What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Chromium pop-up under "mshta.exe." in SysWOW64 folder?

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited

I have used Spybot Search & Destroy, Malwarebytes, Adwcleaner, and ccleaner regularly. I guess they have never cleaned this problem out.

 

For the past week or two, every time I reboot my laptop, a pop-up comes up on my screen informing me that Chromium needs to be updated. There are no files under the name Chromium on my computer and whenever Chromium was first initially installed, I uninstalled. So basically just the "virus" is what is left on my computer. I would really like to finally figure out how to get rid of it.

 

Windows 10

Samsung Series 7 Chronos

 

Thanks in advance!

 

Required scans:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-01-2017 01
Ran by [removed] (administrator) on ALAINA (26-01-2017 15:23:47)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\WINDOWS\System32\atiesrxx.exe
(AMD) C:\WINDOWS\System32\atieclxx.exe
(Intel Corporation) C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe
(Intel Corporation) C:\WINDOWS\System32\igfxCUIService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB Card Reader\RIconMan.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDTouch.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\WINDOWS\System32\igfxEM.exe
(Intel Corporation) C:\WINDOWS\System32\igfxHK.exe
(Intel Corporation) C:\WINDOWS\System32\igfxTray.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Microsoft Corporation) C:\WINDOWS\System32\SettingSyncHost.exe
() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\WINDOWS\System32\InstallAgent.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\CNext\CCCSlim\MOM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\CNext\CCCSlim\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe
(Microsoft Corporation) C:\WINDOWS\System32\NetworkUXBroker.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(AVAST Software) C:\Users\Alaina McKinzie\Downloads\aswMBR.exe
 
==================== Registry (Whitelisted) ====================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\…\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3242200 2016-11-11] (ELAN Microelectronics Corp.)
HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14040296 2015-09-17] (Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1412840 2015-09-17] (Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg_SRSSA] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1412840 2015-09-17] (Realtek Semiconductor)
HKLM\…\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2014-09-19] (Adobe Systems Incorporated)
HKLM\…\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [8027016 2016-09-16] (Advanced Micro Devices, Inc.)
HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2016-12-06] (Apple Inc.)
HKLM\…\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [Adobe Reader Speed Launcher] => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
HKLM-x32\…\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-13] (Intel Corporation)
HKLM-x32\…\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\…\Run: [AdobeCEPServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe [1039248 2013-03-13] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [4369952 2014-11-07] (Fitbit, Inc.)
HKLM-x32\…\Run: [GoPro Studio Importer] => C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe [3207680 2015-05-20] (GoPro)
HKLM-x32\…\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4127488 2015-06-16] (Safer-Networking Ltd.)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)
HKLM-x32\…\RunOnce: [Lomifap] => C:\WINDOWS\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\ALAINA~1\AppData\Roaming\Ponobe"
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\Run: [Spotify Web Helper] => C:\Users\Alaina McKinzie\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1444976 2016-12-22] (Spotify Ltd)
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [4369952 2014-11-07] (Fitbit, Inc.)
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\Run: [SpybotPostWindows10UpgradeReInstall] => "C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31682144 2015-03-25] (Skype Technologies S.A.)
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\Run: [Spotify] => C:\Users\Alaina McKinzie\AppData\Roaming\Spotify\Spotify.exe [7153264 2016-12-22] (Spotify Ltd)
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\Run: [Chromium] => "c:\users\alaina mckinzie\appdata\local\chromium\application\chrome.exe" –auto-launch-at-startup –profile-directory="Default" –restore-last-session –restore-last-session
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9292504 2016-12-21] (Piriform Ltd)
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6301.0127] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6301.0127"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\amd64"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6302.0225] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6302.0225"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6386.0412] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6386.0412"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6390.0509] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6390.0509"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall 17.3.6720.1207\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6720.1207\amd64"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\RunOnce: [Uninstall 17.3.6720.1207] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6720.1207"
GroupPolicy: Restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{39de28ae-f68c-4bb4-99fb-6760bbddc911}: [DhcpNameServer] 192.168.1.254
 
