My system was infected with Sysnetwk.exe & mylucky123 [Solved]

Addition.txt


Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-11-2016
Ran by [removed] (17-11-2016 01:30:16)
Running from C:\Users\[removed]\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2013-01-11 12:46:15)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-4001190308-645597301-758162152-500 - Administrator - Disabled)
Guest (S-1-5-21-4001190308-645597301-758162152-501 - Limited - Disabled) => C:\Users\Guest
HomeGroupUser$ (S-1-5-21-4001190308-645597301-758162152-1002 - Limited - Enabled)
Jason (S-1-5-21-4001190308-645597301-758162152-1001 - Administrator - Enabled) => C:\Users\Jason

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: Avast Antivirus (Disabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acunetix Web Vulnerability Scanner 7.0 (HKLM-x32\…\{2B040D56-BD5A-4990-A50C-33CDBCE03112}_is1) (Version: 7.0 - Acunetix)
Acunetix Web Vulnerability Scanner 9.5 (HKLM-x32\…\{ffec63c3-090d-45ea-afd7-eab07edb5822}_is1) (Version: 9.5 - Acunetix)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe Flash Player 23 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\…\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\…\{29DB9165-5FC1-48F0-9188-26123F526848}) (Version: 5.0.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\…\{5905C8CF-1C88-4478-A48E-4E458AD1BC7E}) (Version: 5.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{D4D86CB2-2370-4691-8272-3869EDED6C64}) (Version: 10.0.0.18 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Avast Premier (HKLM-x32\…\Avast) (Version: 12.3.2280 - AVAST Software)
AviSynth 2.5 (HKLM-x32\…\AviSynth) (Version:  - )
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\…\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Blasterball 2: Holidays (x32 Version: 2.2.0.95 - WildTangent) Hidden
BlueStacks App Player (HKLM-x32\…\BlueStacks App Player) (Version: 0.8.9.3088 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\…\{4C02AFA8-074D-44FE-B0E1-A73D4AA65390}) (Version: 0.8.9.3088 - BlueStack Systems, Inc.)
Bonjour (HKLM\…\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Broadcom 802.11 Wireless LAN Adapter (HKLM\…\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.100.82.148 - Broadcom Corporation)
Broadcom Bluetooth Software (HKLM\…\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.5700 - Broadcom Corporation)
Broadcom Wireless Utility (HKLM\…\Broadcom Wireless Utility) (Version: 5.100.82.148 - Broadcom Corporation)
Bubble Wrap (HKLM-x32\…\{5BFFDDEB-AFD7-499F-BB13-7A6EAD927CDA}_is1) (Version: 1.0.0.0 - XM Asia Pacific Pte Ltd)
Call of Duty: Black Ops II (HKLM-x32\…\Steam App 202970) (Version:  - )
CCleaner (HKLM\…\CCleaner) (Version: 4.12 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Combined Community Codec Pack 2013-03-02 (HKLM-x32\…\Combined Community Codec Pack_is1) (Version: 2013.03.02.0 - CCCP Project)
CopyTrans Suite Remove Only (HKU\S-1-5-21-4001190308-645597301-758162152-1001\…\CopyTrans Suite) (Version: 2.35 - WindSolutions)
Counter-Strike: Global Offensive (HKLM-x32\…\Steam App 730) (Version:  - Valve)
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM\…\DAEMON Tools Lite) (Version: 10.2.0.0114 - Disc Soft Ltd)
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden
Dota 2 (HKLM-x32\…\Steam App 570) (Version:  - Valve )
Dragonball Xenoverse Bundle Edition (HKLM-x32\…\Dragonball Xenoverse Bundle Edition_is1) (Version:  - )
Dropbox (HKU\S-1-5-21-4001190308-645597301-758162152-1001\…\Dropbox) (Version: 14.4.19 - Dropbox, Inc.)
Emergency Download Driver (HKLM-x32\…\{3F0F5AB4-C9CE-4226-8393-E9CFF8369D9D}) (Version: 1.1.16.1526 - Microsoft)
EPUB File Reader (HKLM-x32\…\{818C5857-5C74-4CAC-9F43-E5597086852D}_is1) (Version: 1.0 - )
f.lux (HKU\S-1-5-21-4001190308-645597301-758162152-1001\…\Flux) (Version:  - )
Facebook (HKLM-x32\…\{8AE50893-3A87-4439-9A57-942ED43F7189}) (Version: 1.1.0004 - Hewlett-Packard)
Facebook Video Calling 3.1.0.521 (HKLM-x32\…\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Farmscapes (x32 Version: 2.2.0.98 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
Flash Update Installer (x32 Version: 6.1.49 - Microsoft) Hidden
Fuse Installer (x32 Version: 6.1.49 - Nokia) Hidden
GitHub (HKU\S-1-5-21-4001190308-645597301-758162152-1001\…\5f7eb300e2ea4ebf) (Version: 2.3.1.1 - GitHub, Inc.)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 54.0.2840.99 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Gpg4win (2.2.4) (HKLM-x32\…\GPG4Win) (Version: 2.2.4 - The Gpg4win Project)
Grand Theft Auto IV (HKLM-x32\…\Steam App 12210) (Version:  - Rockstar North)
Grand Theft Auto: San Andreas (HKLM-x32\…\Steam App 12120) (Version:  - Rockstar Games)
Havij 1.17 Pro (HKLM-x32\…\Havij_is1) (Version:  - ITSecTeam)
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Hitman: Absolution (HKLM-x32\…\Steam App 203140) (Version:  - Square Enix)
Hitman: Sniper Challenge (HKLM-x32\…\Steam App 205930) (Version:  - IO Interactive)
HitmanPro 3.7 (HKLM\…\HitmanPro37) (Version: 3.7.15.281 - SurfRight B.V.)
HP Application Assistant (HKLM\…\{B34A07DD-C6F7-414A-AE63-01019482EAF0}) (Version: 1.0.393.3870 - Hewlett-Packard)
HP Calendar (HKLM-x32\…\{2B38E0FA-D8A5-4EBF-A018-E3C1C8E7A2E2}) (Version: 5.1.4245.23508 - Hewlett-Packard)
HP Clock (HKLM-x32\…\{0EEC4E49-D4C2-4E23-87F2-B5641F1A09E4}) (Version: 5.1.4244.16367 - Hewlett-Packard)
HP Deskjet 1050 J410 series Basic Device Software (HKLM\…\{F294770E-F869-400F-81C3-614B5F13CA54}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
HP Games (HKLM-x32\…\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP LinkUp (HKLM-x32\…\{7E750542-55BC-4300-8B7B-AC2A762FB435}) (Version: 2.01.029 - Hewlett-Packard)
HP Magic Canvas (HKLM-x32\…\{DDFDC9D6-4220-41F8-BF9A-8E7512C4EF52}) (Version: 5.1.15.0 - Hewlett-Packard)
HP Magic Canvas Tutorials (HKLM-x32\…\{858FCB65-7C6D-4BA4-AD80-A3CB3744CE09}_is1) (Version: 5.0.0.3 - Hewlett-Packard)
HP MovieStore (HKLM-x32\…\{9008D736-35CA-40DB-A2BE-5F32D954E5AA}) (Version: 2.1.21091.0 - Hewlett-Packard Company)
HP Notes (HKLM-x32\…\{86BAB08A-5E66-4C53-82E3-C1E91673C7CA}) (Version: 5.1.4274.30382 - Hewlett-Packard)
HP Odometer (HKLM-x32\…\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP RSS (HKLM-x32\…\{A35E58D6-2A0F-4051-983B-79342081338E}) (Version: 5.1.4301.21494 - Hewlett-Packard)
HP Setup (HKLM-x32\…\{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1}) (Version: 9.0.15130.3904 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\…\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.2.15145.3905 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\…\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}) (Version: 8.3.34.7 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\…\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 11.00.0001 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\…\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.5.32.37 - Hewlett-Packard Company)
HP TouchSmart Background - Beats (HKLM-x32\…\{6A6F8D36-04BA-41E9-9004-1789BD545874}) (Version: 1.0.1.0 - Hewlett-Packard)
HP TouchSmart RecipeBox (HKLM-x32\…\{20714B53-FC73-4F9C-9687-49EB237D6FD7}) (Version: 3.0.3830.27730 - Hewlett-Packard)
HP Update (HKLM-x32\…\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HP Vision Hardware Diagnostics (HKLM\…\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.12.1.0 - Hewlett-Packard)
HP Weather (HKLM-x32\…\{8364E531-493B-4B05-8041-09D5CE38B975}) (Version: 5.1.4295.16450 - Hewlett-Packard)
ICQ (version 10.0.12091) (HKU\S-1-5-21-4001190308-645597301-758162152-1001\…\icq.desktop) (Version: 10.0.12091 - ICQ)
iFunbox (v3.0.3109.1352) (HKLM-x32\…\iFunbox_is1) (Version: v3.0.3109.1352 - iFunbox DevTeam)
Intel(R) Management Engine Components (HKLM\…\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.30.1072 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.9.1000 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\…\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)
iTunes (HKLM\…\{9946A4F7-E0FD-4A33-82D1-06CBFFBBB9F9}) (Version: 12.5.1.21 - Apple Inc.)
Java 8 Update 51 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218051F0}) (Version: 8.0.510 - Oracle Corporation)
Java 8 Update 73 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218073F0}) (Version: 8.0.730.2 - Oracle Corporation)
Java SE Development Kit 8 (64-bit) (HKLM\…\{64A3A4F4-B792-11D6-A78A-00B0D0180000}) (Version: 8.0.0 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\…\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.4507 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.4507 - CyberLink Corp.) Hidden
LocK-A-FoLdeR (HKLM-x32\…\LocK-A-FoLdeR) (Version: 3.10.3 - )
Lumia UEFI Blue Driver (HKLM-x32\…\{9D2A75FE-8CE1-4297-AEC1-A097D47BACE9}) (Version: 1.1.10.1526 - Microsoft)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
McAfee Security Scan Plus (HKLM\…\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Metric Converter (HKLM-x32\…\{D0661463-50F7-4A1E-83CB-37CC590589AE}_is1) (Version: 1.0.0.0 - XM Asia Pacific Pte Ltd)
Microsoft .NET Framework 4.6.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\…\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Expression Encoder 4 (HKLM-x32\…\Encoder_4.0.1651.0) (Version: 4.0.1651.0 - Microsoft Corporation)
Microsoft Expression Encoder 4 Screen Capture Codec (HKLM-x32\…\{952DCCD8-4039-46C8-BC8B-5C1EB6C8E130}) (Version: 4.0.1651.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE (HKLM-x32\…\{2C9EE786-1DDB-4C98-8FA4-B1B9B5A66B77}) (Version: 3.1.186.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\…\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft IntelliPoint 8.2 (HKLM\…\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft Mathematics (HKLM-x32\…\{4D090F70-6F08-4B60-9357-A1DFD4458F09}) (Version: 4.0 - Microsoft Corporation)
Microsoft Network Monitor 3.4 (HKLM\…\{8C5B5A11-CBF8-451B-B201-77FAB0D0B77D}) (Version: 3.4.2350.0 - Microsoft Corporation)
Microsoft Network Monitor: NetworkMonitor Parsers 3.4 (HKLM\…\{963E5FEB-1367-46B9-851D-A957F1A3747F}) (Version: 3.4.2350.0 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\…\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
mIRC (HKLM-x32\…\mIRC) (Version: 7.41 - mIRC Co. Ltd.)
Mozilla Firefox 50.0 (x86 en-US) (HKU\S-1-5-21-4001190308-645597301-758162152-1001\…\Mozilla Firefox 50.0 (x86 en-US)) (Version: 50.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 50.0 - Mozilla)
MSR606 (HKLM-x32\…\MSR606v1.12) (Version: v1.12 - )
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\…\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\…\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Need for Speed: Hot Pursuit (HKLM-x32\…\Steam App 47870) (Version:  - Electronic Arts)
Need for Speed™ Carbon (HKLM-x32\…\{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}) (Version:  - )
Nero 12 (HKLM-x32\…\{560FC78C-A4B2-461D-9B47-820C1EEF87B8}) (Version: 12.0.02000 - Nero AG)
Nokia Connectivity Cable Driver (HKLM-x32\…\{D4BF151C-70A8-4CE2-906F-4173A575BAD9}) (Version: 7.1.182.0 - Nokia)
Nokia Software Recovery Tool 6.1.49 (HKLM-x32\…\{8633c9e1-373f-4783-8f17-ba964d9e2eb9}) (Version: 6.1.49 - Microsoft)
Nokia Software Recovery Tool 6.1.49 (x32 Version: 6.1.49 - Microsoft) Hidden
Notepad++ (HKLM-x32\…\Notepad++) (Version: 6.7.4 - Notepad++ Team)
NVIDIA 3D Vision Controller Driver 349.95 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 349.95 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 350.12 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 350.12 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.4.3.22 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.3.22 - NVIDIA Corporation)
NVIDIA Graphics Driver 350.12 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 350.12 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.33.0 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0324 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0324 - NVIDIA Corporation)
Oculus Positional Tracker Driver (Install Only) (HKLM\…\{A4390897-480A-4F6E-971A-4AA27E65657B}) (Version: 1.0.10.0 - Oculus VR, LLC)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
paint.net (HKLM\…\{DADC2AF6-DC9F-4BCF-BFCE-DCEC16EF507C}) (Version: 4.0.9 - dotPDN LLC)
PC Suite for Sony Ericsson (HKLM-x32\…\{E1252473-6306-4d5d-904D-B06AA7F38161}) (Version: 1.6.0 - )
PC Suite for Sony Ericsson (x32 Version: 1.6.0 - Sony Ericsson) Hidden
PC Suite for Sony Ericsson x64 (Version: 1.6.0 - Sony Ericsson) Hidden
PDF Complete Special Edition (HKLM-x32\…\PDF Complete) (Version: 4.0.65 - PDF Complete, Inc)
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PhoneRescue (HKLM-x32\…\PhoneRescue) (Version: 3.2.0.0 - iMobie Inc.)
PicPick (HKLM-x32\…\PicPick) (Version: 3.3.2 - NTeWORKS)
