EOS Utility.lnk => C:\Windows\pss\EOS Utility.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Home^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LegacyCarbon-OFFICIAL-18.11.13.zip.lnk => C:\Windows\pss\LegacyCarbon-OFFICIAL-18.11.13.zip.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Home^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MEGAsync.lnk => C:\Windows\pss\MEGAsync.lnk.Startup
MSCONFIG\startupreg: Acrobat Assistant 8.0 => "C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe"
MSCONFIG\startupreg: AddressBookReminderApp => C:\Program Files (x86)\MISC\Creative Home\Hallmark Card Studio 2015 Deluxe\ReminderApp.exe
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCEPServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: BoxSync => "C:\Program Files\Box\Box Sync\BoxSync.exe" -m
MSCONFIG\startupreg: BrStsWnd => C:\Program Files (x86)\Brownie\BrstsW64.exe Autorun
MSCONFIG\startupreg: Google Update => "C:\Users\Home\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: LWS => C:\Program Files (x86)\HARDWARE\Logitech\LWS\Webcam Software\LWS.exe -hide
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Raptr => "C:\Program Files (x86)\Raptr\raptrstub.exe" –startup
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: STUISpeedLauncher => "C:\Program Files\Samsung\Stylish UI Pack\TouchBasedUI.exe" -speedlauncher -minVer:6.6.58.0
HKLM\…\StartupApproved\Run: => "Acronis Scheduler2 Service"
HKLM\…\StartupApproved\Run: => "CDAServer"
HKLM\…\StartupApproved\Run32: => "AcronisTibMounterMonitor"
HKLM\…\StartupApproved\Run32: => "TrueImageMonitor.exe"
HKLM\…\StartupApproved\Run32: => "Adobe ARM"
HKLM\…\StartupApproved\Run32: => "LWS"
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\StartupApproved\Run: => "Xmarks"
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-186901184-3626248880-2543553819-1000\…\StartupApproved\Run: => "Skype"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{32841414-E681-44C3-8A4A-7117FBBF1C77}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe
FirewallRules: [{8FAB2424-CC3A-496F-AF5D-055E7AD772F0}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [UDP Query User{15A4FFEB-1AE9-48AB-A8EE-3B03F1B05CCD}C:\program files (x86)\origin games\fifa 16\fifa16.exe] => (Allow) C:\program files (x86)\origin games\fifa 16\fifa16.exe
FirewallRules: [TCP Query User{B86BD128-6F92-437C-932F-F5D2C65D68C3}C:\program files (x86)\origin games\fifa 16\fifa16.exe] => (Allow) C:\program files (x86)\origin games\fifa 16\fifa16.exe
FirewallRules: [UDP Query User{14741351-05E9-4A12-83B3-141E92017BA0}C:\program files (x86)\samsung\easy printer manager\easyprintermanagerv2.exe] => (Allow) C:\program files (x86)\samsung\easy printer manager\easyprintermanagerv2.exe
FirewallRules: [TCP Query User{E92AF1A5-8430-41E4-A0A3-B4BE68A7BD9E}C:\program files (x86)\samsung\easy printer manager\easyprintermanagerv2.exe] => (Allow) C:\program files (x86)\samsung\easy printer manager\easyprintermanagerv2.exe
FirewallRules: [{5D5A6A93-38F2-4DE0-871C-92FA809D1C24}] => (Block) D:\Games\PC\Installed\Pro Evolution Soccer 2016\PES2016.exe