Internet Explorer:
==================
HKU\S-1-5-21-429855145-656000057-2018818212-1008\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-429855145-656000057-2018818212-1008\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM;=INMODF&PC;=IN05
HKU\S-1-5-21-429855145-656000057-2018818212-1008\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung13.msn.com
HKU\S-1-5-21-429855145-656000057-2018818212-1008\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKU\S-1-5-21-429855145-656000057-2018818212-1008\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-429855145-656000057-2018818212-1008 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKU\S-1-5-21-429855145-656000057-2018818212-1008 -> {d4fee3d1-1014-4db8-a824-573bf9ab51c7} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll [2016-11-08] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-11-08] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-04-19] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 
FireFox:
========
FF DefaultProfile: lo3gqdzz.default
FF ProfilePath: C:\Users\Alaina McKinzie\AppData\Roaming\Mozilla\Firefox\Profiles\lo3gqdzz.default [2017-01-26]
FF NewTab: Mozilla\Firefox\Profiles\lo3gqdzz.default -> about:newtab
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\lo3gqdzz.default -> search.yahoo.com
FF DefaultSearchEngine.US: Mozilla\Firefox\Profiles\lo3gqdzz.default -> Yahoo! Powered
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\lo3gqdzz.default -> search.yahoo.com
FF Homepage: Mozilla\Firefox\Profiles\lo3gqdzz.default -> hxxps://www.malwarebytes.org/restorebrowser/a1da39a1¶m1=ArFaIWVoNqArQGMVInobADAevXFbMnMqQGMVwCNoNqAdBHFaISoeATVoNqAqAXFaIWQBvmE4ICILNopcGWUIvmFdJaYYNVA4JmIYwVVdICIVvFFdJaYWvmo4JqYWNVI9J6ILNVJdESk8NUM9J6oXvmk4JmILNFdbDSk8wVU9ImIXvFE9Imk4wVA4ISoUwV5cGWUWvmE9GqUNNFxcJqUDNF5bDGUNNEU3wGQGwVVdJCIWNVI4J6oXwVI9ISISvFNdJaYXwVM9IaYTvFJdJ6oVwVw4JaYVwVI9ISISNVRdISIVNVU4ICIXNVI4ISoVNVI9JCoWNoU9GqUMNFBcJqQzNEBcGqQANFdcFCk8NoM4J6IVvmk9JqYWvFQ9JmoUwVw3vCoWwVI9J6ISvFFdJmIVNVA9IaYXwVNdISk4wVw3vCIWNVRdJ6IWwVM3vCoUvFRdImoXvmlbFCILNVVdGSk8vFFoNqAqxrFaIWR8MaR6LWBdQGR7BHFaISopzU0aCaV7CaJ6C78kBrFbMn0aC6AoxrFaIWVdOqZoNqAexbFaIUwkynIew6NoNpRcNXFbJpseyDF%3D¶m2=NGN9MaVcNqZbMJ%3D%3D
FF Keyword.URL: Mozilla\Firefox\Profiles\lo3gqdzz.default -> user_pref("keyword.URL", true);
FF Extension: (Firefox Hotfix) - C:\Users\Alaina McKinzie\AppData\Roaming\Mozilla\Firefox\Profiles\lo3gqdzz.default\Extensions\[removed] [2016-11-18]
FF Extension: (Video AdBlock) - C:\Users\Alaina McKinzie\AppData\Roaming\Mozilla\Firefox\Profiles\lo3gqdzz.default\Extensions\{7b8a500a-a464-4624-bd4f-73eaafe0f766} [2016-09-21]
FF Extension: (Youtube Unblocker Remediation) - C:\Users\Alaina McKinzie\AppData\Roaming\Mozilla\Firefox\Profiles\lo3gqdzz.default\features\{8d67181a-4afb-486a-b8d6-f8261906cd1e}\[removed] [2016-12-26]
FF SearchPlugin: C:\Users\Alaina McKinzie\AppData\Roaming\Mozilla\Firefox\Profiles\lo3gqdzz.default\searchplugins\Search Provided by Bing.xml [2016-08-07]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_194.dll [2017-01-16] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-09-19] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_194.dll [2017-01-16] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1219160.dll [2015-07-23] (Adobe Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-11-08] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-11-08] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-04-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-07-27] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-01-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-01-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-09-19] (Adobe Systems)
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://mysearch.avg.com/?cid={C0FD3C18-FF37-4D2C-96A4-4C0A0E464830}∣=bbf4a91c6c6147d09dcef9db0cbda486-fa8c8636e067ef3438a9d1457c4dd95abab867ce⟨=en&ds;=AVG≺=fr&d;=2013-05-03 09:40:17&v;=15.0.1.2&pid;=safeguard&sg;=1&sap;=hp","hxxp://search.conduit.com/?ctid=CT3287807&SearchSource;=48&CUI;=UN63435513121776250&UM;=2","hxxp://search.conduit.com/?ctid=CT3289847&SearchSource;=48&CUI;=UN21346491832967455&UM;=2","hxxp://mysearch.avg.com?cid={486EC094-A02F-424D-A6F9-6B79A52B589C}∣=83b23eb8d29c47d39dc7f9db0cbda486-fa8c8636e067ef3438a9d1457c4dd95abab867ce⟨=en&ds;=AVG&coid;=avgtbavg≺=fr&d;=2013-09-09 11:24:48&v;=17.0.1.4&pid;=safeguard&sg;=&sap;=hp","hxxp://search.conduit.com/?ctid=CT3324776&octid;=EB_ORIGINAL_CTID&SearchSource;=55&CUI;=&UM;=4&UP;=SPDF4EF8A6-35CE-4220-8C48-7B539992BA1E&SSPV;=","hxxp://www.default-search.net?sid=503&aid;=101&itype;=n&ver;=13001&tm;=401&src;=hmp","hxxp://us.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wncy_pwrisofs_15_33¶m1=1¶m2=f%3D7%26b%3DChrome%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0C0A0FyBtAtA0EtDyE0C0CzyyB0C0DtCtN0D0Tzu0StCtAtBtAtN1L2XzutAtFtCtBtFyDtFtAtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StAtA0BtCtByC0AtDtGtA0E0FtCtG0A0E0DyBtGtCyEyEzytGtBzz0AyCtCyBzyyB0AyDyEtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtDzztB0CyBtByEtGzyyCtDtCtGyE0BtD0FtG0BtC0DzytGzytC0B0CtCtCzyyEyB0FyBzz2QtN0A0LzuyE%26cr%3D842925453%26a%3Dwncy_pwrisofs_15_33%26os%3DWindows%2B8.1"
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.824\_platform_specific\win_x86\widevinecdmadapter.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\PepperFlash\pepflashplayer.dll => No File
CHR Profile: C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\Default [2017-01-26]
CHR Extension: (Google Drive) - C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (Google Search) - C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-30]
CHR Extension: (AdBlock) - C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-12-29]
CHR Extension: (Reddit Enhancement Suite) - C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2016-12-17]
CHR Extension: (Momentum) - C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\Default\Extensions\laookkfknpbbblfpciffpaejjkokdgca [2016-12-31]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-19]
CHR Extension: (Gmail) - C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-08-26]
CHR Extension: (Chrome Media Router) - C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-17]
CHR HKLM-x32\…\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [155016 2016-09-16] ()
R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171664 2012-11-05] (Adobe Systems Incorporated)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
S2 CAMService; C:\Program Files\Intel\CAM\bin\CAMService.exe [1243344 2014-09-03] (Intel® Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3042032 2016-12-13] (Microsoft Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [129752 2016-11-11] (ELAN Microelectronics Corp.)
R2 Fitbit Connect; C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe [5738528 2014-11-07] (Fitbit, Inc.) [File not signed]
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB Card Reader\RIconMan.exe [2466448 2012-09-12] (Realsil Microelectronics Inc.)
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337840 2016-10-25] (Intel Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-09-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1750712 2015-06-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [235984 2016-11-24] (Safer-Networking Ltd.)
R2 SWUpdateService; C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2878152 2012-12-21] (Samsung Electronics CO., LTD.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2016-10-25] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-10-25] (Microsoft Corporation)
S3 WsAppService; "C:\Program Files (x86)\Wondershare\WAF\WsAppService.exe" [X]
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R0 amdkmpfd; C:\WINDOWS\System32\drivers\amdkmpfd.sys [97184 2016-10-26] (Advanced Micro Devices, Inc.)
S3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-08-07] (Disc Soft Ltd)
S3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2016-08-07] (Disc Soft Ltd)
R3 ETDSMBus; C:\WINDOWS\system32\DRIVERS\ETDSMBus.sys [32328 2015-09-20] (ELAN Microelectronic Corp.)
R3 NETwNe64; C:\WINDOWS\System32\drivers\NETwew01.sys [3343872 2015-10-30] (Intel Corporation)
S3 ptun0901; C:\WINDOWS\System32\drivers\ptun0901.sys [27136 2016-06-15] (The OpenVPN Project)
R0 PxHlpa64; C:\WINDOWS\System32\Drivers\PxHlpa64.sys [56336 2012-08-09] (Corel Corporation)
R3 RadioHIDMini; C:\WINDOWS\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek                                            )
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [402960 2015-05-14] (Realsil Semiconductor Corporation)
