Spyware / Malware / Virus Removal

Laptop slow and downloads are suspicious

11 min read

Looking for the outcome? Ask AI

Bonetucky Topic Starter

Post #1August 27, 2016, 11:52 PM UTC

Our laptop is slow. Also, using Chrome under one of the user profiles, any download turns into an .exe extension. (i.e. download a pdf file, but it turns into and .exe) Also new tabs open in Chrome with ads by themselves.

Logs posted.

Run date: 2016-08-21 22:54:56

—————————–

22:54:56.425 OS Version: Windows x64 6.2.9200

22:54:56.425 Number of processors: 4 586 0x1001

22:54:56.425 ComputerName: HPPAVILION UserName: Shawn

22:55:00.815 Initialize success

22:55:00.825 VM: initialized successfully

22:55:00.829 VM: Amd CPU BiosDisabled

22:55:09.304 AVAST engine defs: 16082100

22:55:13.732 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000002a

22:55:13.732 Disk 0 Vendor: Hitachi_HTS547564A9E384 JEDOA50A Size: 610480MB BusType: 11

22:55:16.754 Disk 0 statistics 984/0/0 @ 3.41 MB/s

22:55:16.756 Scan stopped

22:55:56.139 Disk 0 MBR has been saved successfully to "C:\Users\Shawn\Desktop\MBR.dat"

22:55:56.141 The log file has been saved successfully to "C:\Users\Shawn\Desktop\aswMBR.txt"

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-08-2016 01

Ran by [removed] (administrator) on HPPAVILION (21-08-2016 22:57:41)

Running from C:\Users\[removed]\Desktop

[removed]

Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe

() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Google Inc.) C:\Users\Shawn\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe

(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe

(Microsoft Corporation) C:\Windows\System32\NetworkUXBroker.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1605.1582.0_x64__8wekyb3d8bbwe\Calculator.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-08-20] (IDT, Inc.)

HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3954352 2016-04-28] (Synaptics Incorporated)

HKLM-x32\…\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)

HKLM-x32\…\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [581024 2012-09-07] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\…\Run: [HP CoolSense] => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1342008 2012-09-14] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\…\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9103976 2016-08-21] (AVAST Software)

HKLM-x32\…\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [2724896 2016-06-24] (Sony Corporation)

HKU\S-1-5-21-118284328-1780918115-838920262-1002\…\Run: [EPSONCE518C (WorkForce 435)] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIHRA.EXE [232448 2011-01-21] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-118284328-1780918115-838920262-1002\…\Run: [Plex Media Server] => C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [5142664 2014-12-21] (Plex, Inc.)

HKU\S-1-5-21-118284328-1780918115-838920262-1002\…\Run: [msnmsgr] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4272840 2014-03-31] (Microsoft Corporation)

HKU\S-1-5-21-118284328-1780918115-838920262-1002\…\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2857248 2016-08-16] (Valve Corporation)

HKU\S-1-5-21-118284328-1780918115-838920262-1002\…\Run: [Google+ Auto Backup] => C:\Users\Shawn\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe [3622864 2013-12-18] (Google Inc.)

HKU\S-1-5-21-118284328-1780918115-838920262-1002\…\RunOnce: [Uninstall C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6301.0127_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6301.0127_1\amd64"

HKU\S-1-5-21-118284328-1780918115-838920262-1002\…\RunOnce: [Uninstall C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64"

HKU\S-1-5-21-118284328-1780918115-838920262-1002\…\RunOnce: [Uninstall C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6390.0509] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6390.0509"

HKU\S-1-5-18\…\Run: [EPSONCE518C (WorkForce 435)] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIHRA.EXE [232448 2011-01-21] (SEIKO EPSON CORPORATION)

ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\FileSyncShell64.dll [2016-08-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\FileSyncShell64.dll [2016-08-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\FileSyncShell64.dll [2016-08-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-08-21] (AVAST Software)

ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileSyncShell.dll [2016-08-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileSyncShell.dll [2016-08-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileSyncShell.dll [2016-08-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-07-05] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-07-05] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-07-05] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4 192.168.1.1

Tcpip\..\Interfaces\{30d7ca3c-745c-4ace-a895-99e287fac3c1}: [DhcpNameServer] 8.8.8.8 8.8.4.4 192.168.1.1

Tcpip\..\Interfaces\{bbdbd99e-294b-44f2-9b69-012c12a96a34}: [DhcpNameServer] 8.8.8.8 8.8.4.4 192.168.1.1

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT13/1

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT13/1

HKU\S-1-5-21-118284328-1780918115-838920262-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?trackid=sp-006

HKU\S-1-5-21-118284328-1780918115-838920262-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT13/1

HKU\S-1-5-21-118284328-1780918115-838920262-1002\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/HPNOT13/1

SearchScopes: HKLM -> {D4984F4F-3C48-4A61-8F8F-04A310FFA22E} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKLM-x32 -> {D4984F4F-3C48-4A61-8F8F-04A310FFA22E} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKU\S-1-5-21-118284328-1780918115-838920262-1002 -> {D4984F4F-3C48-4A61-8F8F-04A310FFA22E} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKU\S-1-5-21-118284328-1780918115-838920262-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-07-12] (Microsoft Corporation)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2015-06-14] (Oracle Corporation)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-07-05] (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2015-06-14] (Oracle Corporation)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2016-07-12] (Microsoft Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-07-05] (Microsoft Corporation)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)

Toolbar: HKU\S-1-5-21-118284328-1780918115-838920262-1002 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-04-19] (Microsoft Corporation)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)

FireFox:

========

FF ProfilePath: C:\Users\Shawn\AppData\Roaming\Mozilla\Firefox\Profiles\41runi87.default

FF Plugin: @java.com/DTPlugin,version=10.79.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-06-14] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.79.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2015-06-14] (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll [2012-08-08] (Adobe Systems, Inc.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2013-12-18] (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-28] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-28] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-12] (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-02-06] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)

FF Extension: Skype - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-05-25]

FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-08-21]

FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF

FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-08-21]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF

Chrome:

=======

CHR HomePage: Default -> hxxp://www.search.ask.com/?gct=hp

CHR DefaultSearchURL: Default -> hxxp://www.search.ask.com/web?q={searchTerms}

CHR DefaultSearchKeyword: Default -> search.ask.com

CHR DefaultSuggestURL: Default -> hxxp://ssmsp.ask.com/query?sstype=prefix&li=ff&q={searchTerms}