FirewallRules: [{69B74A64-ABED-4405-A67F-AF59D95A5D61}] => (Block) D:\Games\PC\Installed\Pro Evolution Soccer 2016\PES2016.exe
FirewallRules: [UDP Query User{2AA90412-B82F-4F12-A426-6E2DD8CB5029}C:\ea sports\mvp baseball 2005\mvp2005.exe] => (Allow) C:\ea sports\mvp baseball 2005\mvp2005.exe
FirewallRules: [TCP Query User{7C4FD068-DD53-477E-8188-178521A8D5FE}C:\ea sports\mvp baseball 2005\mvp2005.exe] => (Allow) C:\ea sports\mvp baseball 2005\mvp2005.exe
FirewallRules: [{E8EA1F12-18F3-4505-B497-4A080460F710}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{5B573409-CE76-4B1E-ACAC-5803D118FDC2}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{D268D631-BC59-4315-A167-53FD9DDAFC31}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Printer Center\SamsungPrinterCenter.exe
FirewallRules: [UDP Query User{EA124E25-EA1C-49A0-B254-5F8D5FA6A282}D:\games\pc\installed\pro evolution soccer 2016\pes2016.exe] => (Block) D:\games\pc\installed\pro evolution soccer 2016\pes2016.exe
FirewallRules: [TCP Query User{C0126271-D02B-4C70-A81D-4032F2CCDE12}D:\games\pc\installed\pro evolution soccer 2016\pes2016.exe] => (Block) D:\games\pc\installed\pro evolution soccer 2016\pes2016.exe
FirewallRules: [{161C1C30-2593-42FD-BE80-6CDB778E36FF}] => (Allow) C:\Program Files (x86)\GAMES\2K Sports\Major League Baseball 2K12\mlb2k12.exe
FirewallRules: [{9AE6BC6F-01F0-4BFE-B600-088031E83ACE}] => (Allow) C:\Program Files (x86)\GAMES\2K Sports\Major League Baseball 2K12\mlb2k12.exe
FirewallRules: [{BE1000FE-B977-42BA-8209-4E8389A712BF}] => (Allow) D:\Games\PC\Installed\Assassins Creed\AssassinsCreed_Launcher.exe
FirewallRules: [{90C5F1AE-1133-4943-BE67-1543A15A66EC}] => (Allow) D:\Games\PC\Installed\Assassins Creed\AssassinsCreed_Launcher.exe
FirewallRules: [{2FD697A3-8129-4195-B65C-076FB38CA14D}] => (Allow) D:\Games\PC\Installed\Assassins Creed\AssassinsCreed_Dx10.exe
FirewallRules: [{EDE910A9-04DA-4D01-8051-E93A731411FA}] => (Allow) D:\Games\PC\Installed\Assassins Creed\AssassinsCreed_Dx10.exe
FirewallRules: [{BDB0ABC5-69C6-4D70-B31C-637DF4C56872}] => (Allow) D:\Games\PC\Installed\Assassins Creed\AssassinsCreed_Dx9.exe
FirewallRules: [{04B678E8-CEC2-4BF7-B8A8-A1C15CA52056}] => (Allow) D:\Games\PC\Installed\Assassins Creed\AssassinsCreed_Dx9.exe
FirewallRules: [{A678603F-C9BB-47BE-96EF-5ED94D41D809}] => (Allow) C:\Users\Home\AppData\Local\Hola\firefox\app\hola_plugin.exe
FirewallRules: [{B377B5DB-BA7A-4660-A2CE-A14DCB2CE9E0}] => (Allow) C:\Users\Home\AppData\Local\Hola\firefox\app\hola_plugin.exe
FirewallRules: [UDP Query User{E95B45F5-B2EE-42A2-9F40-5D82DBA69F50}C:\program files (x86)\games\the vanishing of ethan carter\binaries\win64\astronautsgame-win64-shipping.exe] => (Block) C:\program files (x86)\games\the vanishing of ethan carter\binaries\win64\astronautsgame-win64-shipping.exe
FirewallRules: [TCP Query User{33A042E5-2AC7-468E-974C-B625BBF17BC8}C:\program files (x86)\games\the vanishing of ethan carter\binaries\win64\astronautsgame-win64-shipping.exe] => (Block) C:\program files (x86)\games\the vanishing of ethan carter\binaries\win64\astronautsgame-win64-shipping.exe