R3 SensorsAlsDriver; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [216064 2015-10-30] (Microsoft Corporation)
R3 usb3Hub; C:\WINDOWS\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
R3 XHCIPort; C:\WINDOWS\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)
U3 aswMBR; C:\Users\Alaina McKinzie\AppData\Local\Temp\aswMBR.sys [62728 2017-01-26] () [File not signed]
U3 aswVmm; C:\Users\Alaina McKinzie\AppData\Local\Temp\aswVmm.sys [224896 2017-01-26] ()
S3 SBIOSIO; \??\C:\Users\ALAINA~1\AppData\Local\Temp\__Samsung_Update\SBIOSIO64.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-01-26 15:23 - 2017-01-26 15:24 - 00028095 _____ C:\Users\Alaina McKinzie\Desktop\FRST.txt
2017-01-26 15:23 - 2017-01-26 15:23 - 00000000 ____D C:\FRST
2017-01-26 15:19 - 2017-01-26 15:21 - 02420736 _____ (Farbar) C:\Users\Alaina McKinzie\Desktop\FRST64.exe
2017-01-26 15:19 - 2017-01-26 15:20 - 05198336 _____ (AVAST Software) C:\Users\Alaina McKinzie\Downloads\aswMBR.exe
2017-01-24 10:54 - 2017-01-24 10:55 - 00000000 ____D C:\WINDOWS\Panther
2017-01-24 10:54 - 2017-01-24 10:54 - 00000000 ___HD C:\$WINDOWS.~BT
2017-01-19 14:23 - 2017-01-19 14:23 - 00001030 _____ C:\Users\Public\Desktop\World of Warcraft.lnk
2017-01-19 14:23 - 2017-01-19 14:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2017-01-19 14:18 - 2017-01-24 21:24 - 00000000 ____D C:\Program Files (x86)\World of Warcraft
2017-01-19 14:17 - 2017-01-24 21:23 - 00000000 ____D C:\Users\Alaina McKinzie\AppData\Local\Battle.net
2017-01-19 14:17 - 2017-01-19 14:17 - 00000936 _____ C:\Users\Public\Desktop\Battle.net.lnk
2017-01-19 14:17 - 2017-01-19 14:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2017-01-19 14:14 - 2017-01-24 21:23 - 00000000 ____D C:\Program Files (x86)\Battle.net
2017-01-19 14:14 - 2017-01-19 14:18 - 00000000 ____D C:\Users\Alaina McKinzie\AppData\Roaming\Battle.net
2017-01-18 10:07 - 2017-01-18 10:07 - 00000000 ____D C:\Users\Alaina McKinzie\Documents\Electronic Arts
2017-01-18 09:24 - 2017-01-18 09:26 - 00000000 ____D C:\ProgramData\Electronic Arts
2017-01-18 09:14 - 2017-01-18 09:14 - 00002110 _____ C:\Users\Public\Desktop\The Sims™ 3.lnk
2017-01-18 09:08 - 2017-01-18 09:43 - 00000000 ____D C:\Program Files (x86)\Electronic Arts
2017-01-17 08:23 - 2017-01-17 08:28 - 00000000 ____D C:\Users\Alaina McKinzie\AppData\Local\Last.fm
2017-01-17 08:23 - 2017-01-17 08:28 - 00000000 ____D C:\Program Files (x86)\Last.fm
2017-01-17 07:58 - 2017-01-17 07:58 - 00002872 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2017-01-17 07:58 - 2017-01-17 07:58 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-01-17 07:58 - 2017-01-17 07:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2017-01-17 07:58 - 2017-01-17 07:58 - 00000000 ____D C:\Program Files\CCleaner
2017-01-17 07:57 - 2017-01-21 08:59 - 00000000 ____D C:\AdwCleaner
2017-01-17 07:56 - 2017-01-17 07:57 - 03988944 _____ C:\Users\Alaina McKinzie\Desktop\adwcleaner_6.042.exe
2017-01-16 16:28 - 2017-01-16 16:28 - 00002344 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-01-16 16:28 - 2017-01-16 16:28 - 00002332 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-01-16 16:22 - 2017-01-16 17:28 - 00003416 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-01-16 16:22 - 2017-01-16 17:28 - 00003292 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-01-16 16:21 - 2017-01-16 16:22 - 00000000 ____D C:\Users\Alaina McKinzie\AppData\Local\Deployment
2017-01-16 15:17 - 2016-12-21 03:01 - 01540224 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-01-16 15:17 - 2016-12-21 03:01 - 00692136 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2017-01-16 15:17 - 2016-12-21 02:25 - 01594416 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2017-01-16 15:17 - 2016-12-21 01:18 - 01372312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2017-01-16 15:17 - 2016-12-21 00:56 - 01502208 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2017-01-16 15:17 - 2016-12-20 23:41 - 04895744 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-01-16 15:17 - 2016-12-20 23:39 - 22373376 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-01-16 15:17 - 2016-12-20 23:15 - 07839232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-01-16 15:17 - 2016-12-20 23:06 - 03663872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-01-16 15:17 - 2016-12-20 23:03 - 18671616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-01-16 15:17 - 2016-12-20 22:48 - 05658624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-01-16 15:17 - 2016-10-25 00:55 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-01-05 16:21 - 2017-01-05 16:21 - 00423912 ____T C:\Users\Alaina McKinzie\Documents\ACT_TICKET.pdf
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-01-26 15:16 - 2016-09-19 21:11 - 00000312 _____ C:\WINDOWS\Tasks\{27297795-2451-6FDC-8C85-6AEB0183DEFD}.job
2017-01-26 15:06 - 2015-04-14 10:32 - 00004164 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{CC5BFC60-86D7-4CF0-AF3A-E14E5D3BC466}
2017-01-26 15:06 - 2013-01-14 12:05 - 00000000 ____D C:\ProgramData\WinClon
2017-01-26 15:05 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-01-26 15:05 - 2015-04-12 22:32 - 00000000 ____D C:\Users\Alaina McKinzie\AppData\Local\Adobe
2017-01-26 15:02 - 2016-12-15 17:30 - 00003292 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-01-26 15:02 - 2015-08-31 19:07 - 00002429 _____ C:\Users\Alaina McKinzie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-01-26 15:02 - 2015-04-22 13:17 - 00000000 __RDO C:\Users\Alaina McKinzie\OneDrive
2017-01-26 14:59 - 2016-09-19 22:16 - 00000328 _____ C:\Users\Alaina McKinzie\AppData\Roaming\WB.CFG
2017-01-26 14:59 - 2015-04-10 08:40 - 00000000 __SHD C:\Users\Alaina McKinzie\IntelGraphicsProfiles
2017-01-26 14:58 - 2015-12-29 01:29 - 00000000 ____D C:\Users\Alaina McKinzie
2017-01-26 14:57 - 2015-12-29 01:50 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-01-24 21:47 - 2015-04-21 11:58 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2017-01-24 11:16 - 2015-10-30 01:24 - 00000000 ___HD C:\Program Files\WindowsApps
2017-01-24 11:15 - 2015-04-29 16:50 - 00000000 ____D C:\Users\Alaina McKinzie\AppData\Roaming\Spotify
2017-01-24 11:15 - 2015-04-29 16:50 - 00000000 ____D C:\Users\Alaina McKinzie\AppData\Local\Spotify
2017-01-21 10:33 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-01-21 10:13 - 2016-08-16 18:49 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin
2017-01-21 10:13 - 2015-10-30 00:28 - 00786432 ___SH C:\WINDOWS\system32\config\BBI
2017-01-21 10:10 - 2015-10-30 01:21 - 00000000 ____D C:\WINDOWS\INF
2017-01-21 09:19 - 2015-05-31 11:38 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-01-20 20:48 - 2015-10-30 01:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-01-20 20:48 - 2015-04-14 12:09 - 00000000 ____D C:\Program Files\Microsoft Office 15
2017-01-19 16:14 - 2016-09-28 18:14 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-01-18 09:43 - 2013-01-14 11:38 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-01-18 09:15 - 2015-08-17 16:12 - 00000230 _____ C:\WINDOWS\wininit.ini
2017-01-17 08:09 - 2016-08-07 19:55 - 00000000 ____D C:\Users\Alaina McKinzie\AppData\Roaming\DAEMON Tools Lite
2017-01-17 08:09 - 2015-06-14 11:35 - 00000000 ____D C:\Users\Alaina McKinzie\AppData\Roaming\Sony
2017-01-17 08:08 - 2015-04-21 12:12 - 00000000 ____D C:\Users\Alaina McKinzie\AppData\Local\CrashDumps
2017-01-16 18:33 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\rescache
2017-01-16 17:34 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-01-16 16:59 - 2015-04-12 23:38 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-01-16 16:56 - 2015-10-30 01:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-01-16 16:56 - 2015-04-12 23:38 - 135657872 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-01-16 16:28 - 2015-04-14 10:40 - 00000000 ____D C:\Program Files (x86)\Google
2017-01-16 15:50 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-01-16 15:50 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-01-16 15:11 - 2016-08-17 18:26 - 00000000 ____D C:\Users\Alaina McKinzie\Documents\School 2016-2017
2017-01-10 10:08 - 2015-07-19 15:57 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2017-01-09 17:16 - 2016-09-19 21:11 - 00000000 ____D C:\Users\Alaina McKinzie\AppData\Roaming\{2226149D-0774-79EB-6C42-5E39B090A307}
2016-12-31 11:27 - 2015-10-30 01:26 - 00744578 _____ C:\WINDOWS\system32\perfh009.dat
2016-12-31 11:27 - 2015-10-30 01:26 - 00139168 _____ C:\WINDOWS\system32\perfc009.dat
2016-12-31 11:27 - 2015-08-30 19:27 - 00879220 _____ C:\WINDOWS\system32\PerfStringBackup.INI
 