Pidgin (HKLM-x32\…\Pidgin) (Version: 2.10.11 - )
pidgin-otr 4.0.1 (HKLM-x32\…\pidgin-otr) (Version: 4.0.1 - Cypherpunks CA)
PlayReady PC Runtime amd64 (HKLM\…\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
PlayReady PC Runtime x86 (HKLM-x32\…\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Popcorn Time (HKLM-x32\…\Popcorn Time_is1) (Version: 5.5.1.2 - Popcorn Time) <==== ATTENTION
Power2Go (HKLM-x32\…\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.5706 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.5706 - CyberLink Corp.) Hidden
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
PrivaZer (HKLM-x32\…\PrivaZer) (Version: 3.0.11.0 - Goversoft LLC)
Product API Installer (x32 Version: 6.1.49 - Microsoft) Hidden
Python 2.7.5 (HKLM-x32\…\{DBDD570E-0952-475f-9453-AB88F3DD5659}) (Version: 2.7.5150 - Python Software Foundation)
QuickTime 7 (HKLM-x32\…\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.89.716.2014 - Realtek)
Recovery Manager (x32 Version: 5.5.0.4424 - CyberLink Corp.) Hidden
ReiBoot  (HKLM-x32\…\ReiBoot) (Version:  - Tenorshare, Inc.)
Reliance 3 (HKLM\…\ZTEWireless-101_is1) (Version:  - )
Remote Graphics Receiver (HKLM-x32\…\{16FC3056-90C0-4757-8A68-64D8DA846ADA}) (Version: 5.4.5 - Hewlett-Packard)
Revo Uninstaller 1.95 (HKLM-x32\…\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
RogueKiller version 12.8.0.0 (HKLM\…\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.8.0.0 - Adlice Software)
RSDLite (HKLM-x32\…\{2DAFF979-5A46-44FA-B431-DAB8F0580683}) (Version: 5.3.1 - Motorola)
SafeZone Stable 1.51.2220.62 (x32 Version: 1.51.2220.62 - Avast Software) Hidden
Samsung Kies (HKLM-x32\…\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\…\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.16.0 - SAMSUNG Electronics Co., Ltd.)
Seagate File Recovery for Windows 2.0 (HKLM-x32\…\Seagate File Recovery for WindowsNSIS) (Version: 2.0.9835 - Seagate)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\…\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.3.22 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\…\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.11.13307 - Skype Technologies S.A.)
Skype™ 7.29 (HKLM-x32\…\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.29.102 - Skype Technologies S.A.)
Sony Ericsson Symbian 9 Drivers (HKLM\…\Sony Ericsson) (Version:  - )
Sony PC Companion 2.10.181 (HKLM-x32\…\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.181 - Sony)
Steam (HKLM-x32\…\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
SteelSeries Engine (HKLM\…\SteelSeries Engine) (Version: 2.8.59.30483 - SteelSeries)
TAudioConverter 64bit version 0.9.9 (HKLM-x32\…\{35FC8349-C27B-4680-ABF1-88F7FE893586}_is1) (Version: 0.9.9 - ozok)
TeamViewer 11 (HKLM-x32\…\TeamViewer) (Version: 11.0.66695 - TeamViewer)
Telegram Desktop version 0.10.5 (HKU\S-1-5-21-4001190308-645597301-758162152-1001\…\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 0.10.5 - Telegram Messenger LLP)
TI USB 3.0 Host Controller Driver (HKLM-x32\…\InstallShield_{355FBD67-5A4F-44DA-86A1-56EEC4C20EC0}) (Version: 1.12.18.0 - Texas Instruments Inc.)
TI USB3 Host Driver (x32 Version: 1.12.18.0 - Texas Instruments Inc.) Hidden
TSHostedAppLauncher (x32 Version: 5.1.15.0 - Hewlett-Packard) Hidden
Tweaking.com - Windows Repair (HKLM-x32\…\Tweaking.com - Windows Repair) (Version: 3.9.16 - Tweaking.com)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Uplay (HKLM-x32\…\Uplay) (Version: 4.3 - Ubisoft)
USB Serial Port Driver (HKLM-x32\…\{E12118B5-C66D-42A6-B2CC-B1A861B5885E}) (Version: 1.1.13.1605 - Microsoft)
Vega 1.0 (HKLM-x32\…\Vega) (Version: 1.0 - Subgraph)
Vegas Pro 13.0 (64-bit) (HKLM\…\{1EEE0BEE-0BC8-11E5-A19E-F04DA23A5C58}) (Version: 13.0.453 - Sony)
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.4 - VideoLAN)
VMware Player (HKLM-x32\…\VMware_Player) (Version: 6.0.3 - VMware, Inc)
VMware Player (Version: 6.0.3 - VMware, Inc.) Hidden
Watch_Dogs (HKLM-x32\…\Steam App 243470) (Version:  - Ubisoft)
Welcome App (Start-up experience) (x32 Version: 12.0.14000 - Nero AG) Hidden
Wild Media Server (UPnP, DLNA, HTTP) (HKLM-x32\…\WMS) (Version: 1.70 - Evgeny Lachinov)
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.16 - WildTangent) Hidden
Win7 MAC Address Changer version 1.9.5 (HKLM-x32\…\{F9A76116-6D56-4CEA-830E-E95C168DC95B}_is1) (Version: 1.9.5 - Zokali)
Windows 7 USB/DVD Download Tool (HKLM-x32\…\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Device Recovery Tool 3.4.34 (HKLM-x32\…\{b648d7cb-1b81-4465-8010-aa9cc396c3f2}) (Version: 3.4.34 - Microsoft)
Windows Driver Package - OnePlus, Inc. (WinUSB) AndroidUsbDeviceClass  (05/24/2012 6.0.0000.00000) (HKLM\…\59AFF6524BE5C0983F2711DEB8D25D511D4F4924) (Version: 05/24/2012 6.0.0000.00000 - OnePlus, Inc.)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\…\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Phone app for desktop (HKLM-x32\…\{5F71448B-88EB-4357-9A98-8658D4C49C48}) (Version: 1.1.2726.0 - Microsoft Corporation)
WinPcap 4.1.2 (HKLM-x32\…\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
WinRAR 4.20 (32-bit) (HKLM-x32\…\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WinSCP 5.5.4 (HKLM-x32\…\winscp3_is1) (Version: 5.5.4 - Martin Prikryl)
WinUsb CoInstallers (HKLM-x32\…\{9755918A-CDF8-4F1E-8453-6359CF1A330A}) (Version: 1.1.12.1526 - Microsoft)
WinUSB Compatible ID Drivers (HKLM-x32\…\{A4A0B236-6046-4CAB-8177-1EAF61112C75}) (Version: 1.1.11.1526 - Microsoft)
WinUSB Drivers ext (HKLM-x32\…\{29BAAF65-09E5-4F52-8D15-2FAF2E23A8DC}) (Version: 1.1.24.1544 - Microsoft)
Wireshark 1.12.2 (64-bit) (HKLM-x32\…\Wireshark) (Version: 1.12.2 - The Wireshark developer community, hxxp://www.wireshark.org)
Yahoo Messenger (HKU\S-1-5-21-4001190308-645597301-758162152-1001\…\yahoomessenger) (Version: 0.8.269 - Yahoo! Inc)
Yahoo! Messenger (HKLM-x32\…\Yahoo! Messenger) (Version:  - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\…\Yahoo! Software Update) (Version:  - )
Zemana AntiMalware (HKLM-x32\…\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.50.133 - Zemana Ltd.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4001190308-645597301-758162152-1001_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Jason\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {03BB8A75-B5CE-4ADB-A9E5-3784CE25FE8B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-19] (Piriform Ltd)
Task: {0681F517-94B7-4E98-87E2-94455CE5C7BE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {0888AA80-53F0-4930-919E-4E3E66E591E1} - System32\Tasks\Tweaking.com - Windows Repair Tray Icon => C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe [2015-03-12] (Tweaking.com)
Task: {0C15D05B-5265-4232-B448-BFDCDAD2D063} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-11-12] (Adobe Systems Incorporated)
Task: {0CCDC407-16B4-4E94-AD3F-E2BD6DD37A15} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-07-10] (Google Inc.)
Task: {0E70D487-8256-49E2-BCCE-294BDD3D957F} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-06-04] (AVAST Software)
Task: {13D7C537-B2BB-4F51-B7DD-EFA8E9C06767} - System32\Tasks\{559B2D53-A328-4B90-8BDA-7D4E5C8324B7} => pcalua.exe -a C:\Users\Jason\Downloads\2014_09_02_00_webvulnscan95.exe -d C:\Users\Jason\Downloads
Task: {1A898A8A-4B6F-473B-B587-2991509F1F8D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-08-23] (HP Inc.)
Task: {1E92B1D5-E6B3-4593-868D-77362333E855} - System32\Tasks\{776F2551-D6B4-4108-A88F-AED63AB115FA} => Chrome.exe
Task: {24089FBD-FC33-409F-8A87-6239CA873171} - System32\Tasks\RealDownloader Update Check => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe
Task: {28676A75-C713-4A8D-A36F-21C0922354F0} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-11-12] (AVAST Software)
Task: {2FB9E868-9C29-4A2C-A16A-90C32F3D6D17} - System32\Tasks\{8846CE81-000A-4795-B937-3A7E7F5C6AFB} => pcalua.exe -a "H:\Project IGI\SETUP.EXE" -d "H:\Project IGI"
Task: {311D525B-6174-4B18-9B81-8E279D372DA2} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4001190308-645597301-758162152-1001Core => C:\Users\Jason\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-19] (Facebook Inc.)
Task: {3339030D-3B8F-48FA-9531-1216C8CF1627} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {33788D8F-88ED-4981-8261-06A637D010C3} - System32\Tasks\{8506CD8A-7645-4B38-A0E2-7A2E06C0F072} => pcalua.exe -a C:\Users\Jason\Downloads\intellitamper_v2.07.exe -d C:\Users\Jason\Downloads
Task: {37447793-821C-4956-A4A8-4C7131233B73} - System32\Tasks\AdobeAAMUpdater-1.0-Jason-HP-Jason => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-04-28] (Adobe Systems Incorporated)
Task: {3C8A7297-861B-4681-880B-31F2EC7D07B2} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4001190308-645597301-758162152-1001UA => C:\Users\Jason\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-11] (Dropbox, Inc.)
Task: {408901EC-AB4A-4813-A792-B0871058A334} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4001190308-645597301-758162152-1001UA => C:\Users\Jason\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-19] (Facebook Inc.)
Task: {467FB4C6-C92D-41E6-9D41-BB34D23DB8FF} - System32\Tasks\{AC24C4C1-7759-4581-99CD-65BB0F56E3E5} => pcalua.exe -a "C:\Users\Jason\AppData\Roaming\VIP72 Socks Client\ProxifierPE\Proxifier.exe" -d "C:\Users\Jason\AppData\Roaming\VIP72 Socks Client"
Task: {47DB282C-A465-42B1-BE43-F28C2378CF40} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
Task: {4F736414-8C9D-4BE8-BE5D-972E72323C03} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)
Task: {52B91090-A511-445E-8BD6-ED897134AFED} - System32\Tasks\Rersipy Client => C:\Program Files (x86)\Lcophtergo\igasy.exe
Task: {5E0F78B6-FC6F-48A1-95CD-DDCD981AE480} - System32\Tasks\SmartShare => C:\Program Files (x86)\LG Software\LG Smart Share\SmartShareStart.exe
Task: {5F5CC9DD-3723-442E-86C8-CF766E855C95} - System32\Tasks\{3FC2A8D8-9E3A-4F11-8A86-3225C3DF303D} => pcalua.exe -a "E:\Project IGI\SETUP.EXE" -d "E:\Project IGI"
Task: {7345CEAF-1401-40E4-AFC3-C7D39CBD368B} - System32\Tasks\PrivaZer_SkipUAC => C:\Program Files (x86)\PrivaZer\PrivaZer.exe [2016-10-28] (Goversoft LLC)
Task: {79CE45B3-FCC0-46F2-93E6-C22D4EFB8BE0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-05-09] (Hewlett-Packard)
Task: {818C871D-67EC-49E5-9C0C-41D4446332ED} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4001190308-645597301-758162152-1001Core => C:\Users\Jason\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-11] (Dropbox, Inc.)
Task: {822B3219-CE70-48C9-BC2F-CB294619A1A8} - System32\Tasks\{AD55CA11-4121-497B-96DE-74A84940F151} => pcalua.exe -a "H:\road rash\New Folder\DESKTOP.EXE" -d "H:\road rash\New Folder"
Task: {8C811C2B-3317-4C34-8320-9ADDF7BA70BD} - System32\Tasks\Common Software Service => C:\Program Files (x86)\Common Software\CommonSoftware.exe <==== ATTENTION
Task: {9C316A8A-82BA-403F-9EC9-F8116104981F} - System32\Tasks\{325DFAB7-E4E6-45AC-8AD5-F86A63D17F30} => pcalua.exe -a "H:\road rash\New Folder\RASHDEMO.EXE" -d "H:\road rash\New Folder"
Task: {A7B13D08-D5E0-41A8-8F3C-9103ABD69B12} - System32\Tasks\{AFE6F5EB-B5C2-4D9A-851B-753027C00096} => Chrome.exe
Task: {C5C094FC-0532-4F8E-B508-60A2E058EE7B} - System32\Tasks\HPCeeScheduleForJason => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
Task: {C5FFE074-0DF0-4EBE-88D0-A514C9AC842D} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-08-18] (HP Inc.)
Task: {C85D7AB1-6BC3-4D01-8ED8-C604260C1FBB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-07-10] (Google Inc.)
Task: {D65D6B6B-264E-48D7-8CCC-EA89E87607A6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-08-03] (HP Inc.)
Task: {E63AE958-E260-42C9-9705-C3892FD118DD} - System32\Tasks\SafeZone scheduled Autoupdate 1478896838 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-09-06] (Avast Software)
Task: {FAD66820-F3AC-43CA-8D42-94D8CDC51B37} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-08-23] (HP Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4001190308-645597301-758162152-1001Core.job => C:\Users\Jason\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4001190308-645597301-758162152-1001UA.job => C:\Users\Jason\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4001190308-645597301-758162152-1001Core.job => C:\Users\Jason\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4001190308-645597301-758162152-1001UA.job => C:\Users\Jason\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForJason.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\Jason\Favorites\PSPVC  PSP Video Converter.lnk -> hxxp://pspvc.nswardh.com/
Shortcut: C:\Users\Jason\Favorites\PSPVC on Twitter.lnk -> hxxp://twitter.com/swardh
Shortcut: C:\Users\Jason\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ICQ\icq.com.lnk -> hxxp://www.icq.com/