FirewallRules: [UDP Query User{1ED0AFC5-57D3-4213-B962-EE6F7888C8BA}D:\games\pc\installed\fifa 15\fifa15.exe] => (Block) D:\games\pc\installed\fifa 15\fifa15.exe
FirewallRules: [TCP Query User{04E90A88-CC8C-46CD-AED8-7FE2F6C1FF11}D:\games\pc\installed\fifa 15\fifa15.exe] => (Block) D:\games\pc\installed\fifa 15\fifa15.exe
FirewallRules: [{E84CEA8C-2EE7-4A68-A92E-85FE91DCA9A9}] => (Allow) C:\Users\Home\AppData\Local\Hola\firefox\app\hola_plugin.exe
FirewallRules: [{9CCBD4C5-DD36-4B6B-B8E9-E03289B8BEDE}] => (Allow) C:\Users\Home\AppData\Local\Hola\firefox\app\hola_plugin.exe
FirewallRules: [{DF320EB2-5CDF-4AE3-A8A3-01348DBEA0C2}] => (Allow) C:\Program Files (x86)\SkypeWebPlugin\3.2.0.23388\SkypeWebPlugin.exe
FirewallRules: [UDP Query User{39E37FF8-35E3-467D-ADA6-532F32FC3008}C:\program files\media\comicrack\comicrack.exe] => (Block) C:\program files\media\comicrack\comicrack.exe
FirewallRules: [TCP Query User{44AA7B76-FA2C-425D-AEAC-7FB4F5BFE566}C:\program files\media\comicrack\comicrack.exe] => (Block) C:\program files\media\comicrack\comicrack.exe
FirewallRules: [UDP Query User{9C5E44CD-DECA-4105-BB71-65742C17F83F}D:\games\pc\installed\fifa 15\fifa15.exe] => (Block) D:\games\pc\installed\fifa 15\fifa15.exe
FirewallRules: [TCP Query User{D5BD48B7-E39A-4AF2-94A1-9040B47663C6}D:\games\pc\installed\fifa 15\fifa15.exe] => (Block) D:\games\pc\installed\fifa 15\fifa15.exe
FirewallRules: [{6C96AA41-104F-43AB-8DB7-E995647D6C6E}] => (Allow) C:\Program Files (x86)\WEB\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{53D1211C-EB8B-4718-BBE8-61E9BD93F361}] => (Allow) C:\Program Files (x86)\WEB\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{CA4DD613-1D88-4460-8697-32E5DE054B49}] => (Allow) C:\Program Files (x86)\WEB\TeamViewer\TeamViewer.exe
FirewallRules: [{AD394874-116B-4172-8141-DE66F37FE0C8}] => (Allow) C:\Program Files (x86)\WEB\TeamViewer\TeamViewer.exe
FirewallRules: [{5B62AAD9-9619-4652-A398-1F7876B9FAE3}] => (Block) D:\Games\PC\Installed\Assassins Creed Unity\ACU.exe
FirewallRules: [{492D8BD7-4031-40B3-ACB8-940DBF2B1911}] => (Block) D:\Games\PC\Installed\Assassins Creed Unity\ACU.exe
FirewallRules: [UDP Query User{612718D6-52D1-40F8-B571-814E241F71F7}C:\program files\media\comicrack\comicrack.exe] => (Allow) C:\program files\media\comicrack\comicrack.exe
FirewallRules: [TCP Query User{97F3B34B-FFBB-46B2-A22B-4ABA717F494E}C:\program files\media\comicrack\comicrack.exe] => (Allow) C:\program files\media\comicrack\comicrack.exe
FirewallRules: [{B5E18B2D-CE50-4488-8495-E391441646B3}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{6941FBB9-F783-4B46-A900-6C3BA817F8FE}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{45D534A0-89F4-44DF-8C7B-631953C4DEAB}] => (Allow) C:\Users\Home\AppData\Local\Hola\firefox\app\hola_plugin.exe
FirewallRules: [UDP Query User{7F194A3B-E81D-4F33-8F70-241A525F7BE1}C:\program files (x86)\web\portforward\port forward network utilities\pfportchecker.exe] => (Allow) C:\program files (x86)\web\portforward\port forward network utilities\pfportchecker.exe