==================== Files in the root of some directories =======
 
2015-10-18 10:58 - 2015-10-18 10:58 - 0000000 _____ () C:\Program Files (x86)\Common Files\AMD
2015-04-12 22:23 - 2015-04-14 12:16 - 0019516 _____ () C:\Users\Alaina McKinzie\AppData\Roaming\AbsoluteReminder.xml
2015-09-12 16:00 - 2016-03-26 15:02 - 0000132 _____ () C:\Users\Alaina McKinzie\AppData\Roaming\Adobe PNG Format CC Prefs
2016-10-25 11:51 - 2016-10-25 11:51 - 0000112 _____ () C:\Users\Alaina McKinzie\AppData\Roaming\JP2K CS6 Prefs
2016-09-19 21:11 - 2016-09-19 21:16 - 0020058 _____ () C:\Users\Alaina McKinzie\AppData\Roaming\Ponobe
2016-09-19 22:16 - 2017-01-26 14:59 - 0000328 _____ () C:\Users\Alaina McKinzie\AppData\Roaming\WB.CFG
2016-08-01 22:34 - 2016-08-18 20:17 - 302675591 _____ () C:\Users\Alaina McKinzie\AppData\Local\ACCCx3_7_5_291.zip.aamdownload
2016-08-01 22:34 - 2016-08-18 20:17 - 0003392 _____ () C:\Users\Alaina McKinzie\AppData\Local\ACCCx3_7_5_291.zip.aamdownload.aamd
2016-12-23 20:23 - 2016-12-23 20:23 - 0008054 _____ () C:\Users\Alaina McKinzie\AppData\Local\recently-used.xbel
2015-12-29 01:25 - 2015-12-29 01:25 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-01-14 12:10 - 2013-02-21 15:59 - 2063240 _____ (Samsung Electronics) C:\ProgramData\MakeMarkerFile.exe
2013-01-14 12:10 - 2013-01-12 22:51 - 0003004 _____ () C:\ProgramData\MakeMarkerFile.xml
 
Files to move or delete:
====================
C:\Windows\Tasks\{27297795-2451-6FDC-8C85-6AEB0183DEFD}.job
 
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2017-01-21 09:47
 
==================== End of FRST.txt ============================
 
 
 