==================== Loaded Modules (Whitelisted) ==============

2012-06-01 09:59 - 2015-04-09 03:00 - 00116552 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-04-06 15:13 - 2016-04-06 15:13 - 00094888 _____ () C:\Program Files (x86)\Common Files\Microsoft\Care Suite\ADUService\ADUService.exe
2016-09-01 18:12 - 2016-09-01 18:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-09-01 18:12 - 2016-09-01 18:12 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-03-15 22:36 - 2015-07-27 21:46 - 00592384 _____ () C:\Program Files (x86)\i-Funbox DevTeam\exifext_x64.dll
2016-09-01 18:12 - 2016-09-01 18:12 - 00236856 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxslt.dll
2015-03-17 19:51 - 2015-03-17 19:51 - 00216576 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2015-01-20 19:55 - 2014-02-14 10:25 - 00406528 _____ () C:\Program Files\Reliance 3\bin\MonServiceUDisk.exe
2016-11-12 02:05 - 2016-11-12 02:05 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-11-15 21:38 - 2016-11-15 21:38 - 03129808 _____ () C:\Program Files\AVAST Software\Avast\defs\16111501\algo.dll
2016-11-12 02:05 - 2016-11-12 02:05 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-11-16 23:44 - 2016-11-16 23:44 - 03129808 _____ () C:\Program Files\AVAST Software\Avast\defs\16111601\algo.dll
2013-11-26 23:52 - 2016-09-08 08:44 - 00784672 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-01-21 06:19 - 2016-09-01 06:32 - 04969248 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-01-21 06:19 - 2016-09-01 06:32 - 01563936 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-01-21 06:19 - 2016-09-01 06:32 - 01195296 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2014-06-24 08:25 - 2016-10-13 07:28 - 02321696 _____ () C:\Program Files (x86)\Steam\video.dll
2014-08-30 13:51 - 2016-01-27 13:19 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-08-30 13:51 - 2016-01-27 13:19 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-08-30 13:51 - 2016-01-27 13:19 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-08-30 13:51 - 2016-01-27 13:19 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-08-30 13:51 - 2016-01-27 13:19 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2013-11-26 23:55 - 2016-10-13 07:28 - 00836896 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2016-11-12 15:38 - 2016-07-05 03:47 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2016-08-05 03:39 - 2016-10-10 21:59 - 00035792 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
2016-11-12 02:01 - 2016-10-10 21:59 - 00145864 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\pyexpat.pyd
2016-11-12 02:01 - 2016-10-10 21:59 - 00019408 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\faulthandler.pyd
2016-11-12 02:01 - 2016-10-10 21:59 - 00116688 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\pywintypes27.dll
2016-08-05 03:39 - 2016-10-10 21:59 - 00100296 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\_ctypes.pyd
2016-08-05 03:39 - 2016-10-10 21:59 - 00018888 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\select.pyd
2016-08-05 03:39 - 2016-11-08 04:29 - 00019760 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
2016-08-05 03:39 - 2016-10-10 21:59 - 00694224 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\unicodedata.pyd
2016-11-12 02:01 - 2016-11-08 04:28 - 00020816 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
2016-08-05 03:39 - 2016-10-10 22:00 - 00123856 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
2016-11-12 02:01 - 2016-11-08 04:28 - 01682760 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
2016-11-12 02:01 - 2016-11-08 04:28 - 00020808 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00105928 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32api.pyd
2016-08-05 03:39 - 2016-11-08 04:29 - 00021312 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.crt.compiled._winffi_crt.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 00052024 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 00038696 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\fastpath.pyd
2016-11-12 02:01 - 2016-10-10 21:59 - 00392144 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\pythoncom27.dll
2016-11-12 02:01 - 2016-10-10 22:01 - 00020936 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\mmapfile.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00024528 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32event.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00116176 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32security.pyd
2016-08-05 03:39 - 2016-11-08 04:29 - 00381752 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00124880 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32file.pyd
2016-08-05 03:39 - 2016-11-08 04:29 - 00025424 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.kernel32.compiled._winffi_kernel32.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00024016 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00175560 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32gui.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00030160 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32pipe.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00043472 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32process.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00048592 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32service.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00057808 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32evtlog.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00024016 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32profile.pyd
2016-11-12 02:01 - 2016-11-08 04:28 - 00246592 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 00026456 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-08-05 03:39 - 2016-10-10 22:00 - 00241104 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\_jpegtran.pyd
2016-11-12 02:01 - 2016-11-08 04:28 - 00020280 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00028616 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32ts.pyd
2016-08-05 03:39 - 2016-11-08 04:29 - 00023376 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
2016-08-05 03:39 - 2016-11-08 04:29 - 00020800 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-08-05 03:39 - 2016-11-08 04:29 - 00019776 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.winerror._winffi_winerror.pyd
2016-08-05 03:39 - 2016-11-08 04:29 - 00020800 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.wininet._winffi_wininet.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00350152 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\winxpgui.pyd
2016-08-05 03:39 - 2016-11-08 04:29 - 00022352 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\winverifysignature.compiled._VerifySignature.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 00024392 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
2016-11-12 02:01 - 2016-10-10 21:57 - 00036296 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\librsync.dll
2016-11-12 02:01 - 2016-11-08 04:29 - 00084280 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
2016-11-12 02:01 - 2016-11-08 04:29 - 01826096 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
2016-08-05 03:39 - 2016-10-10 21:59 - 00083912 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\sip.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 00531248 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 03928880 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 01972528 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 00133424 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 00224056 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 00207672 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
2016-08-05 03:39 - 2016-11-08 04:29 - 00020288 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.user32._winffi_user32.pyd
2016-11-12 02:01 - 2016-10-10 22:03 - 00017864 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\libEGL.dll
2016-11-12 02:01 - 2016-10-10 22:04 - 01631184 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2016-11-12 02:01 - 2016-11-08 04:29 - 00042808 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtWebChannel.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 00168760 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtWebEngineWidgets.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 00357680 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
2016-08-05 03:39 - 2016-10-10 22:01 - 00060880 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32print.pyd
2016-08-05 03:39 - 2016-11-08 04:29 - 00024904 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.winhttp.compiled._winffi_winhttp.pyd
2016-11-12 02:01 - 2016-11-08 04:29 - 00546096 _____ () C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
2016-11-12 02:05 - 2016-11-12 02:05 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-03-17 19:37 - 2015-03-17 19:37 - 00221184 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2015-03-17 19:31 - 2015-03-17 19:31 - 00038400 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2015-03-17 19:24 - 2015-03-17 19:24 - 00050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2015-03-17 19:37 - 2015-03-17 19:37 - 00070656 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2015-03-17 19:40 - 2015-03-17 19:40 - 00744448 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-20.dll
2015-04-01 15:51 - 2015-05-01 22:22 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2014-06-12 18:22 - 2014-06-12 18:22 - 01261272 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2016-11-12 15:38 - 2016-08-05 02:26 - 49825056 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.winxp\libcef.dll
2014-10-10 09:37 - 2014-10-10 09:37 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Jason\Desktop\aadhar back.jpg:com.dropbox.attributes [420]
AlternateDataStreams: C:\Users\Jason\Desktop\aadhar front.jpg:com.dropbox.attributes [426]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2016-10-28 04:23 - 2016-11-13 05:37 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4001190308-645597301-758162152-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Jason\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^OculusConfigUtil.lnk => C:\Windows\pss\OculusConfigUtil.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Jason^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Jason^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup
MSCONFIG\startupreg: 001d46a7 => C:\Users\Jason\AppData\Local\Temp\world-super-ext.exe
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Aquarius Soft PC Shutdown => "C:\Program Files (x86)\Aquarius Soft\PC Shutdown\assdtray.exe" /startup
MSCONFIG\startupreg: ares => "C:\Program Files (x86)\Ares\Ares.exe" -h
MSCONFIG\startupreg: BeatsOSDApp => C:\Program Files\IDT\WDM\beats64.exe
MSCONFIG\startupreg: BlueStacks Agent => C:\Program Files (x86)\BlueStacks\HD-Agent.exe
MSCONFIG\startupreg: Broadcom Wireless Manager UI => C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe
MSCONFIG\startupreg: CloudSystemBooster => C:\Program Files (x86)\Anvisoft\Cloud System Booster\CloudSystemBooster.exe hide=true
MSCONFIG\startupreg: DAEMON Tools Lite Automount => "C:\Program Files\DAEMON Tools Lite\DTAgent.exe" -autorun
MSCONFIG\startupreg: Facebook Update => "C:\Users\Jason\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: HP Software Update => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpsysdrv => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
MSCONFIG\startupreg: icq => C:\Users\Jason\AppData\Roaming\ICQM\icq.exe -CU
MSCONFIG\startupreg: iFunBoxConnector => "C:\Program Files (x86)\i-Funbox DevTeam\ifb_conn.exe"
MSCONFIG\startupreg: IntelliPoint => "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: Messenger (Yahoo!) => "C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe" -quiet
MSCONFIG\startupreg: mRouterConfig => "C:\Program Files (x86)\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe"
MSCONFIG\startupreg: Norton Online Backup => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: PC Suite for Smartphones => "C:\Program Files (x86)\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
MSCONFIG\startupreg: PDF Complete => C:\Program Files (x86)\PDF Complete\pdfsty.exe
MSCONFIG\startupreg: PicPick Start => C:\Program Files (x86)\PicPick\picpick.exe /startup
MSCONFIG\startupreg: Pidgin => "C:\Program Files (x86)\Pidgin\pidgin.exe"
MSCONFIG\startupreg: Pinger => "C:\Program Files (x86)\Pinger\Pinger.exe"
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: SilentCleanService => C:\Program Files (x86)\iMobie\PhoneRescue\${CHECK_RUNSERVICE_NAME}
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Sony PC Companion => "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background
MSCONFIG\startupreg: SteelSeries Engine => C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SwitchBoard => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exe
MSCONFIG\startupreg: Viber => "C:\Users\Jason\AppData\Local\Viber\Viber.exe" StartMinimized
MSCONFIG\startupreg: Yahoo Messenger => "C:\Users\Jason\AppData\Local\yahoomessenger\app-0.8.269\Yahoo Messenger.exe"
MSCONFIG\startupreg: Yahoo Messenger Updater => "C:\Users\Jason\AppData\Roaming\Yahoo Messenger\YMUpdater\YMUpdater.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{D44CAD8C-F98B-424F-874C-4C1A9EEC4409}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A3F2200F-4FDC-4BFD-983D-901A322EF397}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{39D5ED68-F9EB-4A32-BA1C-5D6ADB73AD01}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{2C763228-8773-4867-A614-D28483A19E34}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{109CB37B-D2CF-40F7-A80F-2458DCA25ED6}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{BC1800AF-2CE0-45AE-8295-539217E5AC82}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{E150BC16-5FA7-4DD4-8041-1553FD304DA3}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{A9192D79-31A5-4EDC-BA42-D60ED9C41922}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{07F96E3F-6E58-4DB4-B044-297501AA7FA6}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{6CA95514-89A0-4CB6-95D3-3A9880C2F784}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [{5C6AE4B4-BE42-486D-877B-45E5965E22F1}] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [{79B84B54-3C02-4E40-B3D7-0410F12BF37A}] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [TCP Query User{11C3F12D-3C35-416C-A65D-61E3F4C4225E}C:\program files (x86)\steam\steamapps\common\half-life\hl.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\half-life\hl.exe
FirewallRules: [UDP Query User{E8F67181-4E3A-48B1-8969-4E43C0FA9616}C:\program files (x86)\steam\steamapps\common\half-life\hl.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\half-life\hl.exe
FirewallRules: [{92D583F9-4480-44A1-97A7-A4064999539A}] => (Block) C:\program files (x86)\steam\steamapps\common\half-life\hl.exe
FirewallRules: [{7379491E-DDCB-41B3-8EDB-F5CCA2721397}] => (Block) C:\program files (x86)\steam\steamapps\common\half-life\hl.exe
FirewallRules: [TCP Query User{4D5F2BE6-C16E-4EED-A04D-8524620339E3}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{70BC6CC9-C15D-48BD-BA42-EB249FC426E0}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{F40F5782-4247-453C-9762-FB13077C4086}] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{E6E03964-78F0-4239-8C1A-D4EE52A1C522}] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{F4B10851-0989-4EA0-84C3-60EE5E1AB3BC}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\xchat\xchat.exe] => Enabled:XChat IRC Client

==================== Restore Points =========================


==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/16/2016 05:45:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 24

Error: (11/16/2016 05:45:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 23

Error: (11/16/2016 05:45:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 22

Error: (11/16/2016 05:45:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 21

Error: (11/16/2016 05:45:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 20

Error: (11/16/2016 05:45:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 17

Error: (11/16/2016 05:45:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 16

Error: (11/16/2016 05:45:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 15

Error: (11/16/2016 05:45:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 14

Error: (11/16/2016 05:45:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 13


System errors:
=============
Error: (11/17/2016 12:46:24 AM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (11/16/2016 05:42:25 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The BlueStacks Android Service service terminated with the following error:
An exception occurred in the service when handling the control request.

Error: (11/16/2016 05:42:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Wondershare Application Framework Service service failed to start due to the following error:
The system cannot find the file specified.

Error: (11/16/2016 02:55:46 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: The server {F9717507-6651-4EDB-BFF7-AE615179BCCF} did not register with DCOM within the required timeout.

Error: (11/15/2016 09:36:53 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The BlueStacks Android Service service terminated with the following error:
An exception occurred in the service when handling the control request.

Error: (11/15/2016 09:36:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Wondershare Application Framework Service service failed to start due to the following error:
The system cannot find the file specified.

Error: (11/15/2016 09:35:26 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 17:55:33 on ‎15-‎11-‎2016 was unexpected.

Error: (11/15/2016 01:04:10 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Windows Update service hung on starting.

Error: (11/15/2016 01:02:11 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

Error: (11/15/2016 12:56:56 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The BlueStacks Android Service service terminated with the following error:
An exception occurred in the service when handling the control request.


CodeIntegrity:
===================================
  Date: 2016-11-13 05:37:33.675
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-11-13 05:37:33.581
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-11-13 05:37:33.472
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-11-13 05:37:33.378
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-31 20:08:15.489
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-31 20:08:15.386
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-31 20:08:15.282
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-31 20:08:15.178
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-28 04:23:11.055
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-28 04:23:10.951
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz
Percentage of memory in use: 43%
Total physical RAM: 8148 MB
Available physical RAM: 4570.95 MB
Total Virtual: 16294.18 MB
Available Virtual: 12519.51 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:457.7 GB) (Free:29.61 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:17.12 GB) (Free:2.14 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive f: () (Fixed) (Total:97.65 GB) (Free:25.81 GB) NTFS
Drive g: (Local Disk) (Fixed) (Total:292.97 GB) (Free:22.1 GB) NTFS
Drive h: () (Fixed) (Total:292.97 GB) (Free:46.13 GB) NTFS
Drive i: () (Fixed) (Total:247.91 GB) (Free:99.3 GB) NTFS
Drive j: (New Volume) (Fixed) (Total:261.28 GB) (Free:75.21 GB) NTFS
Drive k: (Local Disk) (Fixed) (Total:195.31 GB) (Free:13.33 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 4158BAD4)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=457.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=456.6 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=17.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: A9F8A9F8)
Partition 1: (Active) - (Size=97.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=833.8 GB) - (Type=OF Extended)

==================== End of Addition.txt ============================
 

Hey, things are looking real good now.