FirewallRules: [TCP Query User{2462F09E-31F5-4E8A-9D22-1702F978153D}C:\program files (x86)\web\portforward\port forward network utilities\pfportchecker.exe] => (Allow) C:\program files (x86)\web\portforward\port forward network utilities\pfportchecker.exe
FirewallRules: [{D104F245-A140-456A-A3CB-FD0B3FB7F46F}] => (Block) %ProgramFiles%\Adobe\Adobe Premiere Pro CC 2014\Adobe Premiere Pro.exe
FirewallRules: [{74D701D6-9A8A-4578-A7E4-29F47FE564E5}] => (Block) %ProgramFiles%\Adobe\Adobe Premiere Pro CC 2014\Adobe Premiere Pro.exe
FirewallRules: [{F06CE687-1FAB-44D6-A527-2FB63E8EC6AE}] => (Block) %ProgramFiles%\Adobe\Adobe Photoshop Lightroom 5\lightroom.exe
FirewallRules: [{49F63222-9417-4140-9981-DD9E07FD87DE}] => (Block) %ProgramFiles%\Adobe\Adobe Photoshop Lightroom 5\lightroom.exe
FirewallRules: [{02CE8832-2843-40BC-A641-B72377230537}] => (Block) %ProgramFiles%\Adobe\Adobe Media Encoder CC 2014\Adobe Media Encoder.exe
FirewallRules: [{EB9DC73A-2EEC-486C-843D-30C40EC12870}] => (Block) %ProgramFiles%\Adobe\Adobe Media Encoder CC 2014\Adobe Media Encoder.exe
FirewallRules: [{CFDF38FA-F290-4C6B-9513-1BED4F577BB3}] => (Block) %ProgramFiles%\Adobe\Adobe Premiere Pro CC 2014\Adobe Premiere Pro.exe
FirewallRules: [{BCC977A8-F7FA-4D70-BBAD-E0A117ECD883}] => (Block) %ProgramFiles%\Adobe\Adobe Premiere Pro CC 2014\Adobe Premiere Pro.exe
FirewallRules: [UDP Query User{8AD9C2FE-6116-4EAA-BD21-6A0C7B1AEFAD}C:\program files (x86)\web\utorrent\utorrent.exe] => (Allow) C:\program files (x86)\web\utorrent\utorrent.exe
FirewallRules: [TCP Query User{CACAC4C3-8190-4526-B899-368AE059D3C5}C:\program files (x86)\web\utorrent\utorrent.exe] => (Allow) C:\program files (x86)\web\utorrent\utorrent.exe
FirewallRules: [{7CBF2B82-443A-460C-AD51-D3B27169FAA8}] => (Block) %ProgramFiles% (x86)\MEDIA\Xilisoft\DVD Creator 6\dvdcreator.exe
FirewallRules: [{9725FE34-7DF7-44C6-A535-9F77040641AF}] => (Block) %ProgramFiles%\Avid\Avid Media Composer\AvidMediaComposer.exe
FirewallRules: [{1A764AD8-D4D7-43AE-AD89-E2301B90A677}] => (Block) %ProgramFiles%\Avid\Avid Media Composer\AvidMediaComposer.exe
FirewallRules: [{B2C91F01-7817-42CD-A732-3377EE90C8B9}] => (Allow) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
FirewallRules: [{A4B65891-64A2-48BD-AB2A-E79E4EFE0C77}] => (Allow) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
FirewallRules: [{BA738E90-6E11-486F-AE61-5B4AA0C1A8A2}] => (Allow) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
FirewallRules: [{D0C1298A-53E6-4A4E-963D-D6E8BF6EB0E4}] => (Allow) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
FirewallRules: [UDP Query User{E6523757-77D1-4E16-BCB4-EA8BED391ECA}C:\program files (x86)\web\mirc\mirc.exe] => (Allow) C:\program files (x86)\web\mirc\mirc.exe
FirewallRules: [TCP Query User{1984E9F8-6948-4C06-8D9F-1CA245CED026}C:\program files (x86)\web\mirc\mirc.exe] => (Allow) C:\program files (x86)\web\mirc\mirc.exe
FirewallRules: [UDP Query User{0EE83959-B746-4B9A-9D2A-B3CCD1823FFD}D:\apps\web\ggn-mirc\mirc\mirc.exe] => (Allow) D:\apps\web\ggn-mirc\mirc\mirc.exe