ADDITION 
 
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-01-2017 01
Ran by [removed] (26-01-2017 15:24:38)
Running from C:\Users\[removed]\Desktop
Windows 10 Home Version 1511 (X64) (2015-12-29 08:02:17)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-429855145-656000057-2018818212-500 - Administrator - Disabled) => C:\Users\Administrator
Alaina McKinzie (S-1-5-21-429855145-656000057-2018818212-1008 - Administrator - Enabled) => C:\Users\Alaina McKinzie
DefaultAccount (S-1-5-21-429855145-656000057-2018818212-503 - Limited - Disabled)
Guest (S-1-5-21-429855145-656000057-2018818212-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-429855145-656000057-2018818212-1003 - Limited - Enabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Out of date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
7-Zip 15.14 (x64) (HKLM\…\7-Zip) (Version: 15.14 - Igor Pavlov)
7-Zip 16.03 (HKLM-x32\…\7-Zip) (Version: 16.03 - Igor Pavlov)
Absolute Reminder (HKLM-x32\…\{40F4FF7A-B214-4453-B973-080B09CED019}) (Version: 2.1.0.8 - Absolute Software)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.023.20056 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 17.0.0.144 - Adobe Systems Incorporated)
Adobe Flash Player 24 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 24.0.0.194 - Adobe Systems Incorporated)
Adobe Photoshop CC (HKLM-x32\…\{2D99B50E-431D-4AA8-85C1-172A6F8BCF09}) (Version: 14.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 11 (HKLM-x32\…\Adobe Photoshop Elements 11) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.1.9.160 - Adobe Systems, Inc.)
Adobe Update Management Tool (HKLM-x32\…\{534A7A1A-7102-4AF6-23EA-7CD279C7B625}_is1) (Version: 6.2 - PainteR)
AMD Catalyst Install Manager (HKLM\…\{77A7CE43-5A1E-8282-931B-E0CC4C075793}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.)
AMD Settings (HKLM\…\WUCCCApp) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.)
Apple Application Support (32-bit) (HKLM-x32\…\{D079CAAD-0C31-47A2-9AF5-A82F9CD9B221}) (Version: 5.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\…\{64E6007B-1DA9-42CD-BBE4-D5FA67A7C71D}) (Version: 5.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Battle.net (HKLM-x32\…\Battle.net) (Version:  - Blizzard Entertainment)
Bonjour (HKLM\…\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Canon MG2900 series MP Drivers (HKLM\…\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2900_series) (Version: 1.01 - Canon Inc.)
Catalyst Control Center Next Localization BR (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization BR (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization BR (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2015.1129.2307.41591 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.0624.1251.21301 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\…\CCleaner) (Version: 5.26 - Piriform)
CyberLink PowerDVD 10 (HKLM-x32\…\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4421.02 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
ELAN Touchpad driver X64 15.7.9.2_WHQL (HKLM\…\Elantech) (Version: 15.7.9.2 - ELAN Microelectronic Corp.)
Elements 11 Organizer (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
E-POP (HKLM-x32\…\{F06DD8D9-9DC8-430C-835C-C9BF21E05CC1}) (Version: 1.0.1 - Samsung Electronics CO., LTD.)
Fitbit Connect (HKLM-x32\…\{E54705FB-98A6-4C03-B2DC-D8C3B5486DCD}) (Version: 2.0.0.6512 - Fitbit Inc.)
Galería de fotos (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 55.0.2883.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
GoPro App (x32 Version: 0.1.443 - GoPro, Inc.) Hidden
GoPro Studio 2.5.5 (HKLM-x32\…\{5d43231e-c765-405a-a122-81de16acd8b4}) (Version: 2.5.5.443 - GoPro, Inc.)
Help Desk (HKLM\…\{3D85CD3F-00E0-4E14-82D6-1F9397DDD09B}) (Version: 1.0.8 - Samsung Electronics CO., LTD.)
Intel AppUp(SM) center (HKLM-x32\…\Intel AppUp(SM) center 33070) (Version: 3.6.1.33070.11 - Intel)
Intel(R) Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\…\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.36702 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\…\{302600C1-6BDF-4FD1-1309-148929CC1385}) (Version: 3.1.1309.0390 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\…\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\…\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) WiDi (HKLM\…\{6097158B-0184-4140-BEC3-7885794D2571}) (Version: 3.5.40.0 - Intel Corporation)
Intel® Driver Update Utility (HKLM-x32\…\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)
Intel® PROSet/Wireless Software (HKLM-x32\…\{89a03d4c-5e14-4180-984e-6932893138fc}) (Version: 17.14.0 - Intel Corporation)
IntelliMemory (HKLM\…\{40320F22-7D70-49DB-9D66-B6FAE5F36B47}) (Version: 1.0.32.0 - Condusiv Technologies)
iTunes (HKLM\…\{81C96689-EA5B-4B7D-A04F-16326EC51BC2}) (Version: 12.5.4.42 - Apple Inc.)
Java 8 Update 111 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office Home and Student 2013 - en-us (HKLM\…\HomeStudentRetail - en-us) (Version: 15.0.4893.1002 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\…\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
OEM Application Profile (HKLM-x32\…\{EE55B368-EBDF-98F3-CFE7-7CE4ADBC4553}) (Version: 1.00.0004 - Advanced Micro Devices, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4893.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4893.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4893.1002 - Microsoft Corporation) Hidden
PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
PowerXpressHybrid (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
PSE11 STI Installer (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.4.907.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7543 - Realtek Semiconductor Corp.)
Realtek USB Card Reader (HKLM-x32\…\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.2.9200.39035 - Realtek Semiconductor Corp.)
Recovery (HKLM-x32\…\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 6.1.0.1 - Samsung Electronics CO., LTD.)
S Agent (Version: 1.1.51 - Samsung Electronics CO., LTD.) Hidden
Samsung Survey (HKLM-x32\…\{F1F6B58E-CF23-475C-AA96-EC658E9E50F3}) (Version: 2.0.1 - Samsung Electronics Co., Ltd.)
Skype™ 7.3 (HKLM-x32\…\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\Spotify) (Version: 1.0.45.186.g3b5036d6 - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.5.43 - Safer-Networking Ltd.)
SRS Premium Sound (HKLM-x32\…\{E44F8A34-529E-4318-A0E1-1893C337A47F}) (Version: 1.00.2000 - SRS Labs)
SW Update (HKLM-x32\…\{F5B5BA56-8FEB-494B-84E6-C8DA9C2BEE50}) (Version: 2.1.6 - Samsung Electronics CO., LTD.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
The Sims™ 3 (HKLM-x32\…\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.67.2 - Electronic Arts)
The Sims™ 3 Ambitions (HKLM-x32\…\{910F4A29-1134-49E0-AD8B-56E4A3152BD1}) (Version: 4.0.87 - Electronic Arts)
The Sims™ 3 Diesel Stuff (HKLM-x32\…\{1C9B6173-6DC9-4EEE-9EFC-6BA115CFBE43}) (Version: 14.0.48 - Electronic Arts)
The Sims™ 3 Fast Lane Stuff (HKLM-x32\…\{ED436EA8-4145-4703-AE5D-4D09DD24AF5A}) (Version: 5.0.44 - Electronic Arts)
The Sims™ 3 Generations (HKLM-x32\…\{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}) (Version: 8.0.152 - Electronic Arts)
The Sims™ 3 High-End Loft Stuff (HKLM-x32\…\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.0.38 - Electronic Arts)
The Sims™ 3 Late Night (HKLM-x32\…\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.0.81 - Electronic Arts)
The Sims™ 3 Master Suite Stuff (HKLM-x32\…\{08A25478-C5DD-4EA7-B168-3D687CA987FF}) (Version: 11.0.84 - Electronic Arts)
The Sims™ 3 Outdoor Living Stuff (HKLM-x32\…\{117B6BF6-82C3-420C-B284-9247C8568E53}) (Version: 7.0.55 - Electronic Arts)
The Sims™ 3 Pets (HKLM-x32\…\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts)
The Sims™ 3 Seasons (HKLM-x32\…\{3DE92282-CB49-434F-81BF-94E5B380E889}) (Version: 16.0.136 - Electronic Arts)
The Sims™ 3 Town Life Stuff (HKLM-x32\…\{7B11296A-F894-449C-8DF6-6AAAA7D4D118}) (Version: 9.0.73 - Electronic Arts)
User Guide (HKLM-x32\…\{66172F70-0BDE-4BAB-A973-E2E4EF501F6D}) (Version: 1.2.00 - Samsung Electronics CO., LTD.)
Vegas Pro 12.0 (64-bit) (HKLM\…\{A7500970-FE98-11E1-B560-F04DA23A5C58}) (Version: 12.0.367 - Sony)
VFW_Codec32 (x32 Version: 0.1.160.0 - GoPro, Inc.) Hidden
VFW_Codec64 (Version: 0.1.160.0 - GoPro, Inc.) Hidden
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
World of Warcraft (HKLM-x32\…\World of Warcraft) (Version:  - Blizzard Entertainment)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-429855145-656000057-2018818212-1008_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {02D8D3EF-8FB2-4EB7-808E-BE810F840ED9} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {081F29AC-9114-42F5-815D-32BEF34488A0} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-01-16] (Adobe Systems Incorporated)
Task: {1DACE207-4C9E-4178-86E4-4814E55D2569} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {1F9E5ABA-8BFE-4A58-91C8-FA58304B34AD} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {2E082525-5A79-4B9B-B134-9C58CB5B5A4D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {346808E2-97DB-4E32-B1E7-9B4CA63BB34F} - System32\Tasks\{27297795-2451-6FDC-8C85-6AEB0183DEFD} => C:\Users\Alaina McKinzie\AppData\Roaming\{2226149D-0774-79EB-6C42-5E39B090A307}\updater.exe [2013-05-01] () <==== ATTENTION
Task: {3A0B1C45-33D3-423C-9772-84173D31813C} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-06-13] (Intel Corporation)
Task: {42B36C03-898F-48C1-9349-09588E4D755C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-01-16] (Google Inc.)
Task: {4C776396-035B-4311-BE49-4FD0B87BA8FE} - System32\Tasks\advRecovery => C:\Program Files\Samsung\Recovery\WCScheduler.exe [2015-07-14] (SEC)
Task: {521F63BD-BC4B-4E59-BDDA-EC8FC8347646} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {60A064BC-646E-44FF-B39E-7664E2CA7C26} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {6A02BFCC-3E94-4304-8089-93FC05E67B5E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-12-21] (Piriform Ltd)
Task: {6BB8D0DF-407A-4D5A-8B83-2A01C0C9C95F} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2017-01-16] (Microsoft Corporation)
Task: {750ED510-1E32-4838-9851-A4672B575B4E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {7A9205CA-B00A-4D08-8CCD-3CDBFF7EF851} - System32\Tasks\{CB33B4CA-2F90-4D95-8E2F-B615644C8B6A} => pcalua.exe -a "C:\Users\Alaina McKinzie\AppData\Local\{227B1427-06D3-789F-6B4B-5D774F23A1EF}\uninst.exe" -c -FN="C:\Users\Alaina McKinzie\AppData\Roaming\{2226149D-0774-79EB-6C42-5E39B090A307}\updater.exe"-P=/Uninstall /s /noun /DelSelfDir
Task: {7F71E104-C770-4BEB-A3A3-8CED05B99597} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-06-13] (Intel Corporation)
Task: {85E18058-95AD-4640-8396-9C52CE5CC4A5} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {8D3F5708-B8AD-4821-A7D6-7EBD02DA67AB} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {8EB1C1D7-E989-4E4D-B20D-D9ABD6D24B78} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {99B98561-13E7-4BF5-892F-4812C37BFB9D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-01-16] (Google Inc.)
Task: {99D19D51-0291-489E-88C8-20A576DE859F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {A1071566-2F8A-4C1C-8229-8145ACDF64C2} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {AFBE0017-BB59-4395-AB47-C74101E1C427} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2014-10-29] (Samsung Electronics CO., LTD.)