Here's the Fixlog

Fix result of Farbar Recovery Scan Tool (x64) Version: 12-11-2016
Ran by [removed] (17-11-2016 23:06:12) Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-4001190308-645597301-758162152-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-4001190308-645597301-758162152-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
FF ProfilePath: C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\qtj95ygw.default-1458962998159\Profiles\qtj95ygw.default-1458962998159 [not found]
FF HKU\S-1-5-21-4001190308-645597301-758162152-1001\…\SeaMonkey\Extensions: [[removed]] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi => not found
CHR Extension: (26c8690aab4ced4ac840b6bf26e16a77_2) - C:\Program Files (x86)\Google\Chrome\Application\26c8690aab4ced4ac840b6bf26e16a77_2 [2016-06-01]
CHR Extension: (26c8690aab4ced4ac840b6bf26e16a77) - C:\Program Files (x86)\Google\Chrome\Application\26c8690aab4ced4ac840b6bf26e16a77 [2016-02-18]
S3 rpcapd; "%ProgramFiles(x86)%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles(x86)%\WinPcap\rpcapd.ini" [X]
S2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.3.0.5\WsAppService.exe [X]
S3 WsDrvInst; C:\Program Files (x86)\Wondershare\Dr.Fone for iOS\DriverInstall.exe [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 rvrsbdib; \??\C:\Windows\system32\drivers\ngiodriver_x64 [X]
2016-10-26 23:09 - 2016-10-29 12:58 - 00000000 ____D C:\Windows\system32\log
2016-10-26 23:05 - 2016-11-05 03:21 - 00000000 ____D C:\Program Files (x86)\UvConverter
2016-10-26 23:05 - 2016-10-28 03:52 - 00000000 _____ C:\Users\Public\Documents\report.dat
2016-10-26 23:05 - 2016-10-26 23:08 - 00000003 _____ C:\Windows\SysWOW64\hoewmds
2016-10-26 23:05 - 2016-10-26 23:05 - 00000000 _____ C:\Users\Public\Documents\temp.dat
2016-10-26 23:03 - 2016-10-26 23:03 - 00000000 ____D C:\Program Files (x86)\isxthmba
2016-10-22 00:25 - 2016-10-22 00:25 - 00000000 ____D C:\ProgramData\Avira
2016-10-22 00:25 - 2016-10-22 00:25 - 00000000 ____D C:\ProgramData\Avg
2016-10-22 00:24 - 2016-10-22 00:24 - 00006008 _____ C:\Windows\System32\Tasks\Rersipy Client
2016-10-22 00:23 - 2016-10-22 00:24 - 00000000 ____D C:\Users\Jason\AppData\Local\Merhogh
2016-11-06 18:51 - 2013-01-18 16:45 - 00000000 ____D C:\Users\Jason\AppData\Roaming\uTorrent
2016-10-28 06:30 - 2014-01-25 17:47 - 00000939 _____ C:\Users\Public\Desktop\µTorrent.lnk
2016-10-28 06:30 - 2013-01-18 16:46 - 00000951 _____ C:\ProgramData\Microsoft\Windows\Start Menu\µTorrent.lnk
2016-10-22 00:24 - 2013-01-18 16:46 - 00000000 ____D C:\Program Files (x86)\uTorrent
Task: {2FB9E868-9C29-4A2C-A16A-90C32F3D6D17} - System32\Tasks\{8846CE81-000A-4795-B937-3A7E7F5C6AFB} => pcalua.exe -a "H:\Project IGI\SETUP.EXE" -d "H:\Project IGI"
Task: {52B91090-A511-445E-8BD6-ED897134AFED} - System32\Tasks\Rersipy Client => C:\Program Files (x86)\Lcophtergo\igasy.exe
Task: {5F5CC9DD-3723-442E-86C8-CF766E855C95} - System32\Tasks\{3FC2A8D8-9E3A-4F11-8A86-3225C3DF303D} => pcalua.exe -a "E:\Project IGI\SETUP.EXE" -d "E:\Project IGI"
Task: {822B3219-CE70-48C9-BC2F-CB294619A1A8} - System32\Tasks\{AD55CA11-4121-497B-96DE-74A84940F151} => pcalua.exe -a "H:\road rash\New Folder\DESKTOP.EXE" -d "H:\road rash\New Folder"
Task: {8C811C2B-3317-4C34-8320-9ADDF7BA70BD} - System32\Tasks\Common Software Service => C:\Program Files (x86)\Common Software\CommonSoftware.exe <==== ATTENTION
Task: {9C316A8A-82BA-403F-9EC9-F8116104981F} - System32\Tasks\{325DFAB7-E4E6-45AC-8AD5-F86A63D17F30} => pcalua.exe -a "H:\road rash\New Folder\RASHDEMO.EXE" -d "H:\road rash\New Folder"
C:\Users\Jason\AppData\Local\Temp\dllnt_dump.dll
C:\Program Files (x86)\Lcophtergo\igasy.exe
C:\Program Files (x86)\Common Software\CommonSoftware.exe
C:\Users\Jason\AppData\Local\Temp\world-super-ext.exe
CMD: ipconfig /flushdns
CMD: ipconfig /release
CMD: ipconfig /renew
RemoveProxy:
Hosts:
Emptytemp:
*****************

Processes closed successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\S-1-5-21-4001190308-645597301-758162152-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5}" => key removed successfully
HKCR\Wow6432Node\CLSID\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5} => key not found.
"HKU\S-1-5-21-4001190308-645597301-758162152-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66}" => key removed successfully
HKCR\CLSID\{012E1000-F331-11DB-8314-0800200C9A66} => key not found.
C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\qtj95ygw.default-1458962998159\Profiles\qtj95ygw.default-1458962998159 => path removed successfully
HKU\S-1-5-21-4001190308-645597301-758162152-1001\Software\Mozilla\SeaMonkey\Extensions\\[removed] => value removed successfully
C:\Program Files (x86)\Google\Chrome\Application\26c8690aab4ced4ac840b6bf26e16a77_2 => moved successfully
C:\Program Files (x86)\Google\Chrome\Application\26c8690aab4ced4ac840b6bf26e16a77 => moved successfully
rpcapd => service removed successfully
WsAppService => service removed successfully
WsDrvInst => service removed successfully
catchme => service removed successfully
rvrsbdib => service removed successfully
C:\Windows\system32\log => moved successfully
C:\Program Files (x86)\UvConverter => moved successfully
C:\Users\Public\Documents\report.dat => moved successfully
C:\Windows\SysWOW64\hoewmds => moved successfully
C:\Users\Public\Documents\temp.dat => moved successfully
C:\Program Files (x86)\isxthmba => moved successfully
C:\ProgramData\Avira => moved successfully
C:\ProgramData\Avg => moved successfully
C:\Windows\System32\Tasks\Rersipy Client => moved successfully
C:\Users\Jason\AppData\Local\Merhogh => moved successfully
C:\Users\Jason\AppData\Roaming\uTorrent => moved successfully
C:\Users\Public\Desktop\µTorrent.lnk => moved successfully
C:\ProgramData\Microsoft\Windows\Start Menu\µTorrent.lnk => moved successfully
C:\Program Files (x86)\uTorrent => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2FB9E868-9C29-4A2C-A16A-90C32F3D6D17}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2FB9E868-9C29-4A2C-A16A-90C32F3D6D17}" => key removed successfully
C:\Windows\System32\Tasks\{8846CE81-000A-4795-B937-3A7E7F5C6AFB} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{8846CE81-000A-4795-B937-3A7E7F5C6AFB}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{52B91090-A511-445E-8BD6-ED897134AFED}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{52B91090-A511-445E-8BD6-ED897134AFED}" => key removed successfully
C:\Windows\System32\Tasks\Rersipy Client => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Rersipy Client" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5F5CC9DD-3723-442E-86C8-CF766E855C95}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5F5CC9DD-3723-442E-86C8-CF766E855C95}" => key removed successfully
C:\Windows\System32\Tasks\{3FC2A8D8-9E3A-4F11-8A86-3225C3DF303D} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{3FC2A8D8-9E3A-4F11-8A86-3225C3DF303D}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{822B3219-CE70-48C9-BC2F-CB294619A1A8}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{822B3219-CE70-48C9-BC2F-CB294619A1A8}" => key removed successfully
C:\Windows\System32\Tasks\{AD55CA11-4121-497B-96DE-74A84940F151} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{AD55CA11-4121-497B-96DE-74A84940F151}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8C811C2B-3317-4C34-8320-9ADDF7BA70BD}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8C811C2B-3317-4C34-8320-9ADDF7BA70BD}" => key removed successfully
C:\Windows\System32\Tasks\Common Software Service => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Common Software Service" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9C316A8A-82BA-403F-9EC9-F8116104981F}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9C316A8A-82BA-403F-9EC9-F8116104981F}" => key removed successfully
C:\Windows\System32\Tasks\{325DFAB7-E4E6-45AC-8AD5-F86A63D17F30} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{325DFAB7-E4E6-45AC-8AD5-F86A63D17F30}" => key removed successfully
C:\Users\Jason\AppData\Local\Temp\dllnt_dump.dll => moved successfully
"C:\Program Files (x86)\Lcophtergo\igasy.exe" => not found.
"C:\Program Files (x86)\Common Software\CommonSoftware.exe" => not found.
"C:\Users\Jason\AppData\Local\Temp\world-super-ext.exe" => not found.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= ipconfig /release =========


Windows IP Configuration

No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.
No operation can be performed on Bluetooth Network Connection while it has its media disconnected.
No operation can be performed on Local Area Connection while it has its media disconnected.

Wireless LAN adapter Wireless Network Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Ethernet adapter Bluetooth Network Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::3dbb:132b:c069:618c%12
   Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Ethernet adapter VMware Network Adapter VMnet1:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::e9d6:55b3:dc40:cb6c%18
   Autoconfiguration IPv4 Address. . : 169.254.203.108
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

Ethernet adapter VMware Network Adapter VMnet8:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::10a5:99b0:d04f:8f3%19
   Autoconfiguration IPv4 Address. . : 169.254.8.243
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

========= End of CMD: =========


========= ipconfig /renew =========


Windows IP Configuration

No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.
No operation can be performed on Bluetooth Network Connection while it has its media disconnected.
No operation can be performed on Local Area Connection while it has its media disconnected.

Wireless LAN adapter Wireless Network Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Ethernet adapter Bluetooth Network Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::3dbb:132b:c069:618c%12
   IPv4 Address. . . . . . . . . . . : 192.168.0.102
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.1

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Ethernet adapter VMware Network Adapter VMnet1:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::e9d6:55b3:dc40:cb6c%18
   Autoconfiguration IPv4 Address. . : 169.254.203.108
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

Ethernet adapter VMware Network Adapter VMnet8:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::10a5:99b0:d04f:8f3%19
   Autoconfiguration IPv4 Address. . : 169.254.8.243
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

========= End of CMD: =========


========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-4001190308-645597301-758162152-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-4001190308-645597301-758162152-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully


========= End of RemoveProxy: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 12582912 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 59868943 B
Java, Flash, Steam htmlcache => 45038393 B
Windows/system/drivers => 2171366 B
Edge => 0 B
Chrome => 322063590 B
Firefox => 336978514 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 33058 B
systemprofile32 => 131919 B
LocalService => 0 B
NetworkService => 2494 B
Jason => 45162805 B
UpdatusUser => 0 B
Guest => 34719 B

RecycleBin => 4636286041 B
EmptyTemp: => 5.1 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 23:39:14 ====

Here's the report


QuickScan 32-bit v0.9.9.152
—————————
Scan date:  Sun Nov 20 17:36:22 2016
Machine ID: 60BC2866



No infection found.
——————-



Processes
———
(unsigned)  HP TouchSmart Calendar Sync Service      7860    C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe

(verified)  Avast Antivirus                          2536    C:\Program Files\AVAST Software\Avast\avastui.exe
(verified)  Dropbox                                  2172    C:\Users\Jason\AppData\Roaming\Dropbox\bin\Dropbox.exe
(verified)  f.lux                                    2896    C:\Users\Jason\AppData\Local\FluxSoftware\Flux\flux.exe
(verified)  Firefox                                  7664    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(verified)  Firefox                                  4228    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
(verified)  Java Platform SE Auto Updater            5512    C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(verified)  Java Platform SE Auto Updater            2664    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(verified)  Microsoft OneNote                        3116    C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(verified)  Microsoft® Windows® Operating System     6084    C:\Windows\SysWOW64\rundll32.exe
(verified)  NVIDIA Backend                           4556    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(verified)  Steam Client Bootstrapper                2888    C:\Program Files (x86)\Steam\Steam.exe
(verified)  Steam Client WebHelper                   1232    C:\Program Files (x86)\Steam\bin\cef\cef.winxp\steamwebhelper.exe
(verified)  Steam Client WebHelper                   5996    C:\Program Files (x86)\Steam\bin\cef\cef.winxp\steamwebhelper.exe
(verified)  Steam Client WebHelper                   6864    C:\Program Files (x86)\Steam\bin\cef\cef.winxp\steamwebhelper.exe
(verified)  ZAM                                      2876    C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe


Network activity
—————-
Process Dropbox.exe (2172) connected on port 443 (HTTP over SSL) –> [removed]
Process ZAM.exe (2876) connected on port 80 (HTTP) –> [removed]
Process ZAM.exe (2876) connected on port 80 (HTTP) –> [removed]
Process ZAM.exe (2876) connected on port 80 (HTTP) –> [removed]
Process ZAM.exe (2876) connected on port 80 (HTTP) –> [removed]
Process ZAM.exe (2876) connected on port 80 (HTTP) –> [removed]
Process Steam.exe (2888) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 443 (HTTP over SSL) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process steamwebhelper.exe (5996) connected on port 80 (HTTP) –> [removed]
Process firefox.exe (7664) connected on port 443 (HTTP over SSL) –> [removed]
Process firefox.exe (7664) connected on port 443 (HTTP over SSL) –> [removed]
Process firefox.exe (7664) connected on port 443 (HTTP over SSL) –> [removed]
Process firefox.exe (7664) connected on port 80 (HTTP) –> [removed]
Process firefox.exe (7664) connected on port 443 (HTTP over SSL) –> [removed]
Process firefox.exe (7664) connected on port 443 (HTTP over SSL) –> [removed]
Process firefox.exe (7664) connected on port 80 (HTTP) –> [removed]
Process firefox.exe (7664) connected on port 80 (HTTP) –> [removed]
Process firefox.exe (7664) connected on port 443 (HTTP over SSL) –> [removed]

Process Steam.exe (2888) listens on ports: 27036


Autoruns and critical files
—————————
(verified)  Avast Antivirus                          C:\Program Files\AVAST Software\Avast\avastui.exe
(verified)  Dropbox                                  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Dropbox.exe
(verified)  Dropbox Update                           C:\Users\Jason\AppData\Local\Dropbox\Update\DropboxUpdate.exe
(verified)  f.lux                                    C:\Users\Jason\AppData\Local\FluxSoftware\Flux\flux.exe
(verified)  Facebook Update                          C:\Users\Jason\AppData\Local\Facebook\Update\FacebookUpdate.exe
(unsigned)  iFunBox                                  C:\Program Files (x86)\i-Funbox DevTeam\iFunBox_x64.exe
(verified)  Java Platform SE Auto Updater            C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(verified)  Microsoft OneNote                        C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(verified)  Microsoft® Windows® Operating System     c:\Windows\System32\userinit.exe
(verified)  Steam Client Bootstrapper                C:\Program Files (x86)\Steam\Steam.exe


Browser plugins
—————
(verified)  Adobe Acrobat                            C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll
(verified)  Adobe Acrobat                            C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
(verified)  Adobe Content Decryption Module for Fir  C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\tseaflte.default-1477925802081\gmp-eme-adobe\17\eme-adobe.dll
(verified)  AdobeAAMDetect                           C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll
(verified)  Bitdefender QuickScan                    C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\tseaflte.default-1477925802081\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
(verified)  Bonjour                                  C:\Program Files (x86)\Bonjour\mdnsNSP.dll
(verified)  Bonjour                                  C:\Program Files\Bonjour\mdnsNSP.dll
(verified)  Facebook Video Calling Plugin            C:\Users\Jason\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
(verified)  gmpopenh264.dll                          C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\tseaflte.default-1477925802081\gmp-gmpopenh264\1.6\gmpopenh264.dll
(verified)  Google Update                            C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll
(verified)  HP Network Check                         c:\program files (x86)\hewlett-packard\hp support framework\resources\hpnetworkcheck\hpnetworkcheckplugin.dll
(verified)  IE Webrep plugin                         c:\program files\avast software\Avast\aswwebrepie.dll
(verified)  Intel® Identity Protection Technology    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
(verified)  Intel® Identity Protection Technology    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
(verified)  Internet Explorer                        C:\Windows\SysWOW64\ieframe.dll
(verified)  Java Deployment Toolkit 8.0.730.2        C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll
(verified)  Java(TM) Platform SE 8 U73               c:\program files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll
(verified)  Java(TM) Platform SE 8 U73               C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll
(verified)  Java(TM) Platform SE 8 U73               c:\program files (x86)\Java\jre1.8.0_73\bin\ssv.dll
(verified)  McAfee Security Scanner +                C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll
(verified)  Microsoft Office 2010                    C:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL
(verified)  Microsoft Office 2010                    C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL
(verified)  Microsoft Office 2010                    c:\program files (x86)\microsoft office\Office14\URLREDIR.DLL
(verified)  Microsoft® CoReXT                        C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL
(verified)  Microsoft® CoReXT                        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
(verified)  Microsoft® Windows® Operating System     C:\Windows\System32\mswsock.dll
(verified)  Microsoft® Windows® Operating System     C:\Windows\System32\nlaapi.dll
(verified)  Microsoft® Windows® Operating System     C:\Windows\System32\wshbth.dll
(verified)  NCLauncherFromIE                         C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
(verified)  Nero Kwik Media Helper                   C:\Program Files (x86)\Common Files\Nero\BrowserPlugin\npBrowserPlugin.dll
(verified)  NP_wtapp.dll                             C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll
(verified)  NPSWF32_23_0_0_207.dll                   C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll
(unsigned)  NVIDIA 3D Vision                         C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
(unsigned)  NVIDIA 3D VISION                         C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
(verified)  Silverlight Plug-In                      C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll
(verified)  VLC Web Plugin                           C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
(verified)  Widevine Content Decryption Module       C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\tseaflte.default-1477925802081\gmp-widevinecdm\1.4.8.903\widevinecdm.dll
(verified)  Windows Live Photo Gallery              C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
(verified)  Microsoft® Windows® Operating System     C:\Windows\System32\NapiNSP.dll
(verified)  Microsoft® Windows® Operating System     C:\Windows\System32\pnrpnsp.dll
(verified)  Microsoft® Windows® Operating System     C:\Windows\System32\winrnr.dll