FirewallRules: [TCP Query User{CC1B279B-F66C-44D5-9B66-F0B88BD88855}D:\apps\web\ggn-mirc\mirc\mirc.exe] => (Allow) D:\apps\web\ggn-mirc\mirc\mirc.exe
FirewallRules: [{03C71379-028E-45C7-AB00-56354EF2B16E}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [UDP Query User{F45C996F-423B-4C54-BE0E-B33F04DE3517}C:\program files (x86)\system\filezilla ftp client\filezilla.exe] => (Allow) C:\program files (x86)\system\filezilla ftp client\filezilla.exe
FirewallRules: [TCP Query User{D0CF521F-3D82-4E89-868A-8CA0CE631076}C:\program files (x86)\system\filezilla ftp client\filezilla.exe] => (Allow) C:\program files (x86)\system\filezilla ftp client\filezilla.exe
FirewallRules: [UDP Query User{CC2FD3FB-7C6A-4D06-B7EA-B073BAEA453B}C:\program files\misc\ditto\ditto.exe] => (Block) C:\program files\misc\ditto\ditto.exe
FirewallRules: [TCP Query User{BA663F7C-D98C-4EF2-BC88-CA18C8DEC3F9}C:\program files\misc\ditto\ditto.exe] => (Block) C:\program files\misc\ditto\ditto.exe
FirewallRules: [UDP Query User{5CA29E91-F0FE-4B76-847A-EA4ECEC1C6A7}C:\program files\misc\ditto\ditto.exe] => (Allow) C:\program files\misc\ditto\ditto.exe
FirewallRules: [TCP Query User{66F62930-6FBA-4488-9AE4-4059E599E9FA}C:\program files\misc\ditto\ditto.exe] => (Allow) C:\program files\misc\ditto\ditto.exe
FirewallRules: [{6E2B6549-48FC-4638-A6C5-3849200E4BCD}] => (Block) %ProgramFiles% (x86)\Adobe\Adobe Photoshop CC\Photoshop.exe
FirewallRules: [{1EF94D41-AC13-411C-92A4-F5DB517FE1F3}] => (Block) %ProgramFiles% (x86)\Adobe\Adobe Photoshop CC\Photoshop.exe
FirewallRules: [{1DD3723C-5BB4-4A29-B8ED-7F14E43985BB}] => (Block) %ProgramFiles% (x86)\AUDIO\Sony\Sound Forge Pro 11.0\Forge110.exe
FirewallRules: [UDP Query User{F83F9F0C-0EDF-40C3-B6DF-46EA832E015A}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [TCP Query User{C0DA23E6-1579-4FED-992C-D371FD746455}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [TCP Query User{D628844A-0E8C-4FAF-BD5E-68C5E889D170}C:\program files (x86)\media\j river\media center 20\media center 20.exe] => (Allow) C:\program files (x86)\media\j river\media center 20\media center 20.exe
FirewallRules: [UDP Query User{E17FB799-4B02-411B-A739-4D3886BBA484}C:\program files (x86)\media\j river\media center 20\media center 20.exe] => (Allow) C:\program files (x86)\media\j river\media center 20\media center 20.exe
FirewallRules: [{0C3C4233-DEB6-4FCE-9182-4099D4FF0433}] => (Allow) LPort=5454
FirewallRules: [{8F748DEF-7B8B-4B7D-90F6-422DFC519295}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{5676F5B6-44B0-4784-A505-49553060FA3C}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{0558A376-D62A-4121-8E5A-67D784DA6C8B}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\EasyPrinterManagerV2.exe
FirewallRules: [{6137B38B-ACD0-4648-8D6B-3C1262D507DD}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\OrderSupplies.exe
FirewallRules: [{EECA27A2-8438-4884-AB19-AD3C22B9D122}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\EPM2AlertList.exe