Task: {B7C1D953-6944-4C19-B3D3-07B8C8C5B256} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {C0C858CA-0433-4291-9F43-1BF11A1F39FB} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2015-09-17] (Realtek Semiconductor)
Task: {CC863B70-32FD-4E10-A286-F53B3576BEF3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {E4064288-BE68-4B96-8213-C76B8F8B229C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {E72863D7-7C1A-46AC-9E5A-468AB88B6250} - System32\Tasks\AdobeAAMUpdater-1.0-Owner-Alaina McKinzie => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-09-19] (Adobe Systems Incorporated)
Task: {F7A54A62-75B1-4BC3-BBFE-F909CCA4454D} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {F7CED1B8-8034-41EA-BFA7-CB7019BA7B2D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {FC03890F-0E5D-43A0-89E2-F09D97485A48} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\{27297795-2451-6FDC-8C85-6AEB0183DEFD}.job => 
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-10-30 01:18 - 2015-10-30 01:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2015-04-14 12:09 - 2016-05-24 08:51 - 00116416 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2016-09-01 17:12 - 2016-09-01 17:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-11-17 01:28 - 2016-11-17 01:28 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-11-14 17:05 - 2016-10-25 03:42 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-11-14 17:05 - 2016-10-25 03:42 - 02656952 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-12-15 17:30 - 2016-12-15 17:30 - 01678560 _____ () C:\Users\Alaina McKinzie\AppData\Local\Microsoft\OneDrive\17.3.6720.1207\amd64\ClientTelemetry.dll
2016-07-28 19:29 - 2016-05-24 10:43 - 08909504 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2016-04-19 11:08 - 2016-04-19 11:08 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2015-12-29 10:52 - 2015-12-06 22:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-07-18 15:13 - 2016-06-30 21:48 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2014-10-29 16:19 - 2014-10-29 16:19 - 00088624 _____ () C:\Program Files\Samsung\S Agent\ToastX64.dll
2016-11-14 17:06 - 2016-10-24 22:49 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-11-14 17:06 - 2016-10-24 22:44 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-11-14 17:06 - 2016-10-24 22:45 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-11-14 17:06 - 2016-10-24 22:48 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-09-16 14:38 - 2016-09-16 14:38 - 00155016 _____ () C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe
2016-09-13 01:01 - 2016-09-13 01:01 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick.2\qtquick2plugin.dll
2016-09-13 01:01 - 2016-09-13 01:01 - 00739840 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Controls\qtquickcontrolsplugin.dll
2016-09-13 01:01 - 2016-09-13 01:01 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Window.2\windowplugin.dll
2016-09-13 01:01 - 2016-09-13 01:01 - 00071168 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Layouts\qquicklayoutsplugin.dll
2016-09-13 01:01 - 2016-09-13 01:01 - 00011776 _____ () C:\Program Files\AMD\CNext\CNext\libEGL.dll
2016-09-13 01:01 - 2016-09-13 01:01 - 02013696 _____ () C:\Program Files\AMD\CNext\CNext\libGLESv2.dll
2016-09-16 15:14 - 2016-09-16 15:14 - 00017408 _____ () C:\Program Files\ATI Technologies\ATI.ACE\a4\AS4.NativeProxy.dll
2017-01-16 16:28 - 2016-12-08 02:03 - 02412888 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\libglesv2.dll
2017-01-16 16:28 - 2016-12-08 02:03 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\libegl.dll
2015-08-31 19:17 - 2014-05-13 11:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-08-31 19:17 - 2014-05-13 11:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-04-19 11:08 - 2016-04-19 11:08 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-04-19 11:08 - 2016-04-19 11:10 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2015-08-31 19:17 - 2014-05-13 11:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-01-14 11:59 - 2012-06-25 12:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2013-08-22 07:25 - 2016-09-28 18:16 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-429855145-656000057-2018818212-1008\Control Panel\Desktop\\Wallpaper -> C:\Users\Alaina McKinzie\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\background.jpg
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
HKLM\…\StartupApproved\Run: => "Bitcasa"
HKLM\…\StartupApproved\Run: => "BTMTrayAgent"
HKLM\…\StartupApproved\Run: => "iTunesHelper"
HKLM\…\StartupApproved\Run32: => "Fitbit Connect"
HKLM\…\StartupApproved\Run32: => "GoPro Studio Importer"
HKLM\…\StartupApproved\Run32: => "QuickTime Task"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\StartupApproved\Run: => "uTorrent"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\StartupApproved\Run: => "Fitbit Connect"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{825844E2-7A76-47FA-8FF6-4E88EB5CD383}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1E4CA105-5657-4FB9-9F2C-47288DE893B0}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{357F0B3F-546F-495E-A483-1267C3EA5FFC}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{05BE3BD4-7270-447E-8332-6168AB1D6467}] => LPort=1900
FirewallRules: [{F2D34EC7-4CFE-47D8-97AF-561669CD4083}] => LPort=2869
FirewallRules: [{41B66828-F84B-43D6-AFBD-FB2528DC274E}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{51203CAC-A69C-412B-B614-2476533CBB4E}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{CFE5A4A4-761F-4A08-9CF0-4A56DADEA81C}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{2F416B3C-2547-44A6-8B4C-60DC993E109B}] => C:\Program Files\Condusiv Technologies\IntelliMemory\IntelliMem.exe
FirewallRules: [{BE3CFD97-D795-4B00-AF8E-909BA56498B1}] => C:\Program Files\Condusiv Technologies\IntelliMemory\IntelliMem.exe
FirewallRules: [{2B0B073B-28E3-4A46-A269-2D86629C12AB}] => C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe
FirewallRules: [{5FD3E4AC-6ECB-4A99-B724-9822510B39B5}] => C:\Users\Alaina McKinzie\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{9D621729-3AFB-44DB-870B-51E42E6879C7}] => C:\Program Files (x86)\Adobe\Adobe Photoshop CC\Photoshop.exe
FirewallRules: [{787F3E6D-6069-45F0-AC54-589DB0D0FB3B}] => C:\Program Files (x86)\Adobe\Adobe Photoshop CC\Photoshop.exe
FirewallRules: [{F1FB6AA9-ADFD-4FEC-9D4D-55F6760B867B}] => C:\Program Files (x86)\Adobe\Adobe Photoshop CC\Photoshop.exe
FirewallRules: [{0A998F0C-A1A9-4895-B882-50AC965E66E6}] => C:\Program Files (x86)\Adobe\Adobe Photoshop CC\Photoshop.exe
FirewallRules: [{173F5F32-D9FC-4D6B-8A0E-56DE7847B81E}] => C:\Program Files\Adobe\Adobe Photoshop CC (64 Bit)\Photoshop.exe
FirewallRules: [{C7BC8065-2C72-4AFF-AB83-9578CFCC281E}] => C:\Program Files\Adobe\Adobe Photoshop CC (64 Bit)\Photoshop.exe
FirewallRules: [{63F2A14D-7A1A-47E2-AACA-A9FF5F6B9D3E}] => C:\Program Files\Adobe\Adobe Photoshop CC (64 Bit)\Photoshop.exe
FirewallRules: [{AB231805-4BAC-4FCE-B654-0C194F00494B}] => C:\Program Files\Adobe\Adobe Photoshop CC (64 Bit)\Photoshop.exe
FirewallRules: [{2FE8E04E-3EAE-42E2-A1BA-0623CA5B5B37}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{5849E661-BC17-4262-93E0-CCA8655989F7}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{50FA8975-8AC1-464C-B97E-BE04EF15B404}] => C:\Users\Alaina McKinzie\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{8F1AF64B-100C-4F68-9B59-AD73680FBE16}] => C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [TCP Query User{CB13BCF0-6104-4C83-A3E5-8302BACDE27E}C:\users\alaina mckinzie\appdata\roaming\spotify\spotify.exe] => C:\users\alaina mckinzie\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{5773EEDB-FF6F-4F20-9F98-40ACED2326CF}C:\users\alaina mckinzie\appdata\roaming\spotify\spotify.exe] => C:\users\alaina mckinzie\appdata\roaming\spotify\spotify.exe
FirewallRules: [{ABA19853-B6BB-4513-B68D-CB95FFBB521F}] => C:\Program Files\Sony\Vegas Pro 12.0\vegas120.exe
FirewallRules: [{D8C22CA6-966F-4B27-825A-BDB14243242E}] => C:\Program Files\Sony\Vegas Pro 12.0\vegas120.exe
FirewallRules: [{BDBCAC53-43A5-4C4F-A1B8-FDB2110C1976}] => C:\Program Files\Sony\Vegas Pro 12.0\vegas120.exe
FirewallRules: [{28A00C91-6EA8-47E8-A0F2-23B0E690C226}] => C:\Program Files\Sony\Vegas Pro 12.0\vegas120.exe
FirewallRules: [{A162DC0F-AC05-46D7-B14E-6B7701476610}] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{FC7EA25C-8C6C-485A-89B6-6C7E68231C88}] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{45CD0413-081E-4748-A657-E5B03D8CD8CC}] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{7670878F-6137-42CC-B0D3-480883D6FEF1}] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{F7A057C9-C8AD-4D93-82CA-F88010D55B12}] => C:\Program Files (x86)\Acoustica Mixcraft 6\mixcraft6.exe
FirewallRules: [{135EE8DF-5114-4F14-B01E-F2DE5B813681}] => C:\Program Files (x86)\Acoustica Mixcraft 6\mixcraft6.exe
FirewallRules: [{88256623-0BAA-44FB-838B-D192C4050D3F}] => C:\Program Files (x86)\Acoustica Mixcraft 6\mixcraft6.exe
FirewallRules: [{3B5DFC1C-1BE4-46CA-AD7D-49282C7126A4}] => C:\Program Files (x86)\Acoustica Mixcraft 6\mixcraft6.exe
FirewallRules: [{B9DC62D1-2B3C-4E64-B69A-17E48EF0FFF9}] => C:\Program Files (x86)\Acoustica Mixcraft 6\Mixcraft-Updater.exe
FirewallRules: [{82FB69BB-45B0-49FF-A844-C127EAF7E2E2}] => C:\Program Files (x86)\Acoustica Mixcraft 6\Mixcraft-Updater.exe
FirewallRules: [{03C94D7E-1EC7-4712-B3D0-DF5EE8AC076E}] => C:\Program Files (x86)\Acoustica Mixcraft 6\Mixcraft-Updater.exe
FirewallRules: [{77579EB2-EB6A-44FB-A5AD-54511ED37A99}] => C:\Program Files (x86)\Acoustica Mixcraft 6\Mixcraft-Updater.exe
FirewallRules: [TCP Query User{6CBA4B98-9A37-4657-AD06-97E959C20C0D}C:\program files (x86)\wondershare\mobilego-b\mobilegoservice.exe] => C:\program files (x86)\wondershare\mobilego-b\mobilegoservice.exe
FirewallRules: [UDP Query User{CE498350-1128-4DB9-92BB-2FB15F1813AD}C:\program files (x86)\wondershare\mobilego-b\mobilegoservice.exe] => C:\program files (x86)\wondershare\mobilego-b\mobilegoservice.exe
FirewallRules: [{1E712FE7-7C6E-4259-87C7-3D40D5ECCD63}] => C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{82B74127-D3C2-4D88-A021-7B3748D8BEB3}] => C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{2D848103-5D6C-433D-BE66-CD8BDB0FBF92}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E78A872B-FED6-4CDC-8720-186D631BAE62}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5E221EEB-A549-4D45-880B-2E05645FA3B4}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{80CAD922-8B9B-4DD9-AC2B-460A52D7525A}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [TCP Query User{19AB7F40-5A9A-4425-BC7A-ABD2E423166C}C:\program files (x86)\skype\phone\skype.exe] => C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{41206283-8D36-4A30-B969-D08579EDB49C}C:\program files (x86)\skype\phone\skype.exe] => C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{6BB31FEC-E26B-41D9-AA0F-C5618E79EB26}] => C:\Users\Alaina McKinzie\AppData\Local\Chromium\Application\chrome.exe
FirewallRules: [{0FDB757C-8747-480C-BD3D-48A1822F14C1}] => C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{179FB5BB-2063-4AE6-9284-70A326E29634}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [TCP Query User{76CE4762-15F2-4BE8-B754-B0904652BCD0}C:\program files (x86)\electronic arts\eadm\core.exe] => C:\program files (x86)\electronic arts\eadm\core.exe
FirewallRules: [UDP Query User{84B6BC6F-E8A9-4DC6-971B-8F62F875A4AF}C:\program files (x86)\electronic arts\eadm\core.exe] => C:\program files (x86)\electronic arts\eadm\core.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service
 
