WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. Join 93084 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Laptop slow and downloads are suspicious

Started by Andreyta , Aug 27 2016 05:52 PM

This topic is locked

34 replies to this topic

#16 Andreyta

Authentic Member

Authentic Member
57 posts

Posted 08 September 2016 - 05:44 AM

Hi. Sorry, just realized I didn't post the log yesterday. Computer is not the fastest still, but it is a little better. I did have new tabs pop up on mozilla again, but it seems to happen under my son's profile, not under mine.

Thanks,

Fix result of Farbar Recovery Scan Tool (x64) Version: 31-08-2016

Ran by Shawn (06-09-2016 16:26:24) Run:2

Running from C:\Users\Shawn\Desktop

Loaded Profiles: Shawn (Available Profiles: Shawn & vaneg_000 & Evan & Administrator)

Boot Mode: Normal

==============================================

fixlist content:

*****************

start

CreateRestorePoint:

CloseProcesses:

C:\Users\Shawn\AppData\Local\Microsoft\Windows\FileHistory\Data\126\C\Users\Shawn\Downloads\cbsidlm-cbsi134-Pandora_Recovery-SEO-10694796.exe

C:\Users\Shawn\Downloads\cbsidlm-cbsi134-Pandora_Recovery-SEO-10694796.exe

EmptyTemp:

End

*****************

Restore point was successfully created.

Processes closed successfully.

C:\Users\Shawn\AppData\Local\Microsoft\Windows\FileHistory\Data\126\C\Users\Shawn\Downloads\cbsidlm-cbsi134-Pandora_Recovery-SEO-10694796.exe => moved successfully

C:\Users\Shawn\Downloads\cbsidlm-cbsi134-Pandora_Recovery-SEO-10694796.exe => moved successfully

=========== EmptyTemp: ==========

BITS transfer queue => 844963 B

DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 18000968 B

Java, Flash, Steam htmlcache => 13687785 B

Windows/system/drivers => 42091144 B

Edge => 0 B

Chrome => 114631227 B

Firefox => 0 B

Opera => 0 B

Temp, IE cache, history, cookies, recent:

Default => 0 B

ProgramData => 0 B

Public => 0 B

systemprofile => 0 B

systemprofile32 => 0 B

LocalService => 9822 B

NetworkService => 0 B

Shawn => 99355591 B

vaneg_000 => 0 B

Evan => 21753129 B

Administrator => 0 B

RecycleBin => 0 B

EmptyTemp: => 296 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 16:27:32 ====

Advertisements

Register to Remove

#17 Juliet

SuperHelper

Retired Classroom Teacher
7,686 posts

Interests:Boo!....

Posted 08 September 2016 - 02:12 PM

Let's run a new FRST scan and see if we can locate anything.

Right-Click FRST.exe / FRST64.exe and select Run as administrator to run the programme.
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the programme run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

Sometimes the angels fly close enough to you that you can hear the flutter of their wings...

MS - MVP Consumer Security 2009 - 2016, WI-MVP 2016-17
Antivirus Scanners Online Scanners Firewalls Slow Computer??

#18 Andreyta

Authentic Member

Authentic Member
57 posts

Posted 11 September 2016 - 03:59 PM

Ok. Thanks. I've been away for the weekend. I will scan and post today.

#19 Andreyta

Authentic Member

Authentic Member
57 posts

Posted 11 September 2016 - 04:04 PM

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-08-2016

Ran by Shawn (11-09-2016 17:01:04)

Running from C:\Users\Shawn\Desktop

Windows 10 Home Version 1607 (X64) (2016-09-02 15:05:02)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-118284328-1780918115-838920262-500 - Administrator - Disabled) => C:\Users\Administrator

DefaultAccount (S-1-5-21-118284328-1780918115-838920262-503 - Limited - Disabled)

Evan (S-1-5-21-118284328-1780918115-838920262-1006 - Limited - Enabled) => C:\Users\Evan

Guest (S-1-5-21-118284328-1780918115-838920262-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-118284328-1780918115-838920262-1013 - Limited - Enabled)

Shawn (S-1-5-21-118284328-1780918115-838920262-1002 - Administrator - Enabled) => C:\Users\Shawn

vaneg_000 (S-1-5-21-118284328-1780918115-838920262-1005 - Limited - Enabled) => C:\Users\vaneg_000

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden

Adobe Acrobat Reader DC MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}) (Version: 15.017.20053 - Adobe Systems Incorporated)

Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.6.636 - Adobe Systems, Inc.)

Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden

AMD Catalyst Install Manager (HKLM\...\{8FE9C1D4-F5E4-B855-1D79-FF5D11F54A19}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.)

Avast Pro Antivirus (HKLM-x32\...\Avast) (Version: 12.3.2280 - AVAST Software)

Azteca (x32 Version: 2.2.0.97 - WildTangent) Hidden

Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Bounce Symphony (x32 Version: 2.2.0.98 - WildTangent) Hidden

Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden

CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.2.2114 - CyberLink Corp.)

CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.2.3317 - CyberLink Corp.)

CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.2.2126 - CyberLink Corp.)

CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.7.4528 - CyberLink Corp.)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.5.5811 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

EaseUS Data Recovery Wizard 9.0 (HKLM\...\EaseUS Data Recovery Wizard 9.0_is1) (Version: - EaseUS)

Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)

EPSON WorkForce 435 Series Printer Uninstall (HKLM\...\EPSON WorkForce 435 Series) (Version: - SEIKO EPSON Corporation)

FATE: The Cursed King (x32 Version: 2.2.0.97 - WildTangent) Hidden

Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden

Force Of Nature_Alpha3.3 (HKLM\...\UDK-36184b4a-24b5-4286-88ec-1cd89b26e380) (Version: - Epic Games, Inc.)

Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Facepunch Studios)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 52.0.2743.116 - Google Inc.)

Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden

Google+ Auto Backup (HKLM-x32\...\{D1D4D7EA-62B8-4665-9FF7-02A91B925CC9}) (Version: 1.0.18.74 - Google)

Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

Hoyle Card Games (x32 Version: 2.2.0.95 - WildTangent) Hidden

HP 3D DriveGuard (HKLM\...\{6821D775-9303-46DD-977A-2D97CA18B054}) (Version: 4.2.8.1 - Hewlett-Packard Company)

HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: v1.0 - Meridian Audio Ltd)

HP CoolSense (HKLM-x32\...\{8704FEEF-A6A8-4E7E-B124-BD6122C66E2C}) (Version: 2.10.42 - Hewlett-Packard Company)

HP Documentation (HKLM-x32\...\{44613B7A-527C-4E89-91FC-E611FA62806A}) (Version: 1.1.0.0 - Hewlett-Packard)

HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.3.0 - WildTangent)

HP MyRoom (HKLM-x32\...\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)

HP Quick Launch (HKLM-x32\...\{E5823036-6F09-4D0A-B05C-E2BAA129288A}) (Version: 3.0.6 - Hewlett-Packard Company)

HP Registration Service (HKLM\...\{C2E428EB-116E-41C0-9E84-B22DE9CCA42F}) (Version: 1.1.6232.4245 - Hewlett-Packard)

HP Support Assistant (HKLM-x32\...\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)

HP Utility Center (HKLM-x32\...\{0C57987A-A03A-4B95-A309-D23F78F406CA}) (Version: 1.0.8 - Hewlett-Packard)

HP Wireless Button Driver (HKLM-x32\...\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.6.1 - Hewlett-Packard Company)

Icecream Screen Recorder version 2.72 (HKLM-x32\...\{7ADEC622-3230-4C9A-9DCE-9BD462B74095}_is1) (Version: 2.72 - Icecream Apps)

IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6425.0 - IDT)

Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden

Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden

Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden

Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)