CHR Profile: C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-03]

CHR Extension: (Google Docs) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-03]

CHR Extension: (Google Drive) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-01]

CHR Extension: (YouTube) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-02]

CHR Extension: (Google Cast) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2016-05-21]

CHR Extension: (Google Search) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-01]

CHR Extension: (Avast SafePrice) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2016-08-21]

CHR Extension: (Google Sheets) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-03]

CHR Extension: (Google Docs Offline) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-21]

CHR Extension: (Skype) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2016-06-05]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-05-21]

CHR Extension: (Gmail) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]

CHR Extension: (Chrome Media Router) - C:\Users\Shawn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-21]

CHR HKLM-x32\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx

CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx

CHR HKLM-x32\…\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-05-25]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-08-21] (AVAST Software)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1364096 2016-05-25] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1687680 2016-05-25] (Microsoft Corporation)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3189488 2016-07-05] (Microsoft Corporation)

S2 HPConnectedRemote; C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35744 2012-10-12] (Hewlett-Packard)

R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]

R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [506912 2016-06-24] (Sony Corporation)

S3 vmicvss; C:\Windows\System32\ICSvc.dll [511488 2015-10-30] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-06-30] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-08-21] (AVAST Software)

R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-08-21] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108816 2016-08-21] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-08-21] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-08-21] (AVAST Software)

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [969560 2016-08-21] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [513496 2016-08-21] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [163416 2016-08-21] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [292704 2016-08-21] (AVAST Software)

R3 athr; C:\Windows\System32\drivers\athw10x.sys [4318760 2015-08-28] (Qualcomm Atheros Communications, Inc.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-05-28] (Advanced Micro Devices)

S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [130688 2016-07-22] (Samsung Electronics Co., Ltd.)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [310528 2015-06-05] (Realtek Semiconductor Corp.)

R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek )

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-08-24] (Synaptics Incorporated)

S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [43832 2012-08-24] (Synaptics Incorporated)

S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [221824 2016-04-25] (Samsung Electronics Co., Ltd.)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)

U3 aswMBR; C:\Users\Shawn\AppData\Local\Temp\aswMBR.sys [62728 2016-08-21] () [File not signed]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-21 22:57 - 2016-08-21 22:58 - 00025185 _____ C:\Users\Shawn\Desktop\FRST.txt

2016-08-21 22:57 - 2016-08-21 22:57 - 00000000 ____D C:\FRST

2016-08-21 22:55 - 2016-08-21 22:55 - 00000896 _____ C:\Users\Shawn\Desktop\aswMBR.txt

2016-08-21 22:55 - 2016-08-21 22:55 - 00000512 _____ C:\Users\Shawn\Desktop\MBR.dat

2016-08-21 22:51 - 2016-08-21 22:56 - 02396672 _____ (Farbar) C:\Users\Shawn\Desktop\FRST64.exe

2016-08-21 21:44 - 2016-08-21 22:52 - 05198336 _____ (AVAST Software) C:\Users\Shawn\Desktop\aswMBR.exe

2016-08-21 21:24 - 2016-08-21 21:24 - 00391496 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe

2016-08-21 21:23 - 2016-08-21 21:23 - 00053208 _____ (AVAST Software) C:\WINDOWS\avastSS.scr

2016-08-21 21:15 - 2016-08-21 21:15 - 00000000 ___HD C:\OneDriveTemp

2016-08-17 21:51 - 2016-08-21 21:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2016-08-17 20:41 - 2016-08-17 20:41 - 00003328 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task

2016-08-17 20:40 - 2016-08-17 20:40 - 00000000 ____D C:\Users\Evan\AppData\Roaming\Skype

2016-08-17 20:17 - 2016-08-17 20:17 - 00976664 _____ (Cotifaramo ) C:\Users\Evan\Downloads\FSA_CLAIM_FORM_St_Iowa_0875195961.exe

2016-08-17 20:13 - 2016-08-17 20:13 - 00001327 _____ C:\Users\Evan\Desktop\Continue FSA_CLAIM_FORM_St_Iowa.pdf Installation.lnk

2016-08-17 20:11 - 2016-08-17 20:12 - 00976664 _____ (Cotifaramo ) C:\Users\Evan\Downloads\FSA_CLAIM_FORM_St_Iowa_2847602076.exe

2016-08-10 11:19 - 2016-08-03 05:36 - 07469408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2016-08-10 11:19 - 2016-08-03 05:36 - 00099680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys

2016-08-10 11:19 - 2016-08-03 05:30 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2016-08-10 11:19 - 2016-08-03 05:23 - 00693600 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll

2016-08-10 11:19 - 2016-08-03 05:23 - 00115040 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll

2016-08-10 11:19 - 2016-08-03 05:22 - 00808288 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe

2016-08-10 11:19 - 2016-08-03 05:22 - 00465248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys

2016-08-10 11:19 - 2016-08-03 05:22 - 00331616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys

2016-08-10 11:19 - 2016-08-03 05:21 - 03675512 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2016-08-10 11:19 - 2016-08-03 05:21 - 00566112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe

2016-08-10 11:19 - 2016-08-03 05:20 - 01540224 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2016-08-10 11:19 - 2016-08-03 05:20 - 00692136 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll

2016-08-10 11:19 - 2016-08-03 05:19 - 00604928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2016-08-10 11:19 - 2016-08-03 05:19 - 00161632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys

2016-08-10 11:19 - 2016-08-03 05:13 - 01988448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2016-08-10 11:19 - 2016-08-03 05:13 - 00576864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys

2016-08-10 11:19 - 2016-08-03 05:13 - 00393056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2016-08-10 11:19 - 2016-08-03 04:51 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll

2016-08-10 11:19 - 2016-08-03 04:44 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe

2016-08-10 11:19 - 2016-08-03 04:44 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshbth.dll

2016-08-10 11:19 - 2016-08-03 04:44 - 00044544 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll

2016-08-10 11:19 - 2016-08-03 04:43 - 16985088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2016-08-10 11:19 - 2016-08-03 04:41 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryClient.dll