==================== Restore Points =========================
 
21-01-2017 08:58:45 Removed calibre
21-01-2017 09:00:30 Removed calibre
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (01/26/2017 02:57:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: CAMService.exe, version: 1.0.0.1, time stamp: 0x54077d08
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000
Faulting process id: 0x8a4
Faulting application start time: 0x01d27816c746fd94
Faulting application path: C:\Program Files\Intel\CAM\bin\CAMService.exe
Faulting module path: unknown
Report Id: 8749a16b-e6eb-4217-8741-79ea55cd040c
Faulting package full name: 
Faulting package-relative application ID:
 
Error: (01/24/2017 03:55:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1203
 
Error: (01/24/2017 03:55:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1203
 
Error: (01/24/2017 03:55:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (01/24/2017 11:25:07 AM) (Source: SideBySide) (EventID: 9) (User: )
Description: Activation context generation failed for "c:\program files (x86)\spybot - search & destroy 2\SDImmunizeLibrary.dll".Error in manifest or policy file "c:\program files (x86)\spybot - search & destroy 2\SDImmunizeLibrary.dll" on line 2.
The manifest file root element must be assembly.
 
Error: (01/24/2017 11:25:07 AM) (Source: SideBySide) (EventID: 9) (User: )
Description: Activation context generation failed for "c:\program files (x86)\spybot - search & destroy 2\SDLists.dll".Error in manifest or policy file "c:\program files (x86)\spybot - search & destroy 2\SDLists.dll" on line 2.
The manifest file root element must be assembly.
 
Error: (01/24/2017 11:25:07 AM) (Source: SideBySide) (EventID: 9) (User: )
Description: Activation context generation failed for "c:\program files (x86)\spybot - search & destroy 2\SDLicense.dll".Error in manifest or policy file "c:\program files (x86)\spybot - search & destroy 2\SDLicense.dll" on line 2.
The manifest file root element must be assembly.
 
Error: (01/24/2017 11:25:07 AM) (Source: SideBySide) (EventID: 9) (User: )
Description: Activation context generation failed for "c:\program files (x86)\spybot - search & destroy 2\SDHookDrv64.sys".Error in manifest or policy file "c:\program files (x86)\spybot - search & destroy 2\SDHookDrv64.sys" on line 2.
The manifest file root element must be assembly.
 
Error: (01/24/2017 11:25:07 AM) (Source: SideBySide) (EventID: 9) (User: )
Description: Activation context generation failed for "c:\program files (x86)\spybot - search & destroy 2\SDHookDrv32.sys".Error in manifest or policy file "c:\program files (x86)\spybot - search & destroy 2\SDHookDrv32.sys" on line 2.
The manifest file root element must be assembly.
 
Error: (01/24/2017 11:25:07 AM) (Source: SideBySide) (EventID: 9) (User: )
Description: Activation context generation failed for "c:\program files (x86)\spybot - search & destroy 2\SDAV.dll".Error in manifest or policy file "c:\program files (x86)\spybot - search & destroy 2\SDAV.dll" on line 2.
The manifest file root element must be assembly.
 