Scan
—-
MD5: 9b6c0a9b8215ede86ffd94942ef1b477  C:\Program Files (x86)\Acunetix\Web Vulnerability Scanner 7\WVSScheduler7.exe
MD5: db0cd521ec68d35eeee97e6a8d619cbe  C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll
MD5: 35f3b5ed900fd2ab03f2889c05deca35  C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys
MD5: 5827a64e55eea31eda9df0abb8f7e956  C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
MD5: 8427cbc6270b7ef6d089b1d67e77a0dc  C:\Program Files (x86)\BlueStacks\HD-Service.exe
MD5: bc3c6332032180fcd0e294039256875f  C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
MD5: f6d02735de16705c1ebe6429592cd355  C:\Program Files (x86)\Bonjour\mdnsNSP.dll
MD5: c92b0a0957acad3ceef502a2ca10acb8  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
MD5: 66fd5bfe5ce06b241f4588d234cd3123  C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll
MD5: f577910a133a592234ebaad3f3afa258  C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
MD5: c53b51794903cda88cd135014c3e90f5  C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
MD5: 163e43bc69ae78f468024ec2133c94a8  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
MD5: 12b79422a23814429cda9e734c58f78f  C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL
MD5: 191e745bf2a451c716220ffd9ae25e15  C:\Program Files (x86)\Common Files\Microsoft\Care Suite\ADUService\ADUService.exe
MD5: bd2a14045f70177984693c9dc1f32b54  C:\Program Files (x86)\Common Files\Nero\BrowserPlugin\npBrowserPlugin.dll
MD5: 90e22d7cde08e07446d238a569bcab7c  C:\Program Files (x86)\Common Files\Steam\SteamService.exe
MD5: 41fae6618768dc93d98ddaf3f8282d3e  C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
MD5: faecee424c28211df229805b093b0274  C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
MD5: 3ee8ae0ecfe5d79de1737a855ad1e84c  C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll
MD5: 750446ed76a5d13e902174dddda1a62b  C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
MD5: da6508624e8d18f6289534224db1ff94  c:\program files (x86)\hewlett-packard\hp support framework\resources\hpnetworkcheck\hpnetworkcheckplugin.dll
MD5: e3ee3dac4c2e7cadbcf00f640996c88b  C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
MD5: 02f1253476b7f5f818364443dfed3264  C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
MD5: 7b7de6b3dc30f3246958f42c67a6f7bb  C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
MD5: a3ad13ca2747953ddd4c9ae4fb925bec  C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
MD5: 1f9cc89be0da01bcf28ee55db8e64cfb  C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartCalendarNamedPipe.dll
MD5: e6c1d2f421af7096d75d0735c7e64542  C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
MD5: e5123d14e3d50b479581e1ab66d53ef5  C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\LifeCenterDataLayer.dll
MD5: 2127e5ba5e85db6b4b3e27235f87fe36  C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\VistaBridgeLibrary.dll
MD5: 89544e97e57bb33452928c3b1ea005fa  C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\Windows7.DesktopIntegration.dll
MD5: 426d83f386d5916358c281d38c933d67  C:\Program Files (x86)\i-Funbox DevTeam\iFunBox_x64.exe
MD5: ca295d3e5032ddf8a3cbd1a256e646fa  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
MD5: 9c0bb24f7218644422ee0b1aa9e79038  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
MD5: 7ffc5351f32a60f37eb4b44248c83b41  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
MD5: ed5c8b920f2acf11a26586b2fa66bf3d  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
MD5: 843ae18c93c6dfd214ab7eaf338b4d6f  C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll
MD5: c59e3516c7bc44c14f937eed36f2bb97  c:\program files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll
MD5: 9ea6fa4806bb45185fe743d534cee9e6  C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll
MD5: 7d718a24b01f4eef8c592d44872708f2  c:\program files (x86)\Java\jre1.8.0_73\bin\ssv.dll
MD5: bb133892cb5e217f415455b520eaabe8  C:\Program Files (x86)\Microsoft Office\Office14\1033\ONINTL.DLL
MD5: 446795ce8369d50d5aa8237b06f2d798  C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
MD5: e04a1418b6caa33ef61f7b4ae826fc94  c:\program files (x86)\microsoft office\Office14\URLREDIR.DLL
MD5: cddae185ace26369b2dc18d494baf018  C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll
MD5: 5f685973740f289be3c809952db8408b  C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.EXE
MD5: 76f78018f45e7f92164cea5020176933  C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE
MD5: ea4ae42721460002dc31515f295ad1c4  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll
MD5: ad895b2a99a3ec18f1690bbac1e2037a  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll
MD5: 41a0d67ba3833d230f1229ff058be057  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll
MD5: f43a8e9cd787b6d91bb29dbb8eb1a4e5  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll
MD5: 2674310f6fc087862b215b26a5d6da5b  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll
MD5: fd14fcd1550f17701fbf239645b606fa  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll
MD5: bc0be695e63548171105c57d2e9b98e7  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll
MD5: 6bfbf95b7253f32a77bacdf119b678f3  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll
MD5: 07ba5f40c64134e5749df0e8cfee082e  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll
MD5: cb4e401ce4fc657ccebb85f96840cc8b  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll
MD5: b53d96644f5774fe29ba8bb12d6e5f66  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll
MD5: 49a69484b524c6f9fd641e015dd15154  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll
MD5: 66f65b59dff2f8927dc3c8045d8c3a0a  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll
MD5: 11218c9f81404a51d1eb6b56ba60f9ab  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll
MD5: d67520bff673cab4b2ed1af12de37a1f  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll
MD5: e65f76759251845fa1e6a3cf41b5f231  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll
MD5: 1622347a34eba068916713cf28f46b67  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll
MD5: f7af6bb63229721005c8ac85dc86f5c2  C:\Program Files (x86)\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll
MD5: 8ccd860915300187d605a5256dfb8496  C:\Program Files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
MD5: 3a1e3fd9d6e744f0cce8ffc70cddefee  C:\Program Files (x86)\Mozilla Firefox\firefox.exe
MD5: f2d603bc3fd171c4343a04257249c516  C:\Program Files (x86)\Mozilla Firefox\freebl3.dll
MD5: b61f39349eb99407dacf7f5e630eacea  C:\Program Files (x86)\Mozilla Firefox\lgpllibs.dll
MD5: 13a09c59ee2e82109bf057a825f2c1d3  C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
MD5: d25c3ff7a4cbbffc7c9fff4f659051ce  C:\Program Files (x86)\Mozilla Firefox\msvcp140.dll
MD5: 0c9ba0703607aa346664eac0621fcb5a  C:\Program Files (x86)\Mozilla Firefox\nss3.dll
MD5: ee76bbedf5a3cae2da18e9d538dfa046  C:\Program Files (x86)\Mozilla Firefox\nssckbi.dll
MD5: 3e8722e173c4023d9d44ded9e90e82c8  C:\Program Files (x86)\Mozilla Firefox\nssdbm3.dll
MD5: 623c24efed971643e206e4b0fb4ec807  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
MD5: 90a15326cfab65ae5b8be77513992d11  C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
MD5: 92fc454b54e86c2e315b214200996a7d  C:\Program Files (x86)\Mozilla Firefox\softokn3.dll
MD5: d2c5233317767ee9329f470c39b046b1  C:\Program Files (x86)\Mozilla Firefox\ucrtbase.dll
MD5: a2523ea6950e248cbdf18c9ea1a844f6  C:\Program Files (x86)\Mozilla Firefox\vcruntime140.dll
MD5: 628beec3250cf70aabfe6443eabe1583  C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
MD5: e0e4a1f81a7d69c595a8a9ddad084c19  C:\Program Files (x86)\Nero\Update\NASvc.exe
MD5: d6dedc73215738f825b503fcb9aab19a  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
MD5: 9c40f003243f4249f2b5e15e2a08842e  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
MD5: f82b2fc221ca0e408874884787491667  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
MD5: f9cf3fb8dd81b390783532b3c98d6976  C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
MD5: 67ab4219e8fcfca31fc50073dd3d0d11  C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
MD5: 046ddf9b31bec14d03ccc97dd728a4d1  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
MD5: 20b5060889e5bb239af87e3e57b97867  C:\Program Files (x86)\PDF Complete\pdfsvc.exe
MD5: 6ef941dfb22bb46ca79a1cf3ae88940b  C:\Program Files (x86)\ReiBoot\TenorshareReibootService.exe
MD5: f3aab7df6408431c762d8721b68f46e4  C:\Program Files (x86)\Skype\Updater\Updater.exe
MD5: 3a4f2c0bb87a0895abeba341aa1e341b  C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
MD5: 5df3fb47e202ae0c48e8300c36651ec6  C:\Program Files (x86)\Steam\bin\cef\cef.winxp\libcef.dll
MD5: 123f62178ae21d14a41182772acbe771  C:\Program Files (x86)\Steam\bin\cef\cef.winxp\steamwebhelper.exe
MD5: 1dd54fb385f7622f2de65480ad864c17  C:\Program Files (x86)\Steam\bin\chromehtml.dll
MD5: cc788bfe7a600724e3215792e4633e84  C:\Program Files (x86)\Steam\bin\filesystem_stdio.dll
MD5: b9565be197f42ed42d6abe41190899db  C:\Program Files (x86)\Steam\bin\friendsui.dll
MD5: 9ac61170f1a6f31c430e75f355e2e4e5  C:\Program Files (x86)\Steam\bin\serverbrowser.dll
MD5: b326a398c1a44727a70493aff160febd  C:\Program Files (x86)\Steam\bin\vgui2_s.dll
MD5: fd002721df252864c9121606a181d623  C:\Program Files (x86)\Steam\crashhandler.dll
MD5: ab189439d2c625793b4ab4eb15641687  C:\Program Files (x86)\Steam\icui18n.dll
MD5: 79c7511f2958974aa9ebea764b735e13  C:\Program Files (x86)\Steam\icuuc.dll
MD5: e5508e5ac8c0eb05633e469746910636  C:\Program Files (x86)\Steam\libavcodec-56.dll
MD5: 0399722a7331639946a856be5884f73b  C:\Program Files (x86)\Steam\libavformat-56.dll
MD5: d865864ce86ed3b4e10138368886b99d  C:\Program Files (x86)\Steam\libavresample-2.dll
MD5: 56033b08981a1799d27508fcaa779d27  C:\Program Files (x86)\Steam\libavutil-54.dll
MD5: 76774f3be1f04e399783ebb484d8b059  C:\Program Files (x86)\Steam\libswscale-3.dll
MD5: 2fdfa82223228c1e9430d0bad68a8328  C:\Program Files (x86)\Steam\openvr_api.dll
MD5: ae4b74913e7e879a101f137d7a63aa28  C:\Program Files (x86)\Steam\SDL2.dll
MD5: d2ce6ea0e9f641d7153462d40c6b4193  C:\Program Files (x86)\Steam\Steam.exe
MD5: 636c456d90dd08437a328d131e30a80b  C:\Program Files (x86)\Steam\steamclient.dll
MD5: db95454f4979437c96f81cd6f140a1e9  C:\Program Files (x86)\Steam\SteamUI.dll
MD5: 04618222af204b8ff29dbe583345a6b6  C:\Program Files (x86)\Steam\tier0_s.dll
MD5: 7b4acbf9ee05b7f6c8626b76bac4b7ee  C:\Program Files (x86)\Steam\v8.dll
MD5: cdcc39c4ddefb8ae1a606bd3776c3f84  C:\Program Files (x86)\Steam\video.dll
MD5: 90c60bcd364d26f3f12d06306372fa65  C:\Program Files (x86)\Steam\vstdlib_s.dll
MD5: fc79f85cdd7cea1cf7ff09ff39d94967  C:\Program Files (x86)\Steam\winh264.dll
MD5: f2f02e436ba56a96a06e4427c5787b6e  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
MD5: 08c3c6b144eb5ebde93263237c53db14  C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
MD5: 2562943b90afa9829097fb4274276d1d  C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
MD5: 174de8de9da82c4dab5d7457974a20f9  C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll
MD5: c403c5db49a0f9aaf4f2128edc0106d8  C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
MD5: 0a1ff0b674e2f268799442a434a63bb3  C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
MD5: 6ba102896e1569693188362e50065163  C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
MD5: 77c534c7be6afd10de4899876322bc82  C:\Program Files\AVAST Software\Avast\1033\Base.dll
MD5: 1e2f91c933b09d21f6cf09620f6698a2  C:\Program Files\AVAST Software\Avast\1033\uiLangRes.dll
MD5: a44a8015f4b536b277265cf866800b58  C:\Program Files\AVAST Software\Avast\aavm4h.dll
MD5: d60d2f8212f53d85ed8bb9be5328d793  C:\Program Files\AVAST Software\Avast\AavmRpch.dll
MD5: 214d0e6513a401c9538fb2c7bc7672ad  C:\Program Files\AVAST Software\Avast\afwCore.dll
MD5: 9ceeaa22af78cc44fc846210c2968b89  C:\Program Files\AVAST Software\Avast\afwCoreClient.dll
MD5: 0da72b620a59c0c6869e4ec901cb5cd2  C:\Program Files\AVAST Software\Avast\afwGeoIP.dll
MD5: 31d036c29db48cfa3970061c575abc6f  C:\Program Files\AVAST Software\Avast\afwRpc.dll
MD5: caa9bb913356e9fd56761c9352b7054b  C:\Program Files\AVAST Software\Avast\afwServ.exe
MD5: 9220760a42a41189c1b8766a47073fe0  C:\Program Files\AVAST Software\Avast\ashbase.dll
MD5: de76383a6fc61cee76a49ce9352e45f4  C:\Program Files\AVAST Software\Avast\ashtask.dll
MD5: 8dd828f7627db0c0b2562a0e71101bc8  C:\Program Files\AVAST Software\Avast\ashTaskEx.dll
MD5: 6ace5c03624566f75bb1914d57c9cfef  C:\Program Files\AVAST Software\Avast\aswAux.dll
MD5: b517428b000a3a059b39a2c75a884989  C:\Program Files\AVAST Software\Avast\aswCmnBS.dll
MD5: 305d8f0147c145e1f31aac33bf7704c7  C:\Program Files\AVAST Software\Avast\aswCmnIS.dll
MD5: 15c4375ac097fec4422d024f62bcdafe  C:\Program Files\AVAST Software\Avast\aswCmnOS.dll
MD5: b95e910b7d8b479bf6a4587214783c78  C:\Program Files\AVAST Software\Avast\aswData.dll
MD5: 3c19366bb3ff5aafdf242903a2a7bf21  C:\Program Files\AVAST Software\Avast\aswEngLdr.dll
MD5: 8d671abe5b9abe370b6183506c55099f  C:\Program Files\AVAST Software\Avast\aswJsFlt.dll
MD5: 81d28b32cc8d895170633703613e13ac  C:\Program Files\AVAST Software\Avast\aswLog.dll
MD5: 2a09d99ae91883b59e4b41721b4e11b1  C:\Program Files\AVAST Software\Avast\aswproperty.dll
MD5: 21da43aff8b77a5008455a9df447d264  C:\Program Files\AVAST Software\Avast\aswRemoteCache.dll
MD5: 1b2af1ec13f7799dcf04c86085f887af  C:\Program Files\AVAST Software\Avast\aswSqLt.dll
MD5: 3586f2b66d3061a41e5209b12cc02f0a  C:\Program Files\AVAST Software\Avast\aswUtil.dll
MD5: abb2bba14673d64e67e12a3f25c72e73  c:\program files\avast software\Avast\aswwebrepie.dll
MD5: 5862628f4e55cf9ebf47597912863fab  C:\Program Files\AVAST Software\Avast\avastIP.dll
MD5: f4e0580b5789474385e7acb189c4af2c  C:\Program Files\AVAST Software\Avast\AvastSvc.exe
MD5: ce99aa11d0274be5bdef3991508852e9  C:\Program Files\AVAST Software\Avast\avastui.exe
MD5: 1e623c389b0f15e9e412ae70aed8ad6f  C:\Program Files\AVAST Software\Avast\CommChannel.dll
MD5: 94b1301165ccf0036c08a945c6b2b238  C:\Program Files\AVAST Software\Avast\commonres.dll
MD5: 64fac01a8a58b3291dfd9ab34940c8e1  C:\Program Files\AVAST Software\Avast\defs\16112000\aswCmnBS.dll
MD5: 75c814117afdeee7207aa1b51e30deab  C:\Program Files\AVAST Software\Avast\defs\16112000\aswCmnIS.dll
MD5: cbb38fb0e9220deb3ef66ff3a2918277  C:\Program Files\AVAST Software\Avast\defs\16112000\aswCmnOS.dll
MD5: 5f871575b646e9170664fc287727eeb8  C:\Program Files\AVAST Software\Avast\defs\16112000\uiext.dll
MD5: 6316d49329b6947d77feee8f88824c80  C:\Program Files\AVAST Software\Avast\event_manager.dll
MD5: 751874461ade516830d5d101a64b2d73  C:\Program Files\AVAST Software\Avast\event_manager_rpc.dll
MD5: edd855b165b286f79508a333b778f402  C:\Program Files\AVAST Software\Avast\HTMLayout.dll
MD5: 91cd2dd2514afe00380ebdbdc1d6b555  C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
MD5: fd2510710349cabe33c19ed95fb56cf9  C:\Program Files\AVAST Software\Avast\libcef.dll
MD5: 9b433cfd5c619f2ae1132bfc0258f56c  C:\Program Files\AVAST Software\Avast\libeay32.dll
MD5: 1e0bee04a591222b805869dea6f09e4f  C:\Program Files\AVAST Software\Avast\log.dll
MD5: 370dd967a38cacf5055de3cc5a8834db  C:\Program Files\AVAST Software\Avast\snxhk.dll
MD5: bcd8eaf0f0be5a705966780feb94fc14  C:\Program Files\AVAST Software\Avast\ssleay32.dll
MD5: eaaa2b83c4764fdcfbee4a4d6546de92  C:\Program Files\Bonjour\mdnsNSP.dll
MD5: b5c2f92ee1106dfe7bb1cce4d35b6037  C:\Program Files\Bonjour\mDNSResponder.exe
MD5: c3a25a50d82061f986b2ab99e4b40c96  C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
MD5: 885888f8aad89108a5ee2d0174690220  C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
MD5: afb5b500ad69e24ed1bc15d1161641ef  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
MD5: 2bacd71123f42cea603f4e205e1ae337  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
MD5: a3b1076615d6b83826cb8c963ec16043  C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
MD5: 6a181452d4e240b8ecc7614b9a19bde9  C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
MD5: 61b1aaf851790a53158d74ab0cad6550  C:\Program Files\HitmanPro\hmpsched.exe
MD5: 4b1d0b5b6d043aaf45ae89eabab7b865  C:\Program Files\IDT\WDM\stacsv64.exe
MD5: 2d66067c7a8a0112156bcd1c0baa7042  c:\Program Files\Intel\iCLS Client\HeciServer.exe