FirewallRules: [{32DBFE17-2A17-4AB0-BB3A-923B265985A2}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\EPM2Migrator.exe
FirewallRules: [{2B420749-7AB3-4919-B708-06D21807DA12}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{331A9A34-7CEA-4EAB-AEBE-B605CA275236}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Printer Center\SamsungPrinterCenter.exe
FirewallRules: [{6E5664CC-386F-4B90-8BA3-27BFEBEFF12F}] => (Allow) C:\Program Files (x86)\Origin Games\FIFA 16\fifasetup\fifaconfig.exe
FirewallRules: [{0AC9888E-64C6-4D00-8704-5CE8E98467BD}] => (Allow) C:\Program Files (x86)\Origin Games\FIFA 16\fifasetup\fifaconfig.exe
FirewallRules: [TCP Query User{DECE2945-2756-46E0-8D4D-75728D404134}C:\program files (x86)\media\j river\media center 20\media center 20.exe] => (Allow) C:\program files (x86)\media\j river\media center 20\media center 20.exe
FirewallRules: [UDP Query User{96F87E8B-9FED-48DB-917A-43DF8B5F033F}C:\program files (x86)\media\j river\media center 20\media center 20.exe] => (Allow) C:\program files (x86)\media\j river\media center 20\media center 20.exe
FirewallRules: [TCP Query User{0FBB9C11-715F-4F6C-83C5-ED046FBCD6D2}D:\games\pc\installed\assassins creed chronicles china\binaries\win32\accgame-win32-shipping.exe] => (Block) D:\games\pc\installed\assassins creed chronicles china\binaries\win32\accgame-win32-shipping.exe
FirewallRules: [UDP Query User{02657D51-AE2E-4FF1-8BF4-3B83DF4B7F5F}D:\games\pc\installed\assassins creed chronicles china\binaries\win32\accgame-win32-shipping.exe] => (Block) D:\games\pc\installed\assassins creed chronicles china\binaries\win32\accgame-win32-shipping.exe
FirewallRules: [{CC5E0A54-30E3-435C-88BB-48EEC65C295B}] => (Allow) C:\Program Files\WEB\Mozilla Firefox\firefox.exe
FirewallRules: [{93451D3E-E779-467F-A19E-3A95B01E047A}] => (Allow) C:\Program Files\WEB\Mozilla Firefox\firefox.exe
FirewallRules: [{06E70FBE-A866-4B03-B6E3-2155074536F4}] => (Allow) C:\Program Files (x86)\MEDIA\Skype\Phone\Skype.exe
FirewallRules: [{E9091D61-5090-4FF4-856C-014340045533}] => (Block) %ProgramFiles%\MEDIA\Sony\Vegas Pro 13.0\vegas130.exe
FirewallRules: [{0D899B3B-9ED6-49E6-9269-5B5B23DEAB30}] => (Block) %ProgramFiles%\MEDIA\Sony\Vegas Pro 13.0\vegas130.exe
FirewallRules: [TCP Query User{EA8518BB-1B7E-4FD3-A5BF-5AE4E7BCE752}C:\program files (x86)\games\2k sports\major league baseball 2k12\mlb2k12.exe] => (Block) C:\program files (x86)\games\2k sports\major league baseball 2k12\mlb2k12.exe
FirewallRules: [UDP Query User{74237B38-9A24-4750-ACA3-A5FBF258CF4D}C:\program files (x86)\games\2k sports\major league baseball 2k12\mlb2k12.exe] => (Block) C:\program files (x86)\games\2k sports\major league baseball 2k12\mlb2k12.exe
FirewallRules: [{D7217F83-8E15-4E8B-884B-6283845D0886}] => (Block) D:\Games\PC\Installed\The Walking Dead Michonne Episode 1\WalkingDeadMichonne.exe
FirewallRules: [{03282700-DE3A-497E-ABCE-37A59E5D5AC1}] => (Block) D:\Games\PC\Installed\The Walking Dead Michonne Episode 1\WalkingDeadMichonne.exe
FirewallRules: [TCP Query User{2C91ADCF-5EB5-4435-A3A5-50DBB6874D58}C:\program files (x86)\origin games\fifa 16\fifa16.exe] => (Allow) C:\program files (x86)\origin games\fifa 16\fifa16.exe
FirewallRules: [UDP Query User{C87BCA0E-B297-4D47-989D-384E487F2941}C:\program files (x86)\origin games\fifa 16\fifa16.exe] => (Allow) C:\program files (x86)\origin games\fifa 16\fifa16.exe
FirewallRules: [{B3095F96-834A-405E-9864-C17CA16C86B3}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{5A75517D-E760-4346-9AED-1431A8426139}] => (Allow) LPort=21
FirewallRules: [{E8B57F74-DC73-4001-A06E-29641AF1F57F}] => (Allow) LPort=29817
==================== Restore Points =========================
11-05-2016 11:02:30 Windows Update
14-05-2016 11:53:18 Windows Update
24-05-2016 10:41:56 Scheduled Checkpoint
26-05-2016 23:27:08 Installed Hoyle Card Games.
==================== Faulty Device Manager Devices =============
Name: TeamViewer VPN Adapter
Description: TeamViewer VPN Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TeamViewer GmbH
Service: teamviewervpn
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/28/2016 10:13:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: backgroundTaskHost.exe, version: 10.0.10586.0, time stamp: 0x5632d8f0
Faulting module name: Cortana.Core.dll, version: 0.0.0.0, time stamp: 0x571af2d0
Exception code: 0xc0000005
Fault offset: 0x000000000001325d
Faulting process ID: 0x1fe8
Faulting application start time: 0xbackgroundTaskHost.exe0
Faulting application path: backgroundTaskHost.exe1
Faulting module path: backgroundTaskHost.exe2
Report ID: backgroundTaskHost.exe3
Faulting package full name: backgroundTaskHost.exe4
Faulting package-relative application ID: backgroundTaskHost.exe5
Error: (05/28/2016 03:15:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: dwm.exe, version: 10.0.10586.0, time stamp: 0x5632d756
Faulting module name: combase.dll, version: 10.0.10586.103, time stamp: 0x56a849ab
Exception code: 0xc0000005
Fault offset: 0x0000000000067e3c
Faulting process ID: 0x1b4
Faulting application start time: 0xdwm.exe0
Faulting application path: dwm.exe1
Faulting module path: dwm.exe2
Report ID: dwm.exe3
Faulting package full name: dwm.exe4
Faulting package-relative application ID: dwm.exe5
Error: (05/27/2016 03:55:01 PM) (Source: Acronis Scheduler) (EventID: 1) (User: DESKTOP)
Description: Scheduler failed to run task with GUID 'A2BB4F95-348C-4590-958E-DF518374D6D4' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).
Error: (05/27/2016 01:04:15 PM) (Source: Acronis Scheduler) (EventID: 1) (User: DESKTOP)
Description: Scheduler failed to run task with GUID 'A2BB4F95-348C-4590-958E-DF518374D6D4' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).
Error: (05/26/2016 11:27:29 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 8304. Message ID: [0x2509].
Error: (05/26/2016 11:27:09 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (05/26/2016 03:55:01 PM) (Source: Acronis Scheduler) (EventID: 1) (User: DESKTOP)
Description: Scheduler failed to run task with GUID 'A2BB4F95-348C-4590-958E-DF518374D6D4' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).