MergeModule_x64 (Version: 9.3.00 - Sony Corporation) Hidden

MergeModule_x86 (x32 Version: 9.3.00 - Sony Corporation) Hidden

Microsoft Office Professional Plus 2013 - en-us (HKLM\...\ProPlusRetail - en-us) (Version: 15.0.4849.1003 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)

Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)

Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Mozilla Firefox 43.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 43.0.1 (x86 en-US)) (Version: 43.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 43.0.1.5828 - Mozilla)

Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4849.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4849.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4849.1003 - Microsoft Corporation) Hidden

Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden

Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)

PlayMemories Home (HKLM-x32\...\{94F4815B-755A-4FFA-AFDC-EE8FE776981E}) (Version: 5.2.01.06240 - Sony Corporation)

Plex Media Server (HKLM-x32\...\{7425d872-d65d-42c9-8c6d-7a8a529a4b50}) (Version: 0.9.1107 - Plex, Inc.)

Plex Media Server (x32 Version: 0.9.1107 - Plex, Inc.) Hidden

PMB_ModeEditor (x32 Version: 9.3.00 - Sony Corporation) Hidden

PMB_ServiceUploader (x32 Version: 10.2.01 - Sony Corporation) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Polar Golfer (x32 Version: 2.2.0.98 - WildTangent) Hidden

Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)

Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.29031 - Realtek Semiconductor Corp.)

Recuva (HKLM\...\Recuva) (Version: 1.52 - Piriform)

Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

SafeZone Stable 1.51.2220.53 (x32 Version: 1.51.2220.53 - Avast Software) Hidden

Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.3.0.9150 - Microsoft Corporation)

Skype™ 7.27 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.27.101 - Skype Technologies S.A.)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.12.98 - Synaptics Incorporated)

Terraria (HKLM-x32\...\Steam App 105600) (Version: - Re-Logic)

The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden

Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden

WebM Project Directshow Filters (HKU\S-1-5-21-118284328-1780918115-838920262-1002\...\webmdshow) (Version: 1.0.4.1 - WebM Project)

WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)

WildTangent Games App (x32 Version: 4.0.9.7 - WildTangent) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

WinX DVD Ripper Platinum 7.5.11 (HKLM-x32\...\WinX DVD Ripper Platinum_is1) (Version: - Digiarty Software, Inc.)

WinX HD Video Converter Deluxe 5.0.3 (HKLM-x32\...\WinX HD Video Converter Deluxe_is1) (Version: - Digiarty Software, Inc.)

Xiph.Org Open Codecs 0.85.17777 (HKLM-x32\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)

Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-118284328-1780918115-838920262-1002_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\FileCoAuth.exe (Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {00119154-B7E6-424D-9F2B-B39B94E05C8B} - System32\Tasks\HPCeeScheduleForShawn => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)

Task: {032C6D0A-A34D-4278-9A87-A724514BBEE1} - System32\Tasks\SafeZone scheduled Autoupdate 1468504716 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-08-09] (Avast Software)

Task: {2FF46932-3970-40DF-9E8B-F25D6FB59F0C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFReport.exe [2016-02-18] (Hewlett-Packard)

Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe

Task: {3831E41A-88D1-4F2B-9614-6B48FB0AD101} - System32\Tasks\Microsoft\Windows\SysResetLogSuccess => Rundll32.exe ResetEng.dll,RjvLogSuccessEntryPoint

Task: {3A150D8E-7A7B-4CB9-9FA2-50C3A0C215D4} - System32\Tasks\Synaptics TouchPad Enhancements => Program Files\Synaptics\SynTP\SynTPEnh.exe

Task: {421D5C04-FBBD-4500-AC87-2B454992E0CD} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-06-25] (Adobe Systems Incorporated)

Task: {529B9604-3B92-4529-A572-4848E951501F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-07-05] (Microsoft Corporation)

Task: {66CBAB59-7F47-43F1-9A1F-CF090DB7297B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-10-28] (Microsoft Corporation)

Task: {66E579BA-1CDB-4FCF-B29B-46B4291C71CF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-08-08] (HP Inc.)

Task: {7C2FF768-F5B7-4985-93D1-3CA0D2D485FB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2016-07-06] (HP Inc.)

Task: {85C14507-B45C-459C-BE47-568CA5CC8C11} - System32\Tasks\avastBCLRestartS-1-5-21-118284328-1780918115-838920262-1002 => Chrome.exe

Task: {996FB0A8-FFE9-4050-8EBF-39B59383AA32} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-08-13] (Microsoft Corporation)

Task: {9B317946-6EE3-425D-81AA-65389B098E5B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {A45E2E7A-C9AB-4E5C-BD5D-388C2051DF40} - \WPD\SqmUpload_S-1-5-21-118284328-1780918115-838920262-1002 -> No File <==== ATTENTION

Task: {A4669236-5108-45DB-8FF3-23406A71CFCF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)

Task: {AAA7AEFE-6900-42BB-9C03-AE9585B8F6EC} - \WPD\SqmUpload_S-1-5-21-118284328-1780918115-838920262-1006 -> No File <==== ATTENTION

Task: {AC4F1090-238B-4E88-831A-0F4F8F51EEF4} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-10-28] (Microsoft Corporation)

Task: {C84D7EA0-3BF8-453A-9250-C35F75D8E1BA} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-07-05] (Microsoft Corporation)

Task: {CE6A2AD6-F021-4C01-A255-2DE0E958BD52} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {D6D3F3E0-361E-4ADC-A5BF-E816425034FE} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Evan\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe [2016-08-17] (Microsoft Corporation)

Task: {D815556A-793F-40D0-B25F-77AA4BD4C84C} - \WPD\SqmUpload_S-1-5-21-118284328-1780918115-838920262-1005 -> No File <==== ATTENTION

Task: {DC0B34AE-A925-42E5-9564-7DED838A641B} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-08-21] (AVAST Software)

Task: {EE8A54CD-E56A-427D-8B85-A49D40F955FE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)

Task: {FC6512B3-0F5A-47B2-99D9-D84A0D6E5BAD} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-10-12] (CyberLink)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\HPCeeScheduleForShawn.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-02-06 14:56 - 2016-05-24 09:51 - 00116416 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2016-07-16 06:42 - 2016-07-16 06:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll

2016-07-16 06:42 - 2016-07-16 06:42 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2016-07-16 06:42 - 2016-07-16 06:42 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll

2016-09-02 12:57 - 2016-09-02 12:57 - 01864384 _____ () C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\amd64\ClientTelemetry.dll

2016-07-26 05:31 - 2016-05-24 11:43 - 08909504 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2016-07-16 06:42 - 2016-07-16 06:42 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll

2016-07-16 06:43 - 2016-07-16 06:43 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll

2016-07-16 06:43 - 2016-07-16 09:27 - 09761280 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2016-09-02 14:59 - 2016-08-19 23:54 - 01401344 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2016-07-16 06:43 - 2016-07-16 09:27 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll

2016-07-16 06:43 - 2016-07-16 09:27 - 01033728 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll

2016-09-02 14:58 - 2016-08-19 23:54 - 02438144 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2016-09-02 14:59 - 2016-08-19 23:56 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2016-09-02 13:31 - 2016-09-02 13:34 - 00071168 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.7.113.0_x64__kzf8qxf38zg5c\SkypeHost.exe

2016-09-02 13:31 - 2016-09-02 13:34 - 00178176 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.7.113.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll

2016-09-02 13:31 - 2016-09-02 13:34 - 35288064 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.7.113.0_x64__kzf8qxf38zg5c\SkyWrap.dll

2016-07-16 06:43 - 2016-07-16 09:27 - 03378528 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentDeliveryManager.Background.dll

2016-07-16 06:43 - 2016-07-16 09:27 - 02263904 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentManagementSDK.dll

2016-07-16 06:43 - 2016-07-16 09:27 - 00114176 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Dss.BackgroundTask.dll

2016-07-16 06:43 - 2016-07-16 09:27 - 00115712 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\DeviceSideServicesActionUriHandler.dll

2016-07-16 06:43 - 2016-07-16 09:27 - 00522752 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.NodeWinrtWrap.dll

2016-07-16 06:43 - 2016-07-16 09:27 - 00040448 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\winrt-projections\bin\Winrt_Projections.node

2016-07-16 06:43 - 2016-07-16 09:26 - 00813056 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.web.http\bin\NodeRT_Windows_Web_Http.node

2016-07-16 06:43 - 2016-07-16 09:27 - 00963584 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.web.http.headers\bin\NodeRT_Windows_Web_Http_Headers.node

2016-07-16 06:43 - 2016-07-16 09:27 - 00249344 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.web.http.filters\bin\NodeRT_Windows_Web_Http_Filters.node

2016-07-16 06:43 - 2016-07-16 09:27 - 00572416 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.storage.streams\bin\NodeRT_Windows_Storage_Streams.node

2016-07-16 06:43 - 2016-07-16 09:27 - 00403968 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.foundation\bin\NodeRT_Windows_Foundation.node

2016-07-16 06:43 - 2016-07-16 09:27 - 00183296 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\nodert-buffer-utils\bin\NodeRT_Buffer_Utils.node

2016-07-16 06:43 - 2016-07-16 09:26 - 00288256 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.cortana.pal\bin\NodeRT_Windows_Cortana_PAL.node

2016-09-02 13:34 - 2016-09-02 13:34 - 00055808 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11607.1001.51.0_x64__8wekyb3d8bbwe\WinStoreTasksWrapper.dll

2016-08-21 21:23 - 2016-08-21 21:23 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll

2016-08-21 21:23 - 2016-08-21 21:23 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll

2016-09-11 08:57 - 2016-09-11 08:57 - 03085488 _____ () C:\Program Files\AVAST Software\Avast\defs\16091102\algo.dll

2016-07-26 05:30 - 2016-05-24 10:21 - 08909504 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll

2016-08-05 08:15 - 2016-08-02 19:24 - 01771336 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libglesv2.dll

2016-08-05 08:15 - 2016-08-02 19:23 - 00094024 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libegl.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00838792 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libxml2.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00049800 _____ () C:\Program Files (x86)\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00086664 _____ () C:\Program Files (x86)\Plex\Plex Media Server\soci_core-vc80-3_0.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 02092680 _____ () C:\Program Files (x86)\Plex\Plex Media Server\opencv_core249.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 01883272 _____ () C:\Program Files (x86)\Plex\Plex Media Server\opencv_imgproc249.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00502920 _____ () C:\Program Files (x86)\Plex\Plex Media Server\tag.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00072840 _____ () C:\Program Files (x86)\Plex\Plex Media Server\zlib.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00196232 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libidn.dll

2015-12-06 16:49 - 2016-08-08 18:27 - 00785920 _____ () C:\Program Files (x86)\Steam\SDL2.dll

2015-12-06 16:49 - 2015-07-01 17:06 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll

2015-12-06 16:49 - 2016-08-23 14:33 - 02321184 _____ () C:\Program Files (x86)\Steam\video.dll

2015-12-06 16:49 - 2015-07-01 17:06 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll

2015-12-06 16:49 - 2015-07-01 17:06 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll

2015-12-06 16:49 - 2016-01-27 02:49 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll

2015-12-06 16:49 - 2016-01-27 02:49 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll

2015-12-06 16:49 - 2016-01-27 02:49 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll

2015-12-06 16:49 - 2016-01-27 02:49 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll

2015-12-06 16:49 - 2016-01-27 02:49 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll

2015-12-06 16:49 - 2016-08-23 14:33 - 00835360 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL

2016-03-09 17:30 - 2016-07-04 17:17 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll

2013-12-18 17:25 - 2013-12-18 17:25 - 03244032 _____ () C:\Users\Shawn\AppData\Local\Programs\Google\Google+ Auto Backup\gpuploader_i18n.dll

2016-09-02 12:57 - 2016-09-02 12:57 - 01383616 _____ () C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\ClientTelemetry.dll

2016-09-02 12:57 - 2016-09-02 12:57 - 00118976 _____ () C:\Users\Shawn\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\FileSyncViews.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00044680 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_socket.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00027784 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_ssl.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00018568 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_hashlib.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00034952 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00836232 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\lxml\etree.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00062600 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libexslt.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00166024 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libxslt.dll

2014-12-21 23:31 - 2014-12-21 23:31 - 00192136 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\lxml\objectify.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00016520 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\select.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00054920 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00017032 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00043656 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00081544 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_ctypes.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00111240 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\pyexpat.pyd

2014-12-21 23:31 - 2014-12-21 23:31 - 00689800 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\unicodedata.pyd

2016-07-11 18:35 - 2016-07-11 18:35 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2016-02-23 07:14 - 2016-02-23 07:14 - 00325824 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll

2016-02-23 07:00 - 2016-02-23 07:00 - 00325824 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll

2015-12-06 16:49 - 2016-08-04 15:56 - 49825056 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 08:25 - 2016-08-28 22:08 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-118284328-1780918115-838920262-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Shawn\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\backgrounddefault.jpg

DNS Servers: 8.8.8.8 - 8.8.4.4

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{A7F8AA15-8817-4026-BFE6-ED3BD0226D51}] => (Allow) LPort=53000

FirewallRules: [{C8D4B7D9-465E-4F13-A361-69E0F6D35E4D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [UDP Query User{D31A2D65-4FCC-4BF6-9071-A23BD5FF24C4}C:\udk\force of nature_alpha3.3\binaries\win32\udk.exe] => (Block) C:\udk\force of nature_alpha3.3\binaries\win32\udk.exe

FirewallRules: [TCP Query User{66A18723-1A44-470E-A943-96C474ADFA07}C:\udk\force of nature_alpha3.3\binaries\win32\udk.exe] => (Block) C:\udk\force of nature_alpha3.3\binaries\win32\udk.exe

FirewallRules: [{42E5E000-C86F-4E1F-BD75-35CFEC0A579F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{3B6C8C2C-A8EC-4B23-801E-2745E9BE2934}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{5393EAE9-4F75-41AC-8251-A66B00EDED0C}] => (Allow) LPort=52000

FirewallRules: [{B48A2AB4-042F-4B60-ACCB-0FA9A561A0E3}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE

FirewallRules: [{46978978-2707-4AFD-9DA1-7AE597A58661}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE

FirewallRules: [{CB07F566-304A-4D0A-9EBA-8998E27A9C45}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{D54BAA35-D8F5-435F-BC0E-763D7805CE42}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{AEB5D719-A207-4B09-8F4F-F751DFFD0031}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{92C65A2F-F9E4-4C23-8693-892847771B44}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{7AD77BBA-75B2-4E02-9833-732488BA42E1}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe

FirewallRules: [{F06A7163-69FA-4ECE-BDF7-FAD4E9B73577}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe

FirewallRules: [{51EE9AD2-E3EC-4A16-90F1-B8FC462408F6}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe

FirewallRules: [{5188D819-4361-4507-A58D-87E971A13730}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe

FirewallRules: [{D78484F3-BD08-401A-BABF-78BCDF5F4D8A}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe

FirewallRules: [{3F218713-3FAE-4D01-A59F-3EF052DB69BC}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe

FirewallRules: [{5DE93265-C9B7-4909-BF0A-713623A7E08D}] => (Allow) C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe

FirewallRules: [TCP Query User{4970F936-FBD1-4514-A33C-87CFD61F851D}C:\program files (x86)\plex\plex media server\plex media server.exe] => (Allow) C:\program files (x86)\plex\plex media server\plex media server.exe

FirewallRules: [UDP Query User{028A1919-E25C-49DF-99BA-3E903D0C6E42}C:\program files (x86)\plex\plex media server\plex media server.exe] => (Allow) C:\program files (x86)\plex\plex media server\plex media server.exe

FirewallRules: [TCP Query User{0BC5B5DE-99A4-4F33-BD87-D64A22358E91}C:\program files (x86)\plex\plex media server\plexscripthost.exe] => (Block) C:\program files (x86)\plex\plex media server\plexscripthost.exe

FirewallRules: [UDP Query User{1B6AE1A2-EF5E-4158-A59F-7E68AF669C84}C:\program files (x86)\plex\plex media server\plexscripthost.exe] => (Block) C:\program files (x86)\plex\plex media server\plexscripthost.exe

FirewallRules: [TCP Query User{5DF47793-60C5-4DB9-9909-F694FDBD8A3F}C:\program files (x86)\plex\plex media server\plexdlnaserver.exe] => (Allow) C:\program files (x86)\plex\plex media server\plexdlnaserver.exe

FirewallRules: [UDP Query User{92CCD289-81A2-4C09-A71C-E671827BFE3E}C:\program files (x86)\plex\plex media server\plexdlnaserver.exe] => (Allow) C:\program files (x86)\plex\plex media server\plexdlnaserver.exe

FirewallRules: [TCP Query User{A69341A6-5428-46C6-B688-F6351DEF181A}C:\program files (x86)\plex\plex media server\plexscripthost.exe] => (Block) C:\program files (x86)\plex\plex media server\plexscripthost.exe

FirewallRules: [UDP Query User{8985DD24-5253-44DB-919A-D290E19CCDE7}C:\program files (x86)\plex\plex media server\plexscripthost.exe] => (Block) C:\program files (x86)\plex\plex media server\plexscripthost.exe

FirewallRules: [{94A0365B-3645-4AEF-A61B-388178919516}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe

FirewallRules: [{7FBC74D4-D82E-4F7A-A1A8-F130651E3B28}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{9241CCE3-F617-4351-AFC5-780EE1438DE0}] => (Allow) LPort=2869

FirewallRules: [{E3567AAF-4394-4AE9-9B6E-017A988C8D1C}] => (Allow) LPort=1900

FirewallRules: [{FC00B216-96E4-46C2-BC9E-00C4B062C6F6}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

FirewallRules: [{7AE04A1F-5449-4C13-A4FE-44106BEF5923}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{D3427698-C8FD-4000-8C95-BAEFD1BC4497}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [TCP Query User{9970AB88-37F7-404D-9BFE-2C37ED6B277D}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe

FirewallRules: [UDP Query User{B8102AC3-7ED9-4FE7-91CA-EC89B6EA7CB1}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe

FirewallRules: [TCP Query User{747429AB-93A7-4AD8-AB8F-9094E2BE90DB}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [UDP Query User{14121F2B-F071-4C45-ADFA-AC2EC786FBD3}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [TCP Query User{BA8F4101-1534-41E3-9F28-966E07179013}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [UDP Query User{B41DAC98-1FF2-4305-8B30-DE54D1043FAE}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [TCP Query User{03F593B8-0FD8-461D-87BD-EAFC9EC92DD7}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{5969D1D9-97F4-47E5-8440-6E17CA186C6D}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{C9DD1DCA-7AE8-44D9-868A-2480F0B810EA}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe

FirewallRules: [{623F96A8-CDC1-44C9-8F31-2DB4A4F33822}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe

FirewallRules: [{677EFBA8-223A-42F1-BEF6-6CA402D53188}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe

FirewallRules: [{C52C2D07-288C-4095-9920-349C39715ECF}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe

FirewallRules: [{D367F020-F506-4C92-87AD-4B3033F60B2A}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{833821D8-252B-4A4F-B09E-77258DDFDB33}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{7D443816-6814-4384-8DF0-768AAED127E6}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{D2B4D678-E026-41DF-867B-1DD0DC6C6342}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{C8E8921B-3CF9-46F8-9412-5B9F340D06E8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe

FirewallRules: [{6856D574-486F-4F39-A9C4-B234CC4F7988}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe

FirewallRules: [{9AB5F51C-738A-4209-AFC3-5D08ACE77193}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe

FirewallRules: [{68E7B57D-301C-4499-9D18-472EAD349167}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe

FirewallRules: [TCP Query User{AB59619E-EEE6-4A78-8CE6-34F6DFD8AFF2}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] => (Block) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe

FirewallRules: [UDP Query User{8DDA6591-EB6B-4E02-90CA-0135BBF093E4}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] => (Block) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe

FirewallRules: [{6DCC9E0B-2C27-404B-A55F-4DA9178431D3}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe

==================== Restore Points =========================

02-09-2016 13:01:47 ASU_MSI_TRAN

09-09-2016 10:04:34 Windows Modules Installer

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (09/11/2016 04:56:12 PM) (Source: ATIeRecord) (EventID: 16396) (User: )

Description: ATI EEU PnP start/stop failed

Error: (09/11/2016 04:55:56 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HPPavilion)

Description: Activation of app Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (09/11/2016 04:55:56 PM) (Source: ATIeRecord) (EventID: 16396) (User: )

Description: ATI EEU PnP start/stop failed

Error: (09/11/2016 04:55:56 PM) (Source: ATIeRecord) (EventID: 16396) (User: )

Description: ATI EEU PnP start/stop failed

Error: (09/11/2016 03:11:18 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

Error: (09/11/2016 03:11:18 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

Error: (09/11/2016 03:11:18 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

Error: (09/11/2016 03:11:18 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

Error: (09/11/2016 03:11:18 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

Error: (09/11/2016 03:11:18 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

System errors:

=============

Error: (09/11/2016 04:59:27 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)

Description: The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.

Error: (09/11/2016 04:56:26 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}

and APPID

{F72671A9-012C-4725-9D2F-2A4D32D65169}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (09/11/2016 04:55:56 PM) (Source: DCOM) (EventID: 10010) (User: HPPavilion)

Description: The server Windows.Media.Capture.Internal.AppCaptureShell did not register with DCOM within the required timeout.

Error: (09/11/2016 04:55:56 PM) (Source: DCOM) (EventID: 10010) (User: HPPavilion)

Description: The server App.AppXwdz8g2fxr36xz0tdtagygnvemf85s7gg.mca did not register with DCOM within the required timeout.

Error: (09/09/2016 04:57:51 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)

Description: The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.

Error: (09/09/2016 04:54:51 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}

and APPID

{F72671A9-012C-4725-9D2F-2A4D32D65169}

Error: (09/09/2016 04:52:58 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 4:47:05 PM on ‎9/‎9/‎2016 was unexpected.

Error: (09/09/2016 04:03:27 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)

Description: The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.

Error: (09/09/2016 04:00:26 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}

and APPID

{F72671A9-012C-4725-9D2F-2A4D32D65169}

Error: (09/09/2016 03:54:22 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)

Description: The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.

==================== Memory info ===========================

Processor: AMD A8-4555M APU with Radeon™ HD Graphics

Percentage of memory in use: 36%

Total physical RAM: 7650.26 MB

Available physical RAM: 4827.29 MB

Total Virtual: 8994.26 MB

Available Virtual: 5819.25 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:570.1 GB) (Free:304.94 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive d: (RECOVERY) (Fixed) (Total:24.09 GB) (Free:2.87 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 596.2 GB) (Disk ID: 0A1E55B0)

Partition: GPT.

==================== End of Addition.txt ============================

#20 Andreyta

Authentic Member

Authentic Member
57 posts