MD5: 3fe5f886f28b78fced4bd5668902b7fc  C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
MD5: 16a6d49e7698fc6f1730d3ff9f5561a8  C:\Program Files\iPod\bin\iPodService.exe
MD5: 49f5b235edc9c6ac0aba44737b190317  C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe
MD5: 63ee2015b877a2e472cc59e05291aa39  C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll
MD5: c2730fe9713c1c474257a7085386b11e  C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
MD5: 3a7b0570d896602e37eaf80ec3d1615a  C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys
MD5: 1baa6c0aab6263a55980b7ba4e8d7d54  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
MD5: 2cb506d7641731710da9a31e5ab201bb  C:\Program Files\Reliance 3\bin\MonServiceUDisk.exe
MD5: 096c36adc6c4fdbaa5fc8e8ad170f33f  c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
MD5: f043e7b1f43eb2e3f825f07bb97c4828  C:\Program Files\WIDCOMM\Bluetooth Software\syswow64\BtMmHook.dll
MD5: 7cbb1d4d13dc62d7f529d87151fd3cd3  C:\Program Files\Windows Defender\MpSvc.dll
MD5: 06c8fa1cf39de6a735b54d906ba791c6  C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
MD5: a9f3bfc9345f49614d5859ec95b9e994  C:\Program Files\Windows Media Player\wmpnetwk.exe
MD5: b9f101c40a8631b20778b46d1a6f6daf  C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
MD5: a1f58fff448e4099297d6ee0641d4d0e  C:\Users\Jason\AppData\Local\Dropbox\Update\DropboxUpdate.exe
MD5: 2a3fb4c98f139038e23330d2439db8a4  C:\Users\Jason\AppData\Local\Facebook\Update\FacebookUpdate.exe
MD5: 3cd19649b2c3023d65e67c056457a2bc  C:\Users\Jason\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
MD5: 44a9229022a519ed45294a1934c05eec  C:\Users\Jason\AppData\Local\FluxSoftware\Flux\flux.exe
MD5: 08257af0ccb91b1dd057424b589a303f  C:\Users\Jason\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
MD5: 7c7782c0ac90db42b13e20156bcaae1b  C:\Users\Jason\AppData\Roaming\Dropbox\bin\_ctypes.pyd
MD5: 31b2b7e6d3cd0a8765641846452dc6a4  C:\Users\Jason\AppData\Roaming\Dropbox\bin\_jpegtran.pyd
MD5: f41c2615820755d8fe13ae6af83781ee  C:\Users\Jason\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
MD5: ea2ed9d50ad52485d93d4369da882547  C:\Users\Jason\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
MD5: 129b9af86f0e52c08f05476f04804762  C:\Users\Jason\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
MD5: 24d51d19975016da3017823b26e00327  C:\Users\Jason\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
MD5: e4721b91ba07899c43804e74c1373907  C:\Users\Jason\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
MD5: 08011eb5121d720427c48d402756a97c  C:\Users\Jason\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
MD5: fd849e2d11482c28c3eb61aded376098  C:\Users\Jason\AppData\Roaming\Dropbox\bin\D3DCompiler_47.dll
MD5: 138df846afdbdc883cd72c5e447a099b  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Dropbox.exe
MD5: 20d396ecf172ae23d91b692787b2226c  C:\Users\Jason\AppData\Roaming\Dropbox\bin\dropbox.infinite.win.compiled._driverinstallation.pyd
MD5: 5c9a936e7f7d0f1c348fdfb7d3000607  C:\Users\Jason\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.dll
MD5: e7a6bc0e880dbf7da0be4ec48b0b7fe7  C:\Users\Jason\AppData\Roaming\Dropbox\bin\fastpath.pyd
MD5: 7f93517ca65db5e1c7ef9fa405e7dfa2  C:\Users\Jason\AppData\Roaming\Dropbox\bin\faulthandler.pyd
MD5: 6d359b1192a99345e4de31145c904734  C:\Users\Jason\AppData\Roaming\Dropbox\bin\icudt55.dll
MD5: 0fb43dc4297491af36ef84682d0118f6  C:\Users\Jason\AppData\Roaming\Dropbox\bin\icuin55.dll
MD5: 63abc77c9c658db77388f7be428a3e8a  C:\Users\Jason\AppData\Roaming\Dropbox\bin\icuuc55.dll
MD5: 452412a1551476e89f8ea2c729d56b80  C:\Users\Jason\AppData\Roaming\Dropbox\bin\libEGL.dll
MD5: 292d28558cd073de3069772c7a5f7d4f  C:\Users\Jason\AppData\Roaming\Dropbox\bin\libGLESv2.dll
MD5: 126a1d391948eb82e098f4f11c2feb81  C:\Users\Jason\AppData\Roaming\Dropbox\bin\librsync.dll
MD5: 69ab37d1a84778fa6cb83c4ca61af09c  C:\Users\Jason\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
MD5: e1e61ee14b6477775c803c9239667749  C:\Users\Jason\AppData\Roaming\Dropbox\bin\mmapfile.pyd
MD5: fd5cabbe52272bd76007b68186ebaf00  C:\Users\Jason\AppData\Roaming\Dropbox\bin\msvcp120.dll
MD5: 034ccadc1c073e4216e9466b720f9849  C:\Users\Jason\AppData\Roaming\Dropbox\bin\msvcr120.dll
MD5: 2132c7974c41c362d34ec6e1977634a6  C:\Users\Jason\AppData\Roaming\Dropbox\bin\plugins\imageformats\qgif.dll
MD5: 6a02fd2beebeae36b2efb483d7e24f1d  C:\Users\Jason\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
MD5: 7a9a9c5de84c6e27e2b716e962b0ede4  C:\Users\Jason\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
MD5: db410bc0e8c3ebb7567933ec9021d397  C:\Users\Jason\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
MD5: 3c75145ee663b1ebaf52f3352a990dbb  C:\Users\Jason\AppData\Roaming\Dropbox\bin\pyexpat.pyd
MD5: 24de1e08d35d199fd43c11de35ac2201  C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
MD5: 06db97588bcf4a851dc90e5e6587fc86  C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
MD5: b70251c08f18c559e4b45e74c01ee15b  C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
MD5: 4c0aa04be45ad81f57407c6e396fc03d  C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
MD5: 8f81b96db89184f7b62df70f285a4f25  C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
MD5: 07082f951cc02f6988264a895c16259c  C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
MD5: 8b1899167aa1d487d5149c05eb085cd1  C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtWebChannel.pyd
MD5: 8161cbb71c17afcc4bf974cbd03a68a5  C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtWebEngineWidgets.pyd
MD5: 8c1516119eb40efb59b850abc6357065  C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
MD5: c4c38335beede2f0aa1296a33964a9c1  C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
MD5: 3190f4f78db306f6e48667aad5a1932b  C:\Users\Jason\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
MD5: 9645735e9f855a6a494ac371da7d3d1b  C:\Users\Jason\AppData\Roaming\Dropbox\bin\python27.dll
MD5: 20b86c24a8e8361cc3b0a4343132489c  C:\Users\Jason\AppData\Roaming\Dropbox\bin\pythoncom27.dll
MD5: b9703793c4218670a2fead26c6e2ea1d  C:\Users\Jason\AppData\Roaming\Dropbox\bin\pywintypes27.dll
MD5: cefc54efcebd8777feff59bfd0d9d0e6  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5Core.dll
MD5: f687ac45ee72d16783c2c9c1f7df9bdb  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5Gui.dll
MD5: 6ef4d3684658db178b631f50b8c414fd  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5Network.dll
MD5: 0bf08b6ac208c35f78328cd31f2ca34e  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll
MD5: 364f93263d39815d042388c51cd60c72  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5QML.dll
MD5: fb56b58c72ecc2a255639a4fc9b7921c  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5Quick.dll
MD5: 1ea37555254cf1386a410970733b68a3  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5WebChannel.dll
MD5: b4d37999bac19b48b71e5cfbe41a824b  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5WebEngine.dll
MD5: 8d983d60a5e2489996e24604c591470d  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5WebEngineCore.dll
MD5: 515e39e3423dcbefada77207ce7225c1  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5WebEngineWidgets.dll
MD5: 953255a7ef591bee9aa0411d050041d4  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5Webkit.dll
MD5: 22add16ef916ce97cc4599a5fcbd0b82  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5WebkitWidgets.dll
MD5: 51475b9bcfc88c521515fb0e3a7965ff  C:\Users\Jason\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll
MD5: 4faaa3a73764f099c3323ed50db8212f  C:\Users\Jason\AppData\Roaming\Dropbox\bin\select.pyd
MD5: e3baef592476c9b9c8470bf87a7327ca  C:\Users\Jason\AppData\Roaming\Dropbox\bin\sip.pyd
MD5: 98851e3e0da85a11ddd056a75ecb1173  C:\Users\Jason\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
MD5: 39068517eb4a48e08ca6e5e8e48475e7  C:\Users\Jason\AppData\Roaming\Dropbox\bin\unicodedata.pyd
MD5: c89f824dd82c260323850d48ee5aaecd  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32api.pyd
MD5: e28b16ca538cacb6cc333b5003104f64  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
MD5: 7a5b586fb408841d92ceb158e775fdcf  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
MD5: 497701af4cdbf88ce6d9086ae54ea286  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32event.pyd
MD5: 3f41ff59a4ecd2214421699ae742e350  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32evtlog.pyd
MD5: 23b2c1f2df699eda91dce9ad97b4de4e  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32file.pyd
MD5: 46fcd48d9f3745b33d9157e30dd2cc08  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32gui.pyd
MD5: f1ec151305737d668c34c2eec24d621b  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32pipe.pyd
MD5: 70ba4932725584d7278aea367feeb5b6  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32print.pyd
MD5: 6871cf889f844112d0b99c62e6b3a1ab  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32process.pyd
MD5: 7a0ff00a189c57c708e35a4174b7bb95  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32profile.pyd
MD5: d43048f8d73d69eaf5d7d1283c10c5d7  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32security.pyd
MD5: 11a37fddc0162b458fea1e4746d2e04a  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32service.pyd
MD5: 5efe8af476ef6f7ab94804e152d611f9  C:\Users\Jason\AppData\Roaming\Dropbox\bin\win32ts.pyd
MD5: 5c79d4363ed402a452a769e4e694c501  C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.crt.compiled._winffi_crt.pyd
MD5: 1f29c869b26dbfe29470bf2d105b7d90  C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.iphlpapi._winffi_iphlpapi.pyd
MD5: a7a9d994588bc83c38debd084d7ee95a  C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.kernel32.compiled._winffi_kernel32.pyd
MD5: fb3b85a940673405df934d71c505124c  C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.user32._winffi_user32.pyd
MD5: 7778412f7419bfdc81162da61cac782f  C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.winerror._winffi_winerror.pyd
MD5: f14e999a2a4257765a9973bfc7f2d26a  C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.winhttp.compiled._winffi_winhttp.pyd
MD5: 9b58b59be151391772fc28ff6a59d267  C:\Users\Jason\AppData\Roaming\Dropbox\bin\winffi.wininet._winffi_wininet.pyd
MD5: f6bbbb115c837ee2f012c6229a5cbc3f  C:\Users\Jason\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
MD5: 16bf62a30ff22dc6956ebb8a5f2f1406  C:\Users\Jason\AppData\Roaming\Dropbox\bin\winverifysignature.compiled._VerifySignature.pyd
MD5: 13edfebd345320fd4828d3637855f52e  C:\Users\Jason\AppData\Roaming\Dropbox\bin\winxpgui.pyd
MD5: b8ff5528c19e81b85a800bfcf41f16d4  C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\tseaflte.default-1477925802081\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
MD5: b1c853e7285e224a69695be88ed31a2c  C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\tseaflte.default-1477925802081\gmp-eme-adobe\17\eme-adobe.dll
MD5: ac8327b0d820f6177ceefff995a76080  C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\tseaflte.default-1477925802081\gmp-gmpopenh264\1.6\gmpopenh264.dll
MD5: 6f4c70c96fedc4e0a79c49d75fb31819  C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\tseaflte.default-1477925802081\gmp-widevinecdm\1.4.8.903\widevinecdm.dll
MD5: 8704a754ce5af0c28cbb87a5fe77995a  C:\Windows\AppPatch\AcLayers.dll
MD5: 9d56ececaa0fe76de6919203e5aeb7a4  C:\Windows\AppPatch\acwow64.dll
MD5: 8248cae69ef9baff2bf7ea84a0d5128e  C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\affcb83bba04f782c2586a1788330891\mscorlib.ni.dll
MD5: 3cbe0d84a1f85a1f301128b4edfcc549  C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\86d8696483cc81f030d41061c629fa41\PresentationCore.ni.dll
MD5: 50156e0b66cfb0723f28bf997d33e025  C:\Windows\assembly\NativeImages_v4.0.30319_32\ReachFramework\7b591c588b55c80201cba63f7e7fd1c7\ReachFramework.ni.dll
MD5: 461f4d22d22975e5e418c97b5fa9d27c  C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\32b270a7b4daf4731cf1c36ecd660297\SMDiagnostics.ni.dll
MD5: 2b2861900777e502eca812097fca35ad  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\6b3bc806e6d6a2c73c6d9f1429395698\System.Configuration.ni.dll
MD5: a6cbb834a3c76530087eccb5e8aa8c51  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\a57805cc2d492d82e327b83ab24fad62\System.Core.ni.dll
MD5: 25a94ccf77067284881a8e57165113ff  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\48453ce4573683172752f7fdc00f8820\System.Drawing.ni.dll
MD5: 02f23c9874e56f21a9111ff9cbe770ec  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c56cbffc8423ff484bf3f80aae1d5c24\System.IdentityModel.ni.dll
MD5: ad201b54a15362b81eb67c1286983bdc  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\ffbd00c458124054f2049e9a25a7cca8\System.Runtime.Serialization.ni.dll
MD5: e667628e392570414ab35f9a071e4a08  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\e2ab3c1c7be8727fb1f36945861e780b\System.ServiceModel.Internals.ni.dll
MD5: 16595c6f1342d9f56ed06d3dd2a4d05e  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\a459f8b69edabf287d593a2a08c5c8d6\System.ServiceModel.ni.dll
MD5: d2d3210727cb85e94502d15a0d6abf1b  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\7b437291b260f008653ebc86553ab462\System.Windows.Forms.ni.dll
MD5: ddbaf127dd146968372826c9b3dceb3d  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\36599a72e79974ff4c004c43df9fce2b\System.Xml.ni.dll
MD5: 0164f46ac064ce771fa1f1a47ab5fd40  C:\Windows\assembly\NativeImages_v4.0.30319_32\System\d03eb8a47500f40d5428f9c6875f8e56\System.ni.dll
MD5: 965ccac5493fb5b8ce33308e0094ff88  C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\778c4647568c87adb6930daa13e24b88\WindowsBase.ni.dll
MD5: c4002b6b41975f057d98c439030cea07  C:\Windows\ehome\ehrecvr.exe
MD5: 38ae1b3c38faef56fe4907922f0385ba  C:\Windows\explorer.exe
MD5: b4d73f04e9bc076f7cdac4327df636bb  C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
MD5: c98a5b9d932430ad8eebd3ef73756ef7  C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
MD5: a8b7f3818ab65695e3a0bb3279f6dce6  C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
MD5: 660d597b7a78256734d7f3230b21b355  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
MD5: 1400c75ff021d6cface46ac41b60770e  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
MD5: 15cba881e10968e33b43d31be6097ba3  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
MD5: f13ec8a783e0cb0d6dc26a3ca848b7b8  C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
MD5: 6faa411f45271a95a8445a715f129b5e  C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
MD5: cb3111a9107c1048f501b4642dd7b403  C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
MD5: bd460a85e005b5d22328f02944f476bc  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
MD5: ab4cd527befcc43ee441e6c50cce54c8  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
MD5: dad626cf7ed7df94c745c95d26822fad  C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
MD5: f3d75515c2475cb2b4fea22f5ef77bfa  C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll
MD5: fc184b997e98f3fbb6c3f5a90d027fee  C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll
MD5: 773212b2aaa24c1e31f10246b15b276c  C:\Windows\servicing\TrustedInstaller.exe
MD5: 0866168d24ccbd25f7b6bd941463892a  C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
MD5: d6a0c196c38d8c8edc393e06178d687d  C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
MD5: ed10ad79ca9b25bf467c09534386e8a6  C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
MD5: 318e0bec9f5bb5d843ddd79a65c0e644  C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
MD5: 40b1a027b54db3634367273ec9944f1a  C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
MD5: c7b2d46b370ad35d8c7a1922871b80d1  C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
MD5: ec0bd8598521e818e0a00ab71853d15f  C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
MD5: 26c94e123ce155f64dec76354d33965d  C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
MD5: a9fed7eac5f8fd57b0db63c2f8c9ee51  C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
MD5: 3df4733a8bb75eea366c985399d8c058  C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
MD5: d960cc9a5f96992ad372cf5816f5fbba  C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
MD5: 704825c1de15c82e0b1eeb169c2ad0cd  C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
MD5: e07b7af0f1e0e6e1b0dbeca4b07ce423  C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
MD5: 7268b379330fd01858c208b5b52b69f6  C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
MD5: fbfac472ff42ff25c8c4bda7daba3e38  C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
MD5: 8c0ef7c679de34649e9c59840007bb5d  C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
MD5: 11b95736415153c20be6ab1cc9c618a3  C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
MD5: 96c418d91a84bc0794e60d262111f3d7  C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
MD5: 33346575abd8dcb75d21d4e37ccba4d7  C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
MD5: 58e023e390e0946146a68940486f50b2  C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
MD5: 6fe33d0c9036a03d4f3f3ec328cecb7d  C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
MD5: 98714e01795c383f3a193afb151bca58  C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
MD5: 82f6445270c10a5cffd038c0f2e8f945  C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
MD5: 2d1f46c96c632086bcf160ad49370455  C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
MD5: ac337ed7ff8e5e76eedb22010a257d88  C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
MD5: ae3117caa5c006025e7ff9beef234624  C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
MD5: 21d5edba366caffc0d9d33eb2e947075  C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
MD5: 6a13b4f3b3f575f1e24b877b9359aaba  C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
MD5: 49aca548b2423f1c67898e6ac719a9a6  C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
MD5: 2e33dfd10f28f86c3fc40ee123cc3904  C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
MD5: 1c60e09ca1c3a045bc4d367f67c915b7  C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
MD5: 60f4aefa103d421ea4a40e31409b4756  C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
MD5: 6951562dc4625eefc6eacd52ad165866  C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
MD5: 007863e45f25aa47a4c30d0930bbfd85  C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
MD5: 589cbc4989f750e1da35625ab481cf43  C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
MD5: 3be0d923aa45a4dbe091c2d84f0b4fe7  C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
MD5: dfca0cf2c35cbc79e94ce5dd7b968767  C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
MD5: 5efa8e04bb2364cf18c07918f3661c4b  C:\Windows\System32\apisetschema.dll
MD5: ad7b9c14083b52bc532fba5948342b98  C:\Windows\System32\cmd.exe
MD5: 6f8e0d147e53d4ce2f4d975ab976e80a  C:\Windows\System32\cryptsvc.dll
MD5: e9e01eb683c132f7fa27cd607b8a2b63  C:\Windows\System32\dhcpcore.dll
MD5: 07f7f501ad50de2ba2d5842d9b6d6155  C:\Windows\System32\drivers\SECDRV.SYS
MD5: 6ddca324434ffa506cf7dc4e51db7935  C:\Windows\System32\explorer.exe
MD5: 2b857fd18ba4b5be6409bd6ce79eb4bd  C:\Windows\System32\msiexec.exe
MD5: a88241c2a519afd2c99a40000f9113e6  C:\Windows\System32\mswsock.dll
MD5: fe48346938c1cdddf4e4097db9b99764  C:\Windows\System32\nlaapi.dll
MD5: e56cd79bce4382b62d36842481fc0c71  C:\Windows\System32\ntdll.dll
MD5: 414bba67a3ded1d28437eb66aeb8a720  C:\Windows\System32\pla.dll
MD5: dbc02d918fff1cad628acbe0c0eaa8e8  C:\Windows\System32\provsvc.dll
MD5: 236f286e103fd44bd85fdd93097fd5dd  C:\Windows\System32\SearchIndexer.exe
MD5: 4ae380f39a0032eab7dd953030b26d28  C:\Windows\System32\SessEnv.dll
MD5: 414da952a35bf5d50192e28263b40577  C:\Windows\System32\shsvcs.dll
MD5: 613bf4820361543956909043a265c6ac  C:\Windows\System32\tapisrv.dll
MD5: 61ac3efdfacfdd3f0f11dd4fd4044223  c:\Windows\System32\userinit.exe
MD5: 34eee0dfaadb4f691d6d5308a51315dc  C:\Windows\System32\wcncsvc.dll
MD5: dde994e9159497d0d5ab2cdf66d1ead6  C:\Windows\System32\wdi.dll
MD5: dc54d7a40b6e18e5c7f592f836d163ff  C:\Windows\System32\WebClnt.dll
MD5: ead314f2142162ae4de91355580f6607  C:\Windows\System32\winhttp.dll
MD5: ac122407b29378ff9646f03404ac7c54  C:\Windows\System32\wshbth.dll
MD5: 8949a93520f7008c3b7ad320a0eea267  C:\Windows\System32\WsmSvc.dll
MD5: d2958325c1ae1ae37a83334c6229e3bc  C:\Windows\SysWOW64\actxprxy.dll
MD5: de8821da97bb8fa07c3970bd458205b6  C:\Windows\SysWOW64\advapi32.dll
MD5: 6a13b4f3b3f575f1e24b877b9359aaba  C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
MD5: 49aca548b2423f1c67898e6ac719a9a6  C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
MD5: 2e33dfd10f28f86c3fc40ee123cc3904  C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
MD5: 1c60e09ca1c3a045bc4d367f67c915b7  C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
MD5: 60f4aefa103d421ea4a40e31409b4756  C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
MD5: 6951562dc4625eefc6eacd52ad165866  C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
MD5: 007863e45f25aa47a4c30d0930bbfd85  C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
MD5: 589cbc4989f750e1da35625ab481cf43  C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
MD5: 3be0d923aa45a4dbe091c2d84f0b4fe7  C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
MD5: d5afc3a476925ce740b7079d9bd2d269  C:\Windows\SysWOW64\apphelp.dll
MD5: b2aba92f93b3b1bd241ec284bbf53de1  C:\Windows\SysWOW64\AudioSes.dll
MD5: 6b98026761228f913e9fa3f974920a20  C:\Windows\SysWOW64\bcryptprimitives.dll
MD5: f436e847fa799ecd75ad8c313673f450  C:\Windows\SysWOW64\cfgmgr32.dll
MD5: d1de1eafde97be41cf6585027ff3e732  C:\Windows\SysWOW64\comdlg32.dll
MD5: 44e7d66c3f0e2896239b03073714af19  C:\Windows\SysWOW64\credssp.dll
MD5: b87cea4e4ac19b13026fb2026ce2adab  C:\Windows\SysWOW64\crypt32.dll
MD5: 228cf2cb0632bb822d8700eb681ee934  C:\Windows\SysWOW64\cryptbase.dll
MD5: 8b51433ac5e699c1bb694f64778071b9  C:\Windows\SysWOW64\cryptnet.dll
MD5: d161cb594609d47c8e9b7599f3195e56  C:\Windows\SysWOW64\cryptsp.dll
MD5: d55a6842a7b9af46dfe1990faa802bed  C:\Windows\SysWOW64\cryptui.dll
MD5: 465bea35f7ed4a4a57686dea7ea10f47  C:\Windows\SysWOW64\cscapi.dll
MD5: 14800bd31701a5047ac3145bb1e698ae  C:\Windows\SysWOW64\d2d1.dll
MD5: 6de66fe7c526637e74cd066461c7c871  C:\Windows\SysWOW64\d3d11.dll
MD5: 6ef5f3f18413c367195f06e503ab86a6  C:\Windows\SysWOW64\d3d9.dll
MD5: 53223b673a3fa2f9a4d1c31c8d3f6cd8  C:\Windows\SysWOW64\dbghelp.dll
MD5: 441766e9d3dc1548799f16f3b1464037  C:\Windows\SysWOW64\dciman32.dll
MD5: 2eeff4502f5e13b1bed4a04ccad64c08  C:\Windows\SysWOW64\devobj.dll
MD5: 162d247e995eaebf3ef4289069e1111c  C:\Windows\SysWOW64\devrtl.dll
MD5: 81f6c1ae23b1c493d9e996c3103915d7  C:\Windows\SysWOW64\dhcpcsvc6.dll
MD5: 5e08ac958be05247ff1539e0d1ce7905  C:\Windows\SysWOW64\dinput8.dll
MD5: b40420876b9288e0a1c8cca8a84e5dc9  C:\Windows\SysWOW64\dnsapi.dll
MD5: 52213d271f6804aaa44f57aefd2b778a  C:\Windows\SysWOW64\dwmapi.dll
MD5: 71683207cc0b8bf691bbb3c815ab50a7  C:\Windows\SysWOW64\DWrite.dll
MD5: d4f264fe23f8953d840904418220c15e  C:\Windows\SysWOW64\dxgi.dll
MD5: a9b552f2f039119661a388b986ef3dca  C:\Windows\SysWOW64\evr.dll
MD5: 6ddba73dd781d6cc3cc5a2e8a3e99092  C:\Windows\SysWOW64\ExplorerFrame.dll
MD5: 1e8d06aae74fed674c1156b3fea911c2  C:\Windows\SysWOW64\Faultrep.dll
MD5: f0d0e883ebbdc7615dc9edea0ffb2817  C:\Windows\SysWOW64\FWPUCLNT.DLL
MD5: 59e1493ea47eb958a4125da4e9a71c34  C:\Windows\SysWOW64\gdi32.dll
MD5: fbe4e7975289230f84d9da2222448ac3  C:\Windows\SysWOW64\gpapi.dll
MD5: 9263229a4663d0d59b9752d5ee12b35a  C:\Windows\SysWOW64\ieframe.dll
MD5: 1741bdc6ef1dc754517d9861bfc4ab43  C:\Windows\SysWOW64\iertutil.dll
MD5: e7b9d5ff20ffdd4aae2ef1d1b8c27a37  C:\Windows\SysWOW64\imagehlp.dll
MD5: a6f09e5669d9a19035f6d942caa15882  C:\Windows\SysWOW64\imm32.dll
MD5: a90dc9abd65db1a8902f361103029952  C:\Windows\SysWOW64\IPHLPAPI.DLL
MD5: 5d58a9a092cc9f1aeaf8a2cfcfff5b95  C:\Windows\SysWOW64\kernel32.dll
MD5: 582b1574976a53112a600cc523d353ac  C:\Windows\SysWOW64\KernelBase.dll
MD5: a4c85f362ebb7815676f1cd9cfc5ba59  C:\Windows\SysWOW64\ksuser.dll
MD5: 8ea53101ff2b15bdff934b62a8fb326d  C:\Windows\SysWOW64\logoncli.dll
MD5: 5e0def87d65768c38758254a8ab05180  C:\Windows\SysWOW64\lpk.dll
MD5: 9baf21ba600ec4e5fd9a66ad3e4ff5a6  C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
MD5: 83fcfa3c1e0d7523c21ccfbf336d2687  C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll
MD5: 8eb808138dee25ba53d331a14bfd39d8  C:\Windows\SysWOW64\mf.dll
MD5: 6211282edfb9577773ccfffa8d97ed67  C:\Windows\SysWOW64\mfplat.dll
MD5: bfebb6f76a0988a38260870c61a6d1b7  C:\Windows\SysWOW64\mfreadwrite.dll
MD5: 243974ec02f7ae49e4179c54624143ab  C:\Windows\SysWOW64\MMDevAPI.dll
MD5: 5dce986c8d7e91b455fb3d57bf955a2a  C:\Windows\SysWOW64\MP3DMOD.DLL
MD5: 938f39b50bafe13d6f58c7790682c010  C:\Windows\SysWOW64\msasn1.dll
MD5: 7f8678c59f188528d60104e697c2361e  C:\Windows\SysWOW64\mscms.dll
MD5: d83947a58613e9091b4c9cc0f1546a8d  C:\Windows\SysWOW64\mscoree.dll
MD5: 4c7a52467d41de158258a551c49cc169  C:\Windows\SysWOW64\msctf.dll
MD5: 7069aab8536f29ed7323140973a2894b  C:\Windows\SysWOW64\msdmo.dll
MD5: 804a445357c35467fd9eb025619860c0  C:\Windows\SysWOW64\msi.dll
MD5: 3cc0ef43c256d0a28c908f36ad06963d  C:\Windows\SysWOW64\msmpeg2adec.dll
MD5: 7c135c38ec6586f7562cfbc184a514e2  C:\Windows\SysWOW64\msmpeg2vdec.dll
MD5: c5a99a4c0dc9f0f5a95ba0c83d30a549  C:\Windows\SysWOW64\mstask.dll
MD5: 856da04454a75cf6e7453d53cd90a29d  C:\Windows\SysWOW64\msvcr120_clr0400.dll
MD5: 9dc80a8aaaaac397bdab3c67165a824e  C:\Windows\SysWOW64\msvcrt.dll
MD5: a88241c2a519afd2c99a40000f9113e6  C:\Windows\SysWOW64\mswsock.dll
MD5: 12340d95b5af0497ddb0db98ca301b4e  C:\Windows\SysWOW64\ncrypt.dll
MD5: 2fca0d2c59a855c54bafa22aa329df0f  C:\Windows\SysWOW64\netapi32.dll
MD5: 20b3934db73eaba2b49b7177873cb81f  C:\Windows\SysWOW64\netutils.dll
MD5: 3d57ffbad3ed16b63de3879bab0fb56f  C:\Windows\SysWOW64\networkexplorer.dll
MD5: fe48346938c1cdddf4e4097db9b99764  C:\Windows\SysWOW64\nlaapi.dll
MD5: e56cd79bce4382b62d36842481fc0c71  C:\Windows\SysWOW64\ntdll.dll
MD5: 03f3b770dfbed6131653ceda8ca780f0  C:\Windows\SysWOW64\ntshrui.dll
MD5: 67448a5b8a63f01240702a042a2959e5  C:\Windows\SysWOW64\nvspcap.dll
MD5: e4dd2eb4a892ad10f2b8535ab3ae3c68  C:\Windows\SysWOW64\nvwgf2um.dll
MD5: e518b37f8c82a4320732352e4da9bf41  C:\Windows\SysWOW64\ole32.dll
MD5: 8e01332cc4b68bc6b5b7effe374442aa  C:\Windows\SysWOW64\oleacc.dll
MD5: dfa4fc62e591afe142b21d11de145687  C:\Windows\SysWOW64\oleaut32.dll
MD5: 307a6d4f7cd94e384ecff05afa30b42c  C:\Windows\SysWOW64\olepro32.dll
MD5: 487f44b08efeaf5ad087878357b9403d  C:\Windows\SysWOW64\pdh.dll
MD5: 12c45e3cb6d65f73209549e2d02eca7a  C:\Windows\SysWOW64\propsys.dll
MD5: 5cf623b21998b8f1d081d55910a0bda7  C:\Windows\SysWOW64\qasf.dll
MD5: 8d9c6cd3966aa8322d3f15533d08cc47  C:\Windows\SysWOW64\quartz.dll
MD5: 102cf6879887bbe846a00c459e6d4abc  C:\Windows\SysWOW64\riched20.dll
MD5: 2c9cd83111ae1b18a7331c66edf4969d  C:\Windows\SysWOW64\rpcrt4.dll
MD5: 5997d769cdb108390dcfaebf442bf816  C:\Windows\SysWOW64\RpcRtRemote.dll
MD5: 68ecca523ed760aafc03c5d587569859  C:\Windows\SysWOW64\samcli.dll
MD5: 795f356f6027fca3fd4ad5f3ccd904b7  C:\Windows\SysWOW64\samlib.dll
MD5: 8c1b4231df981a8d95d0b58799dd7a35  C:\Windows\SysWOW64\schannel.dll
MD5: 6581b52e133cc6d00661c58968c7e212  C:\Windows\SysWOW64\SearchFolder.dll
MD5: 65a5e27c2217d606e212b6088ccd6104  C:\Windows\SysWOW64\sechost.dll
MD5: 953b036b621a8300705ada7696d0612d  C:\Windows\SysWOW64\secur32.dll
MD5: 10fb16b50affda6d44588f3c445dc273  C:\Windows\SysWOW64\setupapi.dll
MD5: 2c4a87ca8c00e98efdcfa2e8ec9a3503  C:\Windows\SysWOW64\shdocvw.dll
MD5: abc113054366c0102f134d181162cb86  C:\Windows\SysWOW64\shell32.dll
MD5: 8cc3c111d653e96f3ea1590891491d71  C:\Windows\SysWOW64\shlwapi.dll
MD5: 5ccdcd40e732d54e0f7451ac66ac1c87  C:\Windows\SysWOW64\srvcli.dll
MD5: bbbdf09b55103bb7aefd348584cfbf00  C:\Windows\SysWOW64\sspicli.dll
MD5: 22f2efadeaeeb66d8c7e22d9457ab7e0  C:\Windows\SysWOW64\StructuredQuery.dll
MD5: 919001d2bb17df06ca3f8ac16ad039f6  C:\Windows\SysWOW64\sxs.dll
MD5: 27ab472295602a88d28e21b69cbc241d  C:\Windows\SysWOW64\urlmon.dll
MD5: 0fbc0e335b65ee5a0175631237817510  C:\Windows\SysWOW64\user32.dll
MD5: d15618a0ff8dbc2c5bf3726bacc75a0b  C:\Windows\SysWOW64\userenv.dll
MD5: 3553707b119ad5aaf1f31bff5517a093  C:\Windows\SysWOW64\usp10.dll
MD5: cfc7d8289d2b5f3cf8d16e2db7f93d4a  C:\Windows\SysWOW64\wbem\fastprox.dll
MD5: 704314fd398c81d5f342caa5df7b7f21  C:\Windows\SysWOW64\wbemcomn.dll
MD5: d205c24a9d069049fe2df2a1b38726a7  C:\Windows\SysWOW64\wdmaud.drv
MD5: cb52def1b1e1b9950f29548f2f19115a  C:\Windows\SysWOW64\webio.dll
MD5: ead314f2142162ae4de91355580f6607  C:\Windows\SysWOW64\winhttp.dll
MD5: 19465502d25c5b7d54b792e3695c2a90  C:\Windows\SysWOW64\wininet.dll
MD5: d5aefad57c08349a4393d987df7c715d  C:\Windows\SysWOW64\winmm.dll
MD5: 9e4b0e7472b4ceba9e17f440b8cb0ab8  C:\Windows\SysWOW64\winspool.drv
MD5: fd67683fba9b2c4bb551780bd8846f64  C:\Windows\SysWOW64\winsta.dll
MD5: bad7422556d0f387ffa49f9f983970db  C:\Windows\SysWOW64\wintrust.dll
MD5: e5a4a1326a02f8e7b59e6c3270ce7202  C:\Windows\SysWOW64\wkscli.dll
MD5: a8bb45f9ecad993461e0fef8e2a99152  C:\Windows\SysWOW64\Wldap32.dll
MD5: 43c9cf6825cea58f1815b7c3dbbb385c  C:\Windows\SysWOW64\Wpc.dll
MD5: 59ea5753ebdae42cf92fd5b6e7ae4d53  C:\Windows\SysWOW64\ws2_32.dll
MD5: ac122407b29378ff9646f03404ac7c54  C:\Windows\SysWOW64\wshbth.dll
MD5: 6a6b2ee4565a178035be2a4ff6f2c968  C:\Windows\SysWOW64\wtsapi32.dll
MD5: 77f595dee5ffacea72b135b1fce1312e  C:\Windows\SysWOW64\xinput1_3.dll
MD5: edf2a5e96bec469da3f64e9bdd386111  C:\Windows\SysWOW64\xmllite.dll
MD5: ec4f2cb68dcf7e96516eb284003be8bb  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-core-file-l1-2-0.dll
MD5: b9287eb7bcbfdcec2e8d4198fd266509  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-core-file-l2-1-0.dll
MD5: dbb81fcc74c59490008ee59bffff5a6d  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-core-localization-l1-2-0.dll
MD5: f61b9ecb79cd20fc2e8fce87286cfe43  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-core-processthreads-l1-1-1.dll
MD5: e4110aa5c8a32b63de2c85e0bc297c54  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-core-synch-l1-2-0.dll
MD5: 00b548bf3eab7a6debce296ee5e877de  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-core-timezone-l1-1-0.dll
MD5: 032a139ea3cc41f2bb801cd580759a75  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-conio-l1-1-0.dll
MD5: 94e386a317faa200aa1dc270ce54e5fd  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-convert-l1-1-0.dll
MD5: e8ccecac4f06679b9d5e77333d216ee0  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-environment-l1-1-0.dll
MD5: 42153324a982f848d7a49bb7406125c2  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-filesystem-l1-1-0.dll
MD5: aad41d33906cfdb31681ce8276648481  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-heap-l1-1-0.dll
MD5: bc75b80a80802146e79c383c94542f06  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-locale-l1-1-0.dll
MD5: 1028042a84aefe816280f22a4517dc68  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-math-l1-1-0.dll
MD5: b7e1023ebbf0e5018c58b5488c03a643  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-multibyte-l1-1-0.dll
MD5: 2f10f2255271b09d58af75f58476899c  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-runtime-l1-1-0.dll
MD5: 65fe48962755451a1a5bab26e6fd978d  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-stdio-l1-1-0.dll
MD5: a3eccd7f2f2c45d1553055593278645a  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-string-l1-1-0.dll
MD5: c8f1a3b19e5103751202010805bce5c9  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-time-l1-1-0.dll
MD5: e0aeba2d9d9ae584d6c1aa0f5929526b  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\api-ms-win-crt-utility-l1-1-0.dll
MD5: d25c3ff7a4cbbffc7c9fff4f659051ce  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\msvcp140.dll
MD5: 015b30309491a911e75748ad69c9e680  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\ucrtbase.dll
MD5: a2523ea6950e248cbdf18c9ea1a844f6  C:\Windows\winsxs\x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.24210.0_none_9e58d6f8311e6fc8\vcruntime140.dll
MD5: 2296ab849839fdb3b186d07c829d7ebe  C:\Windows\winsxs\x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.24210.0_none_a338d8ea2df29efb\mfc140u.dll
MD5: cdbe9690cf2b8409facad94fac9479c9  C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
MD5: 58788565442368b0615ddaf1d452b843  C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
MD5: 885e18b2d0a445fb637850282530eb72  C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll


No file uploaded.

Scan finished - communication took 2 sec
Total traffic - 0.02 MB sent, 1.64 KB recvd
Scanned 615 files and modules - 163 seconds

==============================================================================

 

Your computer appears to be clean.

Now that you’re free from malware, as long as it seems to be running well, please follow these simple steps to tidy up your computer and decrease the likelihood of getting infected again:

===================================================

Enable Avast as according to your logs it is disabled. You can find details on Enabling/disabling security shields here.

===================================================

Uninstall Combofix

Follow these steps to uninstall Combofix

• click START then RUN
• now type Combofix /uninstall in the runbox and click OK.

Note the space between the X and the /, it needs to be there.

🖼Click to load external image (CFuninstall.jpg)

• please follow the prompts to uninstall Combofix.
• once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.

===================================================

Uninstall AdwCleaner

• double click on adwcleaner.exe to run the tool
• click on Uninstall
• confirm with Yes.

===================================================

Download & run Delfix

• download Delfix from here to remove many of the tools we've used during the cleaning process.
• ensure “Remove disinfection tools” is checked.

Also place a checkmark next to:

o    Create registry backup
o    Purge system restore

• click the Run button.

You can delete all other logs and programs we’ve used that are on your desktop. Just click on them and press Delete.

===================================================

Update installed programs

Your version of Java is out-of-date and need to be removed and updated.

Having the latest updates and removing old versions ensures there are no security vulnerabilities in your system.

Uninstall:

Java 8 Update 51
Java 8 Update 73

If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

NEXT

Install the latest version of Java:

Java

NOTE – when you install Java, before clicking on Install, be sure to Uncheck “Install the Ask Toolbar and make Ask my default search provider”

🖼Click to load external image (Java.gif)

Even though I just had you get the latest version of Java, there is a vulnerability with regards to Java and web browsers. Therefore, we recommend to disable java in web browsers.

More information can be found here.

===================================================

Recommended programs

SpywareBlaster. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.

======================

Update and run Malwarebytes. This really is an excellent program that you should also update and run on a regular basis, probably weekly.

======================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

======================

Download WOT

Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

green if it's safe
yellow for caution
red for unsafe
 

You can download the WOT add-on for Firefox, Chrome, Internet Explorer, Opera, and Safari browsers. It does not slow down your browsing experience, it is easy to use and free. Just click “Download” and you are ready to go!

======================

MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

A couple of links with information here and here which can answer any questions you might have about installing/using it.

======================

Unchecky

Be careful when downloading free software. Many free programs come bundled with adware, many of which cause redirects/popups and verge on being malware. There is a program that automatically “unckecks” the boxes you may not notice when downloading programs.

Download and install Unchecky .

===================================================

I also recommend that you read the following:

Best Practices for Safe Computing - Prevention of Malware Infection by miekiemoes

Simple and easy ways to keep your computer safe and secure on the Internet  by Lawrence Abrams

I will keep this open for 24 hours in case you have any problems, after which I’ll close the topic.

Safe computing

Satchfan