2016-08-10 11:19 - 2016-08-03 04:41 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll

2016-08-10 11:19 - 2016-08-03 04:40 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe

2016-08-10 11:19 - 2016-08-03 04:40 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll

2016-08-10 11:19 - 2016-08-03 04:39 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll

2016-08-10 11:19 - 2016-08-03 04:39 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll

2016-08-10 11:19 - 2016-08-03 04:38 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll

2016-08-10 11:19 - 2016-08-03 04:36 - 00211456 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll

2016-08-10 11:19 - 2016-08-03 04:36 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll

2016-08-10 11:19 - 2016-08-03 04:35 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFPlatform.dll

2016-08-10 11:19 - 2016-08-03 04:31 - 00247296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtutil.exe

2016-08-10 11:19 - 2016-08-03 04:30 - 00515072 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll

2016-08-10 11:19 - 2016-08-03 04:29 - 14252544 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll

2016-08-10 11:19 - 2016-08-03 04:29 - 01500160 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe

2016-08-10 11:19 - 2016-08-03 04:29 - 01387520 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2016-08-10 11:19 - 2016-08-03 04:28 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll

2016-08-10 11:19 - 2016-08-03 04:28 - 00848896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2016-08-10 11:19 - 2016-08-03 04:27 - 07536640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll

2016-08-10 11:19 - 2016-08-03 04:27 - 01717760 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll

2016-08-10 11:19 - 2016-08-03 04:18 - 06974464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll

2016-08-10 11:19 - 2016-08-03 04:18 - 01388032 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2016-08-10 11:19 - 2016-08-03 04:16 - 05123072 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll

2016-08-10 11:19 - 2016-08-03 04:16 - 03589120 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2016-08-10 11:19 - 2016-08-03 04:16 - 01732096 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2016-08-10 11:19 - 2016-08-03 04:14 - 01997824 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll

2016-08-10 11:19 - 2016-08-03 04:13 - 03025920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2016-08-10 11:19 - 2016-08-03 04:13 - 02280960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2016-08-10 11:19 - 2016-08-03 04:12 - 02746368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll

2016-08-10 11:19 - 2016-08-03 04:11 - 04171264 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll

2016-08-10 11:19 - 2016-08-03 00:52 - 00034088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll

2016-08-10 11:19 - 2016-08-03 00:34 - 00501592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll

2016-08-10 11:19 - 2016-08-03 00:34 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll

2016-08-10 11:19 - 2016-08-03 00:33 - 00051128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsNativeApi.dll

2016-08-10 11:19 - 2016-08-03 00:31 - 02921368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2016-08-10 11:19 - 2016-08-03 00:31 - 00957608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll

2016-08-10 11:19 - 2016-08-03 00:31 - 00703840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe

2016-08-10 11:19 - 2016-08-03 00:30 - 21123320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2016-08-10 11:19 - 2016-08-02 23:57 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdlrecover.exe

2016-08-10 11:19 - 2016-08-02 23:48 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wshbth.dll

2016-08-10 11:19 - 2016-08-02 23:47 - 13018112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2016-08-10 11:19 - 2016-08-02 23:44 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll

2016-08-10 11:19 - 2016-08-02 23:44 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryBroker.dll

2016-08-10 11:19 - 2016-08-02 23:42 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll

2016-08-10 11:19 - 2016-08-02 23:37 - 00219136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll

2016-08-10 11:19 - 2016-08-02 23:35 - 00178688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wevtutil.exe

2016-08-10 11:19 - 2016-08-02 23:34 - 00792064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2016-08-10 11:19 - 2016-08-02 23:32 - 12585984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll

2016-08-10 11:19 - 2016-08-02 23:32 - 00434688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll

2016-08-10 11:19 - 2016-08-02 23:31 - 06743040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll

2016-08-10 11:19 - 2016-08-02 23:31 - 00705536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2016-08-10 11:19 - 2016-08-02 23:25 - 04078080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll

2016-08-10 11:19 - 2016-08-02 23:19 - 02180096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll

2016-08-10 11:18 - 2016-08-03 06:14 - 01505984 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll

2016-08-10 11:18 - 2016-08-03 06:14 - 00092352 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2016-08-10 11:18 - 2016-08-03 06:14 - 00050368 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe

2016-08-10 11:18 - 2016-08-03 05:36 - 00037744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll

2016-08-10 11:18 - 2016-08-03 05:22 - 01322760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll

2016-08-10 11:18 - 2016-08-03 05:22 - 00058408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.dll

2016-08-10 11:18 - 2016-08-03 05:21 - 22561256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2016-08-10 11:18 - 2016-08-03 05:21 - 00303216 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe

2016-08-10 11:18 - 2016-08-03 05:11 - 00422744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys

2016-08-10 11:18 - 2016-08-03 04:51 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdlrecover.exe

2016-08-10 11:18 - 2016-08-03 04:46 - 22384128 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2016-08-10 11:18 - 2016-08-03 04:40 - 00127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll

2016-08-10 11:18 - 2016-08-03 04:40 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthserv.dll

2016-08-10 11:18 - 2016-08-03 04:38 - 00412160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll

2016-08-10 11:18 - 2016-08-03 04:37 - 00110080 _____ (Microsoft Corporation) C:\WINDOWS\system32\IdCtrls.dll

2016-08-10 11:18 - 2016-08-03 04:36 - 00221696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2016-08-10 11:18 - 2016-08-03 04:35 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll

2016-08-10 11:18 - 2016-08-03 04:34 - 00383488 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2016-08-10 11:18 - 2016-08-03 04:33 - 00339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll

2016-08-10 11:18 - 2016-08-03 04:33 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll

2016-08-10 11:18 - 2016-08-03 04:31 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll

2016-08-10 11:18 - 2016-08-03 04:31 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll

2016-08-10 11:18 - 2016-08-03 04:30 - 24613888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2016-08-10 11:18 - 2016-08-03 04:30 - 00970752 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2016-08-10 11:18 - 2016-08-03 04:29 - 02127360 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2016-08-10 11:18 - 2016-08-03 04:29 - 00784384 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2016-08-10 11:18 - 2016-08-03 04:28 - 00529920 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll

2016-08-10 11:18 - 2016-08-03 04:27 - 01752576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2016-08-10 11:18 - 2016-08-03 04:27 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll

2016-08-10 11:18 - 2016-08-03 04:20 - 13390336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2016-08-10 11:18 - 2016-08-03 04:18 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll

2016-08-10 11:18 - 2016-08-03 04:17 - 02175488 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2016-08-10 11:18 - 2016-08-03 04:16 - 02635776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll

2016-08-10 11:18 - 2016-08-03 04:15 - 07833088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2016-08-10 11:18 - 2016-08-03 04:14 - 04895232 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2016-08-10 11:18 - 2016-08-03 00:30 - 00465760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2016-08-10 11:18 - 2016-08-03 00:30 - 00255168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe

2016-08-10 11:18 - 2016-08-02 23:40 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IdCtrls.dll

2016-08-10 11:18 - 2016-08-02 23:39 - 19351040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2016-08-10 11:18 - 2016-08-02 23:37 - 00335872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2016-08-10 11:18 - 2016-08-02 23:35 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll

2016-08-10 11:18 - 2016-08-02 23:34 - 00400896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll

2016-08-10 11:18 - 2016-08-02 23:33 - 18677760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2016-08-10 11:18 - 2016-08-02 23:33 - 02050048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2016-08-10 11:18 - 2016-08-02 23:33 - 00687616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2016-08-10 11:18 - 2016-08-02 23:32 - 01526272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2016-08-10 11:18 - 2016-08-02 23:32 - 01467392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll

2016-08-10 11:18 - 2016-08-02 23:29 - 12133376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2016-08-10 11:18 - 2016-08-02 23:28 - 03663360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2016-08-10 11:18 - 2016-08-02 23:25 - 05323776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll

2016-08-10 11:18 - 2016-08-02 23:23 - 05660672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2016-08-10 11:18 - 2016-08-02 23:23 - 01799680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll

2016-08-10 11:18 - 2016-08-02 23:22 - 02501120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2016-08-10 11:18 - 2016-08-02 23:22 - 01502208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2016-08-10 11:18 - 2016-08-02 23:21 - 01708032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll

2016-08-07 20:43 - 2016-08-07 20:43 - 00976664 _____ (Cotifaramo ) C:\Users\Evan\Downloads\slither_io_download (3).exe

2016-08-07 20:35 - 2016-08-07 20:35 - 00976664 _____ (Cotifaramo ) C:\Users\Evan\Downloads\slither_io_download (2).exe

2016-08-07 20:26 - 2016-08-07 20:27 - 00976664 _____ (Cotifaramo ) C:\Users\Evan\Downloads\slither_io_download (1).exe

2016-08-03 09:00 - 2016-08-03 09:01 - 00000000 ___HD C:\$WINDOWS.~BT

2016-08-01 08:46 - 2016-08-01 08:46 - 00011138 _____ C:\Users\Evan\Downloads\SKID LOADERS.xlsx

2016-07-31 22:45 - 2016-07-31 22:45 - 00001954 _____ C:\Users\Public\Desktop\PlayMemories Home.lnk

2016-07-31 22:45 - 2016-07-31 22:45 - 00001858 _____ C:\Users\Public\Desktop\PlayMemories Home Help.lnk

2016-07-31 22:45 - 2016-07-31 22:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMemories Home

2016-07-31 22:29 - 2016-07-31 22:29 - 01676198 _____ C:\Users\Shawn\Downloads\coby_dp356.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-21 22:05 - 2015-01-24 11:33 - 00000928 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2016-08-21 21:58 - 2015-01-19 10:40 - 00004154 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DB50FEB3-2FA6-4688-9525-CE98A115D281}

2016-08-21 21:48 - 2016-06-21 13:18 - 00003246 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForShawn

2016-08-21 21:48 - 2016-06-21 13:18 - 00000354 _____ C:\WINDOWS\Tasks\HPCeeScheduleForShawn.job

2016-08-21 21:40 - 2015-12-06 16:42 - 00000000 ____D C:\Program Files (x86)\Steam

2016-08-21 21:37 - 2015-01-31 07:10 - 00000000 ___RD C:\Users\Shawn\OneDrive

2016-08-21 21:36 - 2016-05-10 15:46 - 00002403 _____ C:\Users\Shawn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2016-08-21 21:31 - 2015-03-28 12:41 - 00000000 ____D C:\Users\Shawn\Tracing

2016-08-21 21:30 - 2015-01-24 11:33 - 00000924 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2016-08-21 21:28 - 2016-02-08 18:19 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2016-08-21 21:28 - 2015-05-01 21:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2016-08-21 21:27 - 2016-02-08 18:00 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin

2016-08-21 21:27 - 2015-10-30 01:28 - 01048576 ___SH C:\WINDOWS\system32\config\BBI

2016-08-21 21:26 - 2016-07-14 08:58 - 00004010 _____ C:\WINDOWS\System32\Tasks\SafeZone scheduled Autoupdate 1468504716

2016-08-21 21:26 - 2016-07-14 08:58 - 00001088 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk

2016-08-21 21:25 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\AppReadiness

2016-08-21 21:25 - 2015-02-01 23:09 - 00004004 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update

2016-08-21 21:24 - 2015-02-01 23:09 - 00513496 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys

2016-08-21 21:24 - 2015-02-01 23:09 - 00292704 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys

2016-08-21 21:24 - 2015-02-01 23:09 - 00163416 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys

2016-08-21 21:24 - 2015-02-01 23:09 - 00108816 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys

2016-08-21 21:24 - 2015-02-01 23:09 - 00103064 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys

2016-08-21 21:24 - 2015-02-01 23:09 - 00074544 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys

2016-08-21 21:24 - 2015-02-01 23:09 - 00037656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys

2016-08-21 21:23 - 2015-02-01 23:09 - 00969560 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys

2016-08-21 21:23 - 2015-02-01 23:09 - 00037144 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys

2016-08-21 21:13 - 2013-06-03 02:42 - 00000000 __RHD C:\Users\Public\AccountPictures

2016-08-21 15:15 - 2015-05-25 19:02 - 00004152 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{C6A76705-9A22-4CFA-90A8-2A68FFFE2A6D}

2016-08-17 22:30 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\rescache

2016-08-17 20:58 - 2015-10-30 02:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2016-08-17 20:57 - 2015-02-06 14:56 - 00000000 ____D C:\Program Files\Microsoft Office 15

2016-08-17 20:41 - 2016-02-08 19:21 - 00002400 _____ C:\Users\Evan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2016-08-17 20:41 - 2016-02-08 19:21 - 00000000 ___RD C:\Users\Evan\OneDrive

2016-08-17 20:38 - 2015-10-30 02:21 - 00000000 ____D C:\WINDOWS\INF

2016-08-17 20:33 - 2015-10-30 01:28 - 00032768 ___SH C:\WINDOWS\system32\config\ELAM

2016-08-17 20:26 - 2015-10-30 04:07 - 00000000 ____D C:\Program Files\Windows Journal

2016-08-17 20:26 - 2015-10-30 02:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel

2016-08-17 20:26 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\system32\appraiser

2016-08-17 20:22 - 2016-02-03 10:42 - 00001136 _____ C:\Users\Evan\Desktop\nativelog.txt

2016-08-17 18:08 - 2015-10-30 02:24 - 00000000 ___HD C:\Program Files\WindowsApps

2016-08-13 09:00 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\system32\SecureBootUpdates

2016-08-13 09:00 - 2015-10-30 02:11 - 00000000 ____D C:\WINDOWS\CbsTemp

2016-08-13 09:00 - 2015-01-19 15:50 - 00000000 ____D C:\WINDOWS\system32\MRT

2016-08-13 08:37 - 2015-01-19 15:50 - 147640136 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2016-08-08 09:19 - 2015-01-28 19:10 - 00000000 ____D C:\Users\Evan\AppData\Roaming\.minecraft

2016-08-08 09:16 - 2014-12-30 21:07 - 00000000 ____D C:\Users\Evan\Desktop\RAR Files

2016-08-06 07:43 - 2016-02-08 17:38 - 00972168 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2016-08-05 19:07 - 2016-02-08 17:39 - 00000000 ____D C:\Users\Shawn

2016-08-05 19:07 - 2016-02-08 17:39 - 00000000 ____D C:\Users\Evan

2016-08-05 08:15 - 2016-02-08 09:21 - 00002272 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2016-08-05 08:15 - 2016-02-08 09:21 - 00002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2016-08-04 07:36 - 2015-06-05 21:20 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

2016-08-03 09:01 - 2016-02-08 19:27 - 00000000 ___DC C:\WINDOWS\Panther

2016-08-01 08:47 - 2015-01-19 14:08 - 00000000 ____D C:\Users\Evan\AppData\Local\Packages

2016-07-31 23:23 - 2016-07-13 09:41 - 00000000 ____D C:\Users\Shawn\Desktop\sidney greeting card

2016-07-31 22:16 - 2015-09-25 19:33 - 00000000 ____D C:\Users\Shawn\AppData\Roaming\Skype

2016-07-31 22:16 - 2015-09-23 19:18 - 00000000 ___RD C:\Program Files (x86)\Skype

2016-07-31 22:16 - 2015-09-23 19:18 - 00000000 ____D C:\ProgramData\Skype

2016-07-31 22:06 - 2015-03-26 11:23 - 00000000 ____D C:\ProgramData\Sony Corporation

2016-07-28 15:00 - 2015-01-24 11:33 - 00003986 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA

2016-07-28 15:00 - 2015-01-24 11:33 - 00003754 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

2016-07-22 05:51 - 2015-12-08 05:00 - 00130688 _____ (Samsung Electronics Co., Ltd.) C:\WINDOWS\system32\Drivers\ssudbus.sys

==================== Files in the root of some directories =======

2015-01-19 10:37 - 2015-01-19 10:37 - 0000141 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc

Some files in TEMP:

====================

C:\Users\Evan\AppData\Local\Temp\ICReinstall_FSA_CLAIM_FORM_St_Iowa_2847602076.exe

C:\Users\Evan\AppData\Local\Temp\ICReinstall_slither_io_download.exe

C:\Users\Evan\AppData\Local\Temp\jansi-64-2957966556280818378.dll

C:\Users\Evan\AppData\Local\Temp\jre-8u77-windows-au.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-08-21 19:34

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-08-2016 01

Ran by [removed] (21-08-2016 22:59:50)

Running from C:\Users\[removed]\Desktop

Windows 10 Home Version 1511 (X64) (2016-02-08 23:53:57)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-118284328-1780918115-838920262-500 - Administrator - Disabled) => C:\Users\Administrator

DefaultAccount (S-1-5-21-118284328-1780918115-838920262-503 - Limited - Disabled)

Evan (S-1-5-21-118284328-1780918115-838920262-1006 - Limited - Enabled) => C:\Users\Evan

Guest (S-1-5-21-118284328-1780918115-838920262-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-118284328-1780918115-838920262-1013 - Limited - Enabled)

Shawn (S-1-5-21-118284328-1780918115-838920262-1002 - Administrator - Enabled) => C:\Users\Shawn

vaneg_000 (S-1-5-21-118284328-1780918115-838920262-1005 - Limited - Enabled) => C:\Users\vaneg_000

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden

Adobe Acrobat Reader DC MUI (HKLM-x32\…\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}) (Version: 15.017.20053 - Adobe Systems Incorporated)

Adobe Shockwave Player 11.6 (HKLM-x32\…\Adobe Shockwave Player) (Version: 11.6.6.636 - Adobe Systems, Inc.)

Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden

AMD Catalyst Install Manager (HKLM\…\{8FE9C1D4-F5E4-B855-1D79-FF5D11F54A19}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.)

Avast Pro Antivirus (HKLM-x32\…\Avast) (Version: 12.3.2280 - AVAST Software)

Azteca (x32 Version: 2.2.0.97 - WildTangent) Hidden

Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Bounce Symphony (x32 Version: 2.2.0.98 - WildTangent) Hidden

Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden

CyberLink Media Suite 10 (HKLM-x32\…\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.2.2114 - CyberLink Corp.)

CyberLink PhotoDirector (HKLM-x32\…\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.2.3317 - CyberLink Corp.)

CyberLink PowerDirector 10 (HKLM-x32\…\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.2.2126 - CyberLink Corp.)

CyberLink PowerDVD (HKLM-x32\…\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.7.4528 - CyberLink Corp.)

CyberLink YouCam (HKLM-x32\…\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.5.5811 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

EaseUS Data Recovery Wizard 9.0 (HKLM\…\EaseUS Data Recovery Wizard 9.0_is1) (Version: - EaseUS)

Energy Star (HKLM-x32\…\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)

EPSON WorkForce 435 Series Printer Uninstall (HKLM\…\EPSON WorkForce 435 Series) (Version: - SEIKO EPSON Corporation)

FATE: The Cursed King (x32 Version: 2.2.0.97 - WildTangent) Hidden

Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden

Force Of Nature_Alpha3.3 (HKLM\…\UDK-36184b4a-24b5-4286-88ec-1cd89b26e380) (Version: - Epic Games, Inc.)

Garry's Mod (HKLM-x32\…\Steam App 4000) (Version: - Facepunch Studios)

Google Chrome (HKLM-x32\…\Google Chrome) (Version: 52.0.2743.116 - Google Inc.)

Google Earth (HKLM-x32\…\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden

Google+ Auto Backup (HKLM-x32\…\{D1D4D7EA-62B8-4665-9FF7-02A91B925CC9}) (Version: 1.0.18.74 - Google)

Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

Hoyle Card Games (x32 Version: 2.2.0.95 - WildTangent) Hidden

HP 3D DriveGuard (HKLM\…\{6821D775-9303-46DD-977A-2D97CA18B054}) (Version: 4.2.8.1 - Hewlett-Packard Company)

HP Connected Music (Meridian - installer) (HKLM-x32\…\StartHPConnectedMusic) (Version: v1.0 - Meridian Audio Ltd)

HP Connected Remote (HKLM-x32\…\{F243A34B-AB7F-4065-B770-B85B767C247C}) (Version: 1.0.1218 - Hewlett-Packard)

HP CoolSense (HKLM-x32\…\{8704FEEF-A6A8-4E7E-B124-BD6122C66E2C}) (Version: 2.10.42 - Hewlett-Packard Company)

HP Documentation (HKLM-x32\…\{44613B7A-527C-4E89-91FC-E611FA62806A}) (Version: 1.1.0.0 - Hewlett-Packard)

HP Games (HKLM-x32\…\WildTangent hp Master Uninstall) (Version: 1.0.3.0 - WildTangent)

HP MyRoom (HKLM-x32\…\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)

HP Quick Launch (HKLM-x32\…\{E5823036-6F09-4D0A-B05C-E2BAA129288A}) (Version: 3.0.6 - Hewlett-Packard Company)

HP Registration Service (HKLM\…\{C2E428EB-116E-41C0-9E84-B22DE9CCA42F}) (Version: 1.1.6232.4245 - Hewlett-Packard)

HP Support Assistant (HKLM-x32\…\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)

HP Utility Center (HKLM-x32\…\{0C57987A-A03A-4B95-A309-D23F78F406CA}) (Version: 1.0.8 - Hewlett-Packard)

HP Wireless Button Driver (HKLM-x32\…\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.6.1 - Hewlett-Packard Company)

Icecream Screen Recorder version 2.72 (HKLM-x32\…\{7ADEC622-3230-4C9A-9DCE-9BD462B74095}_is1) (Version: 2.72 - Icecream Apps)

IDT Audio (HKLM-x32\…\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6425.0 - IDT)

Java 7 Update 79 (64-bit) (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F06417079FF}) (Version: 7.0.790 - Oracle)

Java 8 Update 31 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

Java SE Development Kit 7 Update 79 (64-bit) (HKLM\…\{64A3A4F4-B792-11D6-A78A-00B0D0170790}) (Version: 1.7.0.790 - Oracle)

Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden

Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden

Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden

MergeModule_x64 (Version: 9.3.00 - Sony Corporation) Hidden

MergeModule_x86 (x32 Version: 9.3.00 - Sony Corporation) Hidden

Microsoft Office Professional Plus 2013 - en-us (HKLM\…\ProPlusRetail - en-us) (Version: 15.0.4849.1003 - Microsoft Corporation)

Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\…\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\…\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)

Minecraft (HKLM-x32\…\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)

Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Mozilla Firefox 43.0.1 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 43.0.1 (x86 en-US)) (Version: 43.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 43.0.1.5828 - Mozilla)

Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4849.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4849.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4849.1003 - Microsoft Corporation) Hidden

Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden

Picasa 3 (HKLM-x32\…\Picasa 3) (Version: 3.9 - Google, Inc.)

PlayMemories Home (HKLM-x32\…\{94F4815B-755A-4FFA-AFDC-EE8FE776981E}) (Version: 5.2.01.06240 - Sony Corporation)

Plex Media Server (HKLM-x32\…\{7425d872-d65d-42c9-8c6d-7a8a529a4b50}) (Version: 0.9.1107 - Plex, Inc.)

Plex Media Server (x32 Version: 0.9.1107 - Plex, Inc.) Hidden

PMB_ModeEditor (x32 Version: 9.3.00 - Sony Corporation) Hidden

PMB_ServiceUploader (x32 Version: 10.2.01 - Sony Corporation) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Polar Golfer (x32 Version: 2.2.0.98 - WildTangent) Hidden

Qualcomm Atheros Driver Installation Program (HKLM-x32\…\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)

Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)

Realtek PCIE Card Reader (HKLM-x32\…\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.29031 - Realtek Semiconductor Corp.)

Recuva (HKLM\…\Recuva) (Version: 1.52 - Piriform)

Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

SafeZone Stable 1.51.2220.53 (x32 Version: 1.51.2220.53 - Avast Software) Hidden

Search App by Ask (HKLM-x32\…\{4F524A2D-5350-4500-76A7-A758B70C1700}) (Version: 12.23.0.15 - APN, LLC) <==== ATTENTION

Skype Click to Call (HKLM-x32\…\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.3.0.9150 - Microsoft Corporation)

Skype™ 7.26 (HKLM-x32\…\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.26.101 - Skype Technologies S.A.)

Steam (HKLM-x32\…\Steam) (Version: 2.10.91.91 - Valve Corporation)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 19.0.12.98 - Synaptics Incorporated)

Terraria (HKLM-x32\…\Steam App 105600) (Version: - Re-Logic)

The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden

Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden

WebM Project Directshow Filters (HKU\S-1-5-21-118284328-1780918115-838920262-1002\…\webmdshow) (Version: 1.0.4.1 - WebM Project)

WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)

WildTangent Games App (x32 Version: 4.0.9.7 - WildTangent) Hidden

Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

WinX DVD Ripper Platinum 7.5.11 (HKLM-x32\…\WinX DVD Ripper Platinum_is1) (Version: - Digiarty Software, Inc.)

WinX HD Video Converter Deluxe 5.0.3 (HKLM-x32\…\WinX HD Video Converter Deluxe_is1) (Version: - Digiarty Software, Inc.)

Xiph.Org Open Codecs 0.85.17777 (HKLM-x32\…\Open Codecs) (Version: 0.85.17777 - Xiph.Org)

Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-118284328-1780918115-838920262-1002_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileCoAuth.exe (Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {032C6D0A-A34D-4278-9A87-A724514BBEE1} - System32\Tasks\SafeZone scheduled Autoupdate 1468504716 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-08-09] (Avast Software)

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {209E15B7-CD3B-468F-B3EB-2B0CF771F1D2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION

Task: {2FF46932-3970-40DF-9E8B-F25D6FB59F0C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFReport.exe [2016-02-18] (Hewlett-Packard)

Task: {34E5603C-F8EF-4C86-82FC-7112CC2D3288} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION

Task: {3831E41A-88D1-4F2B-9614-6B48FB0AD101} - System32\Tasks\Microsoft\Windows\SysResetLogSuccess => Rundll32.exe ResetEng.dll,RjvLogSuccessEntryPoint

Task: {3A150D8E-7A7B-4CB9-9FA2-50C3A0C215D4} - System32\Tasks\Synaptics TouchPad Enhancements => Program Files\Synaptics\SynTP\SynTPEnh.exe

Task: {421D5C04-FBBD-4500-AC87-2B454992E0CD} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-06-25] (Adobe Systems Incorporated)

Task: {513611DA-B53F-49CA-824C-E118C7751754} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION

Task: {529B9604-3B92-4529-A572-4848E951501F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-07-05] (Microsoft Corporation)

Task: {6242FBB4-E46B-4DBA-BE6F-BD8B4AF7D360} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION

Task: {66CBAB59-7F47-43F1-9A1F-CF090DB7297B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-10-28] (Microsoft Corporation)

Task: {66E579BA-1CDB-4FCF-B29B-46B4291C71CF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-08-08] (HP Inc.)

Task: {7C2FF768-F5B7-4985-93D1-3CA0D2D485FB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2016-03-07] (Hewlett-Packard)

Task: {85C14507-B45C-459C-BE47-568CA5CC8C11} - System32\Tasks\avastBCLRestartS-1-5-21-118284328-1780918115-838920262-1002 => Chrome.exe

Task: {861BE37F-3176-4F71-A454-A963406B21C2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION

Task: {87684A1F-4510-4324-BB52-D7862AF204FE} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION

Task: {8BBA547F-C5AD-4099-96F3-A42A162F2537} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION

Task: {9207E174-434C-47FB-8EAD-DCE13552FE56} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION

Task: {996FB0A8-FFE9-4050-8EBF-39B59383AA32} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-08-13] (Microsoft Corporation)

Task: {9B317946-6EE3-425D-81AA-65389B098E5B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {A4669236-5108-45DB-8FF3-23406A71CFCF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)

Task: {A4BA3512-4BEC-4967-B265-259944D3DDCE} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION

Task: {A513260D-37B6-4D68-B4CB-A10A42F69F04} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION

Task: {AC4F1090-238B-4E88-831A-0F4F8F51EEF4} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-10-28] (Microsoft Corporation)

Task: {C4FC19FD-7465-46DD-A886-9AB3149E2821} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION

Task: {C6159B80-1403-4B8C-B5F3-E00E3F641D5A} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION

Task: {C84D7EA0-3BF8-453A-9250-C35F75D8E1BA} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-07-05] (Microsoft Corporation)

Task: {CE6A2AD6-F021-4C01-A255-2DE0E958BD52} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {D6D3F3E0-361E-4ADC-A5BF-E816425034FE} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Evan\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe [2016-08-17] (Microsoft Corporation)

Task: {DC0B34AE-A925-42E5-9564-7DED838A641B} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-08-21] (AVAST Software)

Task: {DF7D7A4F-3653-46A4-A986-95120D8E94B1} - \Microsoft\Windows\Setup\GWXTriggers\Logon-URT -> No File <==== ATTENTION

Task: {EE8A54CD-E56A-427D-8B85-A49D40F955FE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)

Task: {FC336656-73ED-43E3-91FA-A03CC0961541} - System32\Tasks\HPCeeScheduleForShawn => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)

Task: {FC6512B3-0F5A-47B2-99D9-D84A0D6E5BAD} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-10-12] (CyberLink)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\HPCeeScheduleForShawn.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-10-30 02:18 - 2015-10-30 02:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll

2015-02-06 14:56 - 2016-05-24 09:51 - 00116416 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2016-07-13 10:57 - 2016-06-30 23:48 - 02656408 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2016-04-19 05:54 - 2016-04-19 05:55 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe

2016-07-13 10:57 - 2016-06-30 23:48 - 02656408 _____ () C:\WINDOWS\System32\CoreUIComponents.dll

2016-05-17 19:40 - 2016-05-17 19:40 - 00959168 _____ () C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\ClientTelemetry.dll

2016-07-26 05:31 - 2016-05-24 11:43 - 08909504 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2016-02-08 19:11 - 2016-02-08 19:11 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll

2016-07-13 11:00 - 2016-06-30 22:48 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll

2016-07-13 10:58 - 2016-06-30 22:27 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2016-07-13 10:57 - 2016-06-30 22:21 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2016-07-13 10:57 - 2016-06-30 22:22 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2016-07-13 10:58 - 2016-06-30 22:24 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2015-10-30 02:18 - 2015-10-30 02:18 - 00218456 _____ () c:\windows\system32\WerEtw.dll

2016-06-27 19:32 - 2016-06-27 19:32 - 03790336 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1605.1582.0_x64__8wekyb3d8bbwe\Calculator.exe

2016-02-10 18:08 - 2016-02-10 18:08 - 00258560 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1605.1582.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll

2016-08-21 21:23 - 2016-08-21 21:23 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll

2016-08-21 08:13 - 2016-08-21 08:13 - 03015680 _____ () C:\Program Files\AVAST Software\Avast\defs\16082100\algo.dll

2016-08-21 21:23 - 2016-08-21 21:23 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll

2016-04-19 05:54 - 2016-04-19 05:55 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll

2016-04-19 05:54 - 2016-04-19 05:55 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00838792 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libxml2.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00049800 _____ () C:\Program Files (x86)\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00086664 _____ () C:\Program Files (x86)\Plex\Plex Media Server\soci_core-vc80-3_0.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 02092680 _____ () C:\Program Files (x86)\Plex\Plex Media Server\opencv_core249.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 01883272 _____ () C:\Program Files (x86)\Plex\Plex Media Server\opencv_imgproc249.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00502920 _____ () C:\Program Files (x86)\Plex\Plex Media Server\tag.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00072840 _____ () C:\Program Files (x86)\Plex\Plex Media Server\zlib.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00196232 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libidn.dll

2013-12-18 17:25 - 2013-12-18 17:25 - 03244032 _____ () C:\Users\Shawn\AppData\Local\Programs\Google\Google+ Auto Backup\gpuploader_i18n.dll

2016-07-11 18:35 - 2016-07-11 18:35 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00044680 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_socket.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00027784 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_ssl.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00018568 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_hashlib.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00034952 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00836232 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\lxml\etree.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00062600 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libexslt.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00166024 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libxslt.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00192136 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\lxml\objectify.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00016520 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\select.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00054920 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00017032 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00043656 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00081544 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_ctypes.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00111240 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\pyexpat.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00689800 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\unicodedata.pyd

2016-08-05 08:15 - 2016-08-02 19:24 - 01771336 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libglesv2.dll

2016-08-05 08:15 - 2016-08-02 19:23 - 00094024 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libegl.dll

2016-08-21 21:34 - 2016-08-21 21:34 - 01383616 _____ () C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\ClientTelemetry.dll

2016-08-21 21:35 - 2016-08-21 21:35 - 00118976 _____ () C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileSyncViews.dll

2016-02-23 07:14 - 2016-02-23 07:14 - 00325824 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll

2015-12-06 16:49 - 2016-08-08 18:27 - 00785920 _____ () C:\Program Files (x86)\Steam\SDL2.dll

2015-12-06 16:49 - 2015-07-01 17:06 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll

2015-12-06 16:49 - 2016-08-16 15:54 - 02321184 _____ () C:\Program Files (x86)\Steam\video.dll

2015-12-06 16:49 - 2016-01-27 02:49 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll

2015-12-06 16:49 - 2016-01-27 02:49 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll

2015-12-06 16:49 - 2016-01-27 02:49 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll

2015-12-06 16:49 - 2016-01-27 02:49 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll

2015-12-06 16:49 - 2016-01-27 02:49 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll

2015-12-06 16:49 - 2015-07-01 17:06 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll

2015-12-06 16:49 - 2015-07-01 17:06 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll

2015-12-06 16:49 - 2016-08-16 15:54 - 00835360 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL

2016-03-09 17:30 - 2016-07-04 17:17 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll

2015-12-06 16:49 - 2016-08-04 15:56 - 49825056 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-118284328-1780918115-838920262-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Shawn\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\backgrounddefault.jpg

DNS Servers: 8.8.8.8 - 8.8.4.4

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

Juliet

Post #2August 28, 2016, 12:32 PM UTC

The below versions of Java are out of date and need to be removed. Later we can install the most current.

Java 7 Update 79 (64-bit) (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F06417079FF}) (Version: 7.0.790 - Oracle)
Java 8 Update 31 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Java SE Development Kit 7 Update 79 (64-bit) (HKLM\…\{64A3A4F4-B792-11D6-A78A-00B0D0170790}) (Version: 1.7.0.790 - Oracle)

Please uninstall/delete the below
Search App by Ask (HKLM-x32\…\{4F524A2D-5350-4500-76A7-A758B70C1700}) (Version: 12.23.0.15 - APN, LLC) <==== ATTENTION

~~~~~~~~~~~~~~~~~~~`
Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

[external image: FRSTfix.JPG]

start
CreateRestorePoint:
CloseProcesses:
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2015-06-14] (Oracle Corporation)Toolbar: HKU\S-1-5-21-118284328-1780918115-838920262-1002 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
FF Plugin: @java.com/DTPlugin,version=10.79.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-06-14] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.79.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2015-06-14] (Oracle Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-28] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-28] (Oracle Corporation)
CHR DefaultSuggestURL: Default -> hxxp://ssmsp.ask.com/query?sstype=prefix&li=ff&q={searchTerms}
CHR HKLM-x32\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~

[external image: BY4dvz9.png]AdwCleaner

Please download AdwCleaner and save the file to your Desktop.
In order to use AdwCleaner, you have to agree the Eula:
Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
Follow the prompts.
Click [external image: A49sxPr.png]Scan.
Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
Click [external image: MqHawIb.png]Clean.
Follow the prompts and allow your computer to reboot.
After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.

– File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

~~
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt

Bonetucky

Post #3August 28, 2016, 10:51 PM UTC

Hi. Thanks. I will work on this tonight.
A

Bonetucky

Post #4August 29, 2016, 1:43 PM UTC last edited August 29, 2016, 1:46 PM UTC

Logs below. I forgot to uninstall Java until after I ran the Farbar, but they are uninstalled now.

Thanks.

Fix result of Farbar Recovery Scan Tool (x64) Version: 28-08-2016

Ran by [removed] (28-08-2016 22:08:07) Run:1

Running from C:\Users\[removed]\Desktop

[removed]

Boot Mode: Normal

==============================================

fixlist content:

*****************

start

CreateRestorePoint:

CloseProcesses:

BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2015-06-14] (Oracle Corporation)Toolbar: HKU\S-1-5-21-118284328-1780918115-838920262-1002 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File