Error: (05/26/2016 03:44:22 PM) (Source: Acronis Scheduler) (EventID: 1) (User: DESKTOP)
Description: Scheduler failed to run task with GUID 'A2BB4F95-348C-4590-958E-DF518374D6D4' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).
Error: (05/26/2016 12:25:12 PM) (Source: Acronis Scheduler) (EventID: 1) (User: DESKTOP)
Description: Scheduler failed to run task with GUID 'A2BB4F95-348C-4590-958E-DF518374D6D4' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).
Error: (05/26/2016 02:46:31 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: dwm.exe, version: 10.0.10586.0, time stamp: 0x5632d756
Faulting module name: combase.dll, version: 10.0.10586.103, time stamp: 0x56a849ab
Exception code: 0xc0000005
Fault offset: 0x0000000000067e3c
Faulting process ID: 0x14f8
Faulting application start time: 0xdwm.exe0
Faulting application path: dwm.exe1
Faulting module path: dwm.exe2
Report ID: dwm.exe3
Faulting package full name: dwm.exe4
Faulting package-relative application ID: dwm.exe5
System errors:
=============
Error: (05/28/2016 10:13:19 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP)
Description: NLInternal.SharedRecoActivation
Error: (05/28/2016 10:11:19 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP)
Description: NLInternal.SharedRecoActivation
Error: (05/28/2016 10:11:19 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP)
Description: NLInternal.SharedRecoActivation
Error: (05/28/2016 03:15:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Access_44e91d service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (05/28/2016 03:15:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Storage_44e91d service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (05/28/2016 03:15:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Contact Data_44e91d service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (05/28/2016 03:15:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Sync Host_44e91d service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (05/28/2016 03:14:52 AM) (Source: DCOM) (EventID: 10016) (User: DESKTOP)
Description: application-specificLocalActivation{9E175B6D-F52A-11D8-B9A5-505054503030}{9E175B9C-F52A-11D8-B9A5-505054503030}DesktopHomeS-1-5-21-186901184-3626248880-2543553819-1000LocalHost (Using LRPC)UnavailableUnavailable
Error: (05/28/2016 03:14:52 AM) (Source: DCOM) (EventID: 10016) (User: DESKTOP)
Description: application-specificLocalActivation{9E175B6D-F52A-11D8-B9A5-505054503030}{9E175B9C-F52A-11D8-B9A5-505054503030}DesktopHomeS-1-5-21-186901184-3626248880-2543553819-1000LocalHost (Using LRPC)UnavailableUnavailable
Error: (05/28/2016 03:14:51 AM) (Source: DCOM) (EventID: 10016) (User: DESKTOP)
Description: application-specificLocalActivation{9E175B6D-F52A-11D8-B9A5-505054503030}{9E175B9C-F52A-11D8-B9A5-505054503030}DesktopHomeS-1-5-21-186901184-3626248880-2543553819-1000LocalHost (Using LRPC)UnavailableUnavailable
CodeIntegrity:
===================================
Date: 2016-05-28 10:30:05.190
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-05-28 10:30:05.125
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-05-28 10:12:04.383
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-05-28 10:12:04.310
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-05-28 10:11:56.408
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-05-28 10:11:56.275
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-05-28 10:11:54.760
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-05-28 10:11:54.634
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-05-27 05:35:17.540
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-05-27 05:35:17.527
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz
Percentage of memory in use: 20%
Total physical RAM: 16367.11 MB
Available physical RAM: 13011.41 MB
Total Virtual: 32751.11 MB
Available Virtual: 29463.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.35 GB) (Free:47.41 GB) NTFS
Drive d: (Storage) (Fixed) (Total:1863.01 GB) (Free:95.41 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: DF84F0DA)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 6A5CA115)
Partition 1: (Active) - (Size=1863 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
Thank you!!