 
System errors:
=============
Error: (01/26/2017 03:24:16 PM) (Source: DCOM) (EventID: 10010) (User: ALAINA)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
 
Error: (01/26/2017 03:23:46 PM) (Source: DCOM) (EventID: 10010) (User: ALAINA)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
 
Error: (01/26/2017 03:22:43 PM) (Source: DCOM) (EventID: 10010) (User: ALAINA)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
 
Error: (01/26/2017 03:22:13 PM) (Source: DCOM) (EventID: 10010) (User: ALAINA)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
 
Error: (01/26/2017 03:21:16 PM) (Source: DCOM) (EventID: 10010) (User: ALAINA)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
 
Error: (01/26/2017 03:18:38 PM) (Source: DCOM) (EventID: 10010) (User: ALAINA)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
 
Error: (01/26/2017 03:02:45 PM) (Source: DCOM) (EventID: 10010) (User: ALAINA)
Description: The server {DABF28BE-F6B4-4E40-8F40-C4FB26F3116C} did not register with DCOM within the required timeout.
 
Error: (01/26/2017 03:02:04 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Delivery Optimization service hung on starting.
 
Error: (01/26/2017 03:01:27 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.
 
Error: (01/26/2017 02:58:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.
 
 
CodeIntegrity:
===================================
  Date: 2017-01-16 18:23:41.971
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\WINDOWS\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-01-16 17:46:01.685
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\WINDOWS\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2017-01-16 17:00:37.488
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\WINDOWS\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-12-19 10:22:49.723
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\WINDOWS\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-12-17 16:21:28.438
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\WINDOWS\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-12-17 12:31:58.118
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\WINDOWS\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-11-26 14:33:20.513
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\WINDOWS\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-11-26 13:11:38.227
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\WINDOWS\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-11-15 17:07:55.380
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\WINDOWS\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-11-08 09:10:09.711
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\WINDOWS\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: Intel(R) Core(TM) i7-3635QM CPU @ 2.40GHz
Percentage of memory in use: 34%
Total physical RAM: 8078.88 MB
Available physical RAM: 5267.45 MB
Total Virtual: 9358.88 MB
Available Virtual: 6621.67 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:908.72 GB) (Free:785.6 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 4F494D44)
 
Partition: GPT.
 
==================== End of Addition.txt ============================
Post #2
Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)


[external image: FRSTfix.JPG]

 

start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-429855145-656000057-2018818212-1008\…\Run: [Chromium] => "c:\users\alaina mckinzie\appdata\local\chromium\application\chrome.exe" –auto-launch-at-startup –profile-directory="Default" –restore-last-session –restore-last-session
GroupPolicy: Restriction <======= ATTENTION
HKU\S-1-5-21-429855145-656000057-2018818212-1008\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-429855145-656000057-2018818212-1008\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=INMODF&PC=IN05
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-429855145-656000057-2018818212-1008 -> {d4fee3d1-1014-4db8-a824-573bf9ab51c7} URL =
FF SearchPlugin: C:\Users\Alaina McKinzie\AppData\Roaming\Mozilla\Firefox\Profiles\lo3gqdzz.default\searchplugins\Search Provided by Bing.xml [2016-08-07]
CHR StartupUrls: Default -> "hxxp://mysearch.avg.com/?cid={C0FD3C18-FF37-4D2C-96A4-4C0A0E464830}&mid=bbf4a91c6c6147d09dcef9db0cbda486-fa8c8636e067ef3438a9d1457c4dd95abab867ce&lang=en&ds=AVG&pr=fr&d=2013-05-03 09:40:17&v=15.0.1.2&pid=safeguard&sg=1&sap=hp","hxxp://search.conduit.com/?ctid=CT3287807&SearchSource=48&CUI=UN63435513121776250&UM=2","hxxp://search.conduit.com/?ctid=CT3289847&SearchSource=48&CUI=UN21346491832967455&UM=2","hxxp://mysearch.avg.com?cid={486EC094-A02F-424D-A6F9-6B79A52B589C}&mid=83b23eb8d29c47d39dc7f9db0cbda486-fa8c8636e067ef3438a9d1457c4dd95abab867ce&lang=en&ds=AVG&coid=avgtbavg&pr=fr&d=2013-09-09 11:24:48&v=17.0.1.4&pid=safeguard&sg=&sap=hp","hxxp://search.conduit.com/?ctid=CT3324776&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPDF4EF8A6-35CE-4220-8C48-7B539992BA1E&SSPV=","hxxp://www.default-search.net?sid=503&aid=101&itype=n&ver=13001&tm=401&src=hmp","hxxp://us.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_pwrisofs_15_33¶m1=1¶m2=f%3D7%26b%3DChrome%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0C0A0FyBtAtA0EtDyE0C0CzyyB0C0DtCtN0D0Tzu0StCtAtBtAtN1L2XzutAtFtCtBtFyDtFtAtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StAtA0BtCtByC0AtDtGtA0E0FtCtG0A0E0DyBtGtCyEyEzytGtBzz0AyCtCyBzyyB0AyDyEtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtDzztB0CyBtByEtGzyyCtDtCtGyE0BtD0FtG0BtC0DzytGzytC0B0CtCtCzyyEyB0FyBzz2QtN0A0LzuyE%26cr%3D842925453%26a%3Dwncy_pwrisofs_15_33%26os%3DWindows%2B8.1"
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Alaina McKinzie\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.824\_platform_specific\win_x86\widevinecdmadapter.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\PepperFlash\pepflashplayer.dll => No File
S3 WsAppService; "C:\Program Files (x86)\Wondershare\WAF\WsAppService.exe" [X]
C:\Program Files (x86)\Wondershare\WAF
C:\Windows\Tasks\{27297795-2451-6FDC-8C85-6AEB0183DEFD}.job
Task: {02D8D3EF-8FB2-4EB7-808E-BE810F840ED9} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {1DACE207-4C9E-4178-86E4-4814E55D2569} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {1F9E5ABA-8BFE-4A58-91C8-FA58304B34AD} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {2E082525-5A79-4B9B-B134-9C58CB5B5A4D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {346808E2-97DB-4E32-B1E7-9B4CA63BB34F} - System32\Tasks\{27297795-2451-6FDC-8C85-6AEB0183DEFD} => C:\Users\Alaina McKinzie\AppData\Roaming\{2226149D-0774-79EB-6C42-5E39B090A307}\updater.exe [2013-05-01] () <==== ATTENTION
Task: {85E18058-95AD-4640-8396-9C52CE5CC4A5} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {8EB1C1D7-E989-4E4D-B20D-D9ABD6D24B78} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {E4064288-BE68-4B96-8213-C76B8F8B229C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {F7A54A62-75B1-4BC3-BBFE-F909CCA4454D} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {F7CED1B8-8034-41EA-BFA7-CB7019BA7B2D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {FC03890F-0E5D-43A0-89E2-F09D97485A48} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
EmptyTemp:
End


Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~

If you will, please go to the version of AdwCleaner you have on desktop - right click on that, select delete.


We'll get a current version.

[external image: BY4dvz9.png]AdwCleaner
  • Please download AdwCleaner and save the file to your Desktop.
    In order to use AdwCleaner, you have to agree the Eula:
  • Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
  • Follow the prompts.
  • Click [external image: A49sxPr.png]Scan.
  • Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
  • Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
  • Click [external image: MqHawIb.png]Clean.
  • Follow the prompts and allow your computer to reboot.
  • After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.
– File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
~~
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI