Please help me get rid of minergate [Solved]

hey everyone, how's it going?


So it's like this.


I downloaded a file, and unfortunately malwarebytes says that it contained Minergate, which a friend of mine pointed out is something that mines bitcoins. It's slowing down my computer, and causes Firefox to freeze a lot, and I'd really like to get rid of it.


I ran aswMBR and Farbar recovery tool scan, but And have attached the logs. I haven't tried to do any fixes with them.


Please, if you can, help me.


Thank you.


Edit: Noticed that others are just posting the text itself rather than the files, so here you go!


aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-10-06 20:10:33
—————————–
20:10:33.125    OS Version: Windows x64 6.2.9200
20:10:33.126    Number of processors: 8 586 0x200
20:10:33.127    ComputerName: MORTE  UserName:
20:10:35.857    Initialize success
20:10:35.945    VM: initialized successfully
20:10:35.946    VM: Amd CPU supported
20:11:52.272    AVAST engine defs: 17030301
20:13:27.563    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000031
20:13:27.564    Disk 0 Vendor: TOSHIBA_DT01ACA200 MX4OABB0 Size: 1907729MB BusType: 11
20:13:27.659    Disk 0 MBR read successfully
20:13:27.661    Disk 0 MBR scan
20:13:27.665    Disk 0 Windows 7 default MBR code
20:13:27.671    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          350 MB offset 2048
20:13:27.675    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS      1907377 MB offset 718848
20:13:27.746    Disk 0 scanning C:\Windows\system32\drivers
20:13:40.577    Service scanning
20:14:07.180    Modules scanning
20:14:07.185    Disk 0 trace - called modules:
20:14:07.546    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll storahci.sys
20:14:07.549    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe000a3ebf770]
20:14:07.552    3 CLASSPNP.SYS[fffff801e782eabb] -> nt!IofCallDriver -> \Device\00000031[0xffffe000a3d297f0]
20:14:09.444    AVAST engine scan C:\Windows
20:14:12.792    AVAST engine scan C:\Windows\system32
20:17:11.606    AVAST engine scan C:\Windows\system32\drivers
20:18:07.869    AVAST engine scan C:\Users\MorteTorment
20:19:36.435    Disk 0 MBR has been saved successfully to "C:\Users\MorteTorment\Desktop\MBR.dat"
20:19:36.442    The log file has been saved successfully to "C:\Users\MorteTorment\Desktop\aswMBR.txt"


aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-10-06 21:43:43
—————————–
21:43:43.435    OS Version: Windows x64 6.2.9200
21:43:43.435    Number of processors: 8 586 0x200
21:43:43.436    ComputerName: MORTE  UserName:
21:43:49.969    Initialize success
21:43:50.119    VM: initialized successfully
21:43:50.139    VM: Amd CPU supported
21:48:37.375    AVAST engine defs: 17030301
21:48:44.642    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000031
21:48:44.644    Disk 0 Vendor: TOSHIBA_DT01ACA200 MX4OABB0 Size: 1907729MB BusType: 11
21:48:45.725    Disk 0 MBR read successfully
21:48:45.727    Disk 0 MBR scan
21:48:45.731    Disk 0 Windows 7 default MBR code
21:48:45.744    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          350 MB offset 2048
21:48:45.899    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS      1907377 MB offset 718848
21:48:46.625    Disk 0 scanning C:\Windows\system32\drivers
21:49:53.241    Service scanning
21:50:23.318    Modules scanning
21:50:23.323    Disk 0 trace - called modules:
21:50:23.700    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys storahci.sys hal.dll
21:50:23.704    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe000a3ebf770]
21:50:23.707    3 CLASSPNP.SYS[fffff801e782eabb] -> nt!IofCallDriver -> \Device\00000031[0xffffe000a3d297f0]
21:50:26.555    AVAST engine scan C:\Windows
21:55:39.653    Disk 0 MBR has been saved successfully to "C:\Users\MorteTorment\Desktop\MBR.dat"
21:55:39.675    The log file has been saved successfully to "C:\Users\MorteTorment\Desktop\aswMBR.txt"


aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-10-06 21:43:43
—————————–
21:43:43.435    OS Version: Windows x64 6.2.9200
21:43:43.435    Number of processors: 8 586 0x200
21:43:43.436    ComputerName: MORTE  UserName:
21:43:49.969    Initialize success
21:43:50.119    VM: initialized successfully
21:43:50.139    VM: Amd CPU supported
21:48:37.375    AVAST engine defs: 17030301
21:48:44.642    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000031
21:48:44.644    Disk 0 Vendor: TOSHIBA_DT01ACA200 MX4OABB0 Size: 1907729MB BusType: 11
21:48:45.725    Disk 0 MBR read successfully
21:48:45.727    Disk 0 MBR scan
21:48:45.731    Disk 0 Windows 7 default MBR code
21:48:45.744    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          350 MB offset 2048
21:48:45.899    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS      1907377 MB offset 718848
21:48:46.625    Disk 0 scanning C:\Windows\system32\drivers
21:49:53.241    Service scanning
21:50:23.318    Modules scanning
21:50:23.323    Disk 0 trace - called modules:
21:50:23.700    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys storahci.sys hal.dll
21:50:23.704    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe000a3ebf770]
21:50:23.707    3 CLASSPNP.SYS[fffff801e782eabb] -> nt!IofCallDriver -> \Device\00000031[0xffffe000a3d297f0]
21:50:26.555    AVAST engine scan C:\Windows
21:55:39.653    Disk 0 MBR has been saved successfully to "C:\Users\MorteTorment\Desktop\MBR.dat"
21:55:39.675    The log file has been saved successfully to "C:\Users\MorteTorment\Desktop\aswMBR.txt"
21:56:57.099    AVAST engine scan C:\Windows\system32
22:12:51.187    AVAST engine scan C:\Windows\system32\drivers
22:13:34.244    AVAST engine scan C:\Users\MorteTorment
22:15:05.271    Disk 0 MBR has been saved successfully to "C:\Users\MorteTorment\Desktop\MBR.dat"
22:15:05.413    The log file has been saved successfully to "C:\Users\MorteTorment\Desktop\aswMBR.txt"


—-



Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 06-10-2017
Ran by [removed] (administrator) on MORTE (06-10-2017 20:57:27)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 8.1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Windows\appdata\nssm.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\SeaPort.EXE
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Comfort Software Group) C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe
(Discord Inc.) C:\Users\MorteTorment\AppData\Local\Discord\app-0.0.298\Discord.exe
(Valve Corporation) C:\Steam\Steam.exe
(Discord Inc.) C:\Users\MorteTorment\AppData\Local\Discord\app-0.0.298\Discord.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Cerulean Studios) C:\Program Files (x86)\Trillian\trillian.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Discord Inc.) C:\Users\MorteTorment\AppData\Local\Discord\app-0.0.298\Discord.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) C:\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(GOG.com) C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
(GOG.com) C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe
(GOG.com) C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
(GOG.com) C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
(GOG.com) C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
(GOG.com) C:\Program Files (x86)\GOG Galaxy\GOG Galaxy Notifications Renderer.exe
(Microsoft Corporation) C:\Windows\System32\SndVol.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
() C:\MISC\Game Mods\MM6\Might_and_Magic_VI_Hack_Tool\MM6CHE.EXE
(New World Computing) C:\GOG Games\Might and Magic 6\MM6.exe
() C:\Windows\appdata\svchost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(AVAST Software) C:\Users\MorteTorment\Downloads\aswMBR(1).exe
(Farbar) C:\Users\MorteTorment\Desktop\FRST64(1).exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-07-14] (Apple Inc.)
HKLM-x32\…\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM-x32\…\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5885352 2017-06-29] (LogMeIn Inc.)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-12] (Oracle Corporation)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [FreeAC] => C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe [3015072 2016-01-19] (Comfort Software Group)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [uTorrent] => C:\Program Files (x86)\uTorrent\uTorrent.exe [399224 2016-09-13] (BitTorrent, Inc.)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [AIM for Windows] => C:\Users\MorteTorment\AppData\Local\AOL\AIM\aim.exe [1075608 2016-10-03] (AOL Inc.)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [Akamai NetSession Interface] => C:\Users\MorteTorment\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [Discord] => C:\Users\MorteTorment\AppData\Local\Discord\app-0.0.298\Discord.exe [57477112 2017-08-08] (Discord Inc.)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [Steam] => C:\Steam\steam.exe [3074336 2017-10-04] (Valve Corporation)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [GalaxyClient] => C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe [5161536 2017-10-06] (GOG.com)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4468056 2015-06-18] (Disc Soft Ltd)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [MyComGames] => C:\Users\MorteTorment\AppData\Local\MyComGames\MyComGames.exe [5663952 2017-10-03] (MY.COM B.V.)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [BlueStacks Agent] => C:\Program Files (x86)\Bluestacks\HD-Agent.exe [1694856 2017-01-26] (BlueStack Systems, Inc.)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2017-07-14] (Apple Inc.)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [110392 2017-07-14] (Apple Inc.)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [356664 2017-07-14] (Apple Inc.)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1052488 2017-09-10] ()
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27832272 2017-08-25] (Skype Technologies S.A.)
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\MountPoints2: {197a9de9-dd11-11e6-827a-fcaa14cc9bee} - "E:\setup.exe"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\MountPoints2: {7000b660-79ee-11e6-8255-806e6f6e6963} - "D:\FalloutLauncher.exe"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\MountPoints2: {89196f00-ff47-11e6-82ac-fcaa14cc9bee} - "H:\autorun.exe"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\MountPoints2: {b8eb4f56-f5c2-11e6-82ab-fcaa14cc9bee} - "G:\Setup.exe"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\MountPoints2: {cdd87379-abbc-11e6-8269-fcaa14cc9bee} - "F:\stp-tww.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HandyAndy.lnk [2017-02-03]
ShortcutTarget: HandyAndy.lnk -> C:\Program Files\Andy\HandyAndy.exe (Andy OS, inc.)
Startup: C:\Users\MorteTorment\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Curse.lnk [2016-11-11]
ShortcutTarget: Curse.lnk -> C:\Users\MorteTorment\AppData\Roaming\Curse Client\Bin\Curse.exe (Curse, Inc)
Startup: C:\Users\MorteTorment\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2017-02-07]
ShortcutTarget: MEGAsync.lnk -> C:\ProgramData\MEGAsync\MEGAsync.exe (Mega Limited)
Startup: C:\Users\MorteTorment\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk [2017-04-29]
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{2C73C35C-E178-4825-BF55-13367E3F3244}: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{5D7BE276-0FAC-4E13-B4FE-1297C52DE160}: [DhcpNameServer] [removed] [removed]

Internet Explorer:
==================
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
SearchScopes: HKU\S-1-5-21-1988832187-1948698999-1346875777-1001 -> DefaultScope {518b33ae-375d-712d-6742-d1fe0400268d} URL =
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-07-30] (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\ssv.dll [2017-07-19] (Oracle Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\jp2ssv.dll [2017-07-19] (Oracle Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation.)

FireFox:
========
FF DefaultProfile: dweesm80.default
FF DefaultProfile: [removed]
FF ProfilePath: C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default [2017-10-06]
FF user.js: detected! => C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\user.js [2017-04-14]
FF NewTab: Mozilla\Firefox\Profiles\dweesm80.default -> about:newtab
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\dweesm80.default -> Yahoo! Powered Search
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\dweesm80.default -> Yahoo! Powered Search
FF Homepage: Mozilla\Firefox\Profiles\dweesm80.default -> goodreads.com
FF Keyword.URL: Mozilla\Firefox\Profiles\dweesm80.default -> user_pref("keyword.URL", true);
FF Extension: (BetterTTV) - C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\Extensions\[removed] [2017-07-07]
FF Extension: (MEGA) - C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\Extensions\[removed] [2017-10-06]
FF Extension: (GrabMyBooks) - C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\Extensions\[removed] [2017-07-03]
FF Extension: (Dashlane) - C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\Extensions\[removed] [2017-10-03]
FF Extension: (TooManyTabs) - C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\Extensions\[removed] [2016-09-13]
FF Extension: (uBlock Origin) - C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\Extensions\[removed] [2017-09-21]
FF Extension: (uBlock) - C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\Extensions\{2b10c1c8-a11f-4bad-fe9c-1c11e82cac42}.xpi [2017-01-28]
FF Extension: (No Coin) - C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\Extensions\{5657c026-efc3-4860-b43b-16e4eaa8a9aa}.xpi [2017-10-06]
FF Extension: (Adblock Plus) - C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-06-07]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_130.dll [2017-09-12] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_130.dll [2017-09-12] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-12-23] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-12-23] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-12-23] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-12-23] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.141.2 -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\dtplugin\npDeployJava1.dll [2017-07-19] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.141.2 -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\plugin2\npjp2.dll [2017-07-19] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-07-31] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1988832187-1948698999-1346875777-1001: @my.com/Games -> C:\Users\MorteTorment\AppData\Local\MyComGames\NPMyComDetector.dll [2017-01-21] (MY.COM B.V.)
FF Plugin HKU\S-1-5-21-1988832187-1948698999-1346875777-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\MorteTorment\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2016-10-26] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2017-07-31] (Adobe Systems Inc.)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR Profile: C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default [2017-10-06]
CHR Extension: (Google Slides) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-02-05]
CHR Extension: (BetterTTV) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2017-10-01]
CHR Extension: (Google Docs) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-04-11]
CHR Extension: (Google Drive) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-04-11]
CHR Extension: (YouTube) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-04-11]
CHR Extension: (Adblock Plus) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-09-26]
CHR Extension: (Share on Rabbit) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\dplabnbcafdgpcjmibgkekpaejlfhnkl [2017-04-20]
CHR Extension: (Google Sheets) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-02-05]
CHR Extension: (Google Docs Offline) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-04-11]
CHR Extension: (No Coin) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\gojamcfopckidlocpkbelmpjcgmbgjcl [2017-10-06]
CHR Extension: (Chrome Web Store Payments) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-21]
CHR Extension: (Gmail) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-04-11]
CHR Extension: (Chrome Media Router) - C:\Users\MorteTorment\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-27]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-03] (Apple Inc.)
S3 BstHdAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Service.exe [486936 2017-01-26] (BlueStack Systems, Inc.)
S2 BstHdLogRotatorSvc; C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe [470552 2017-01-26] (BlueStack Systems, Inc.)
S3 BstHdPlusAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Plus-Service.exe [515608 2017-01-26] (BlueStack Systems, Inc.)
R2 Defender; C:\Windows\appdata\nssm.exe [331264 2014-08-31] () [File not signed]
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1268568 2015-06-18] (Disc Soft Ltd)
R2 FoxitReaderService; C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe [1659592 2016-12-29] (Foxit Software Inc.)
S3 GalaxyClientService; C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe [532544 2017-10-06] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [8242752 2017-10-06] (GOG.com)
R2 Hamachi2Svc; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [3418024 2017-06-29] (LogMeIn Inc.)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [419248 2016-05-27] (LogMeIn, Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6058960 2017-08-07] (Malwarebytes)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1450824 2017-09-10] (Overwolf LTD)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
S2 MEmusvc; C:\Program Files\Microvirt\MEmu\MemuService.exe [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-22] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [118848 2016-08-09] (Advanced Micro Devices)
S3 BstHdDrv; C:\Program Files (x86)\Bluestacks\HD-Hypervisor-amd64.sys [152672 2017-01-26] (BlueStack Systems)
S3 BstkDrv; C:\Program Files (x86)\Bluestacks\BstkDrv.sys [270904 2016-11-08] (Bluestack System Inc. )
R3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30264 2016-11-19] (Disc Soft Ltd)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [254528 2017-08-04] (DT Soft Ltd)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77440 2017-08-24] ()
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45680 2017-06-29] (LogMeIn Inc.)
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [192960 2017-10-02] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\DRIVERS\farflt.sys [101824 2017-10-04] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [45472 2017-10-04] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [253888 2017-10-04] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [94144 2017-10-06] (Malwarebytes)
R2 memudrv; C:\Program Files\Microvirt\MEmuHyperv\MEmuDrv.sys [260368 2015-11-02] (Microvirt Corporation)
R1 VBoxUSBMon; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [127432 2017-02-04] (BigNox Corporation)
R1 vmkbd3; C:\Windows\system32\DRIVERS\vmkbd.sys [52288 2016-11-12] (VMware, Inc.)
R0 vsock; C:\Windows\system32\DRIVERS\vsock.sys [91712 2016-09-30] (VMware, Inc.)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
R1 YSDrv; C:\Program Files (x86)\Bignox\BigNoxVM\RT\YSDrv.sys [270608 2017-09-29] (BigNox Corporation)
S3 ALSysIO; \??\C:\Users\MORTET~1\AppData\Local\Temp\ALSysIO64.sys [X] <==== ATTENTION
S2 AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
U3 aswMBR; \??\C:\Users\MORTET~1\AppData\Local\Temp\aswMBR.sys [X] <==== ATTENTION
U3 aswVmm; \??\C:\Users\MORTET~1\AppData\Local\Temp\aswVmm.sys [X] <==== ATTENTION

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)


2017-10-06 20:36 - 2017-10-06 20:41 - 000073966 _____ C:\Users\MorteTorment\Desktop\Addition.txt
2017-10-06 20:21 - 2017-10-06 20:58 - 000023227 _____ C:\Users\MorteTorment\Desktop\FRST.txt
2017-10-06 20:20 - 2017-10-06 20:20 - 002400768 _____ (Farbar) C:\Users\MorteTorment\Desktop\FRST64(1).exe
2017-10-06 20:19 - 2017-10-06 20:19 - 000001799 _____ C:\Users\MorteTorment\Desktop\aswMBR.txt
2017-10-06 20:19 - 2017-10-06 20:19 - 000000512 _____ C:\Users\MorteTorment\Desktop\MBR.dat
2017-10-06 20:10 - 2017-10-06 20:10 - 005198336 _____ (AVAST Software) C:\Users\MorteTorment\Downloads\aswMBR(1).exe
2017-10-06 13:59 - 2017-10-06 14:00 - 000000000 ____D C:\Users\MorteTorment\Downloads\v2_04_48_build
2017-10-06 13:59 - 2017-10-06 13:59 - 002013275 _____ C:\Users\MorteTorment\Downloads\v2_04_48_build.rar
2017-10-06 12:54 - 2017-10-06 12:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fallout [GOG.com]
2017-10-06 12:46 - 2017-10-06 12:52 - 000000000 ____D C:\Users\MorteTorment\Downloads\DxWnd.v200
2017-10-06 12:46 - 2017-10-06 12:46 - 000689445 _____ C:\Users\MorteTorment\Downloads\DxWnd.v200.rar
2017-10-06 12:31 - 2017-10-06 12:31 - 000000000 ____D C:\Users\MorteTorment\Downloads\MM6patch
2017-10-06 12:30 - 2017-10-06 12:30 - 002572423 _____ C:\Users\MorteTorment\Downloads\MM6patch.rar
2017-10-06 12:03 - 2017-10-06 12:03 - 000001686 _____ C:\Users\Public\Desktop\Might and Magic 6 - The Mandate of Heaven.lnk
2017-10-06 12:03 - 2017-10-06 12:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Might and Magic 6 [GOG.com]
2017-10-03 13:48 - 2017-10-03 13:48 - 000000708 _____ C:\Users\MorteTorment\Desktop\Shopping list.txt
2017-10-02 02:15 - 2017-10-04 09:03 - 000101824 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-10-01 15:21 - 2017-10-01 15:25 - 000000000 ____D C:\Users\MorteTorment\Downloads\Dark Elf
2017-10-01 15:19 - 2017-10-06 19:30 - 000094144 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-10-01 15:19 - 2017-10-04 09:03 - 000045472 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-10-01 15:19 - 2017-10-02 02:15 - 000192960 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-10-01 15:19 - 2017-10-01 15:19 - 000001883 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-10-01 15:19 - 2017-10-01 15:19 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-10-01 15:19 - 2017-10-01 15:19 - 000000000 ____D C:\Program Files\Malwarebytes
2017-10-01 15:19 - 2017-08-24 11:27 - 000077440 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-10-01 15:18 - 2017-10-01 15:18 - 000000000 ____D C:\ProgramData\MB2Migration
2017-10-01 15:11 - 2017-10-01 15:13 - 000000000 ____D C:\Users\MorteTorment\Downloads\Happy.Campers
2017-10-01 15:09 - 2017-10-01 15:09 - 166512710 _____ C:\Users\MorteTorment\Downloads\Happy.Campers.rar
2017-09-29 01:16 - 2017-09-29 01:16 - 000000066 _____ C:\Users\MorteTorment\inittk.ini
2017-09-29 01:15 - 2017-09-30 16:04 - 000000000 ____D C:\Users\MorteTorment\.BigNox
2017-09-29 01:15 - 2017-09-29 01:15 - 000001064 _____ C:\Users\MorteTorment\Desktop\Multi-Drive.lnk
2017-09-29 01:15 - 2017-09-29 01:15 - 000000983 _____ C:\Users\MorteTorment\Desktop\Nox.lnk
2017-09-29 01:15 - 2017-09-29 01:15 - 000000000 ____D C:\Program Files (x86)\Bignox
2017-09-29 01:14 - 2017-09-29 01:14 - 292272520 _____ (Duodian Technology Co. Ltd.) C:\Users\MorteTorment\Downloads\nox_setup_v5.2.0.0_full_intl.exe
2017-09-28 22:08 - 2017-09-28 22:08 - 000000000 ____D C:\Users\MorteTorment\AppData\LocalLow\Daggerfall Workshop
2017-09-25 20:34 - 2017-09-25 20:34 - 002412284 _____ C:\Users\MorteTorment\Downloads\bak.rar
2017-09-25 12:07 - 2017-09-25 12:09 - 004062964 _____ C:\Users\MorteTorment\Downloads\The Travelers Gate Trilogy.rar
2017-09-23 21:00 - 2017-09-23 21:00 - 000000008 _____ C:\Users\MorteTorment\Desktop\warm line.txt
2017-09-22 21:52 - 2017-09-22 21:52 - 000000000 ____D C:\Users\MorteTorment\AppData\Roaming\The Creative Assembly
2017-09-22 21:47 - 2017-09-22 21:47 - 000000906 _____ C:\Users\Public\Desktop\Total War WARHAMMER.lnk
2017-09-22 21:47 - 2017-09-22 21:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Total War WARHAMMER
2017-09-22 21:18 - 2017-09-22 21:47 - 000000000 ____D C:\Program Files\Total War WARHAMMER
2017-09-22 20:16 - 2017-09-22 21:09 - 000000000 ____D C:\Users\MorteTorment\Downloads\stp-tww
2017-09-21 00:21 - 2017-09-21 00:21 - 000001881 _____ C:\Users\MorteTorment\Desktop\BitLord.lnk
2017-09-21 00:21 - 2017-09-21 00:21 - 000000000 ____D C:\Users\MorteTorment\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitLord
2017-09-21 00:19 - 2017-09-21 00:21 - 000000000 ____D C:\Program Files (x86)\BitLord
2017-09-16 19:05 - 2017-09-16 19:05 - 000436206 _____ C:\Users\MorteTorment\Downloads\Weis, Margaret & Hickman, Tracy - [Death Gate Cycle 3] - Fire Sea (1991, Spectra).epub
2017-09-16 19:04 - 2017-09-16 19:04 - 000488794 _____ C:\Users\MorteTorment\Downloads\Weis, Margaret & Hickman, Tracy - [Death Gate Cycle 3] - Fire Sea (2011).epub
2017-09-15 21:09 - 2017-09-16 20:14 - 000000000 ____D C:\Users\MorteTorment\Downloads\pq6-2
2017-09-15 21:09 - 2017-09-15 21:09 - 000320122 _____ C:\Users\MorteTorment\Downloads\pq6-2.zip
2017-09-15 00:14 - 2017-09-15 00:27 - 1682760125 _____ C:\Users\MorteTorment\Downloads\com.square_enix.android_googleplay.FFVII.zip
2017-09-15 00:14 - 2017-09-15 00:16 - 024832217 _____ C:\Users\MorteTorment\Downloads\com_square_enix_android_googleplay_FFVII-25.apk
2017-09-14 22:58 - 2017-09-14 22:59 - 005802972 _____ C:\Users\MorteTorment\Downloads\ePSXe_2.0.8.apk
2017-09-13 23:28 - 2017-09-13 23:28 - 000000000 ____D C:\Users\MorteTorment\Documents\Electronic Arts
2017-09-13 23:20 - 2017-09-13 23:20 - 000002484 _____ C:\Users\MorteTorment\Desktop\The Sims 4 Deluxe Edition.lnk
2017-09-13 23:20 - 2017-09-13 23:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GMT-MAX.ORG
2017-09-13 22:59 - 2017-09-13 22:59 - 000000000 ____D C:\Program Files (x86)\GMT-MAX.ORG
2017-09-13 21:35 - 2017-09-13 22:57 - 000000000 ____D C:\Users\MorteTorment\Downloads\The Sims 4+All DLC-RePack MAXAGENT
2017-09-13 21:34 - 2017-09-13 21:38 - 000030017 _____ C:\Users\MorteTorment\Downloads\.41c99ab90c2c6d806051f18a3e785b12655be3a2.parts
2017-09-13 21:30 - 2017-09-21 00:18 - 000000000 ____D C:\Users\MorteTorment\Downloads\The Sims 4 [FitGirl Repack]
2017-09-13 21:09 - 2017-09-21 00:24 - 858642432 _____ C:\Users\MorteTorment\Downloads\rld-thesims4.iso
2017-09-13 19:11 - 2017-09-14 11:21 - 000003074 _____ C:\Windows\System32\Tasks\MicrosoftUpdate
2017-09-13 19:11 - 2017-09-13 19:11 - 000003352 _____ C:\Windows\System32\Tasks\NETControlUpdate
2017-09-13 19:11 - 2017-09-03 08:23 - 000858624 _____ C:\Program Files (x86)\setup_m.exe
2017-09-13 19:11 - 2017-08-20 21:35 - 006993560 _____ (Falco Software, Inc. ) C:\Program Files (x86)\setup.exe
2017-09-13 19:09 - 2017-09-13 21:38 - 000000000 ____D C:\Users\MorteTorment\AppData\Roaming\BitLord
2017-09-13 19:09 - 2017-09-13 19:09 - 000000000 ____D C:\Users\MorteTorment\Documents\BitLord
2017-09-13 19:09 - 2017-09-13 19:09 - 000000000 ____D C:\Users\MorteTorment\AppData\Local\BitLord
2017-09-13 19:09 - 2017-09-13 19:09 - 000000000 ____D C:\Users\MorteTorment\.BitLord
2017-09-13 19:08 - 2017-09-13 19:09 - 000000000 ____D C:\Users\MorteTorment\AppData\Local\{42297475-6681-18CD-0B19-3D252F71C1BD}
2017-09-13 11:17 - 2017-09-13 11:23 - 000000000 ____D C:\Users\MorteTorment\Documents\Larian Studios
2017-09-13 11:17 - 2017-09-13 11:17 - 000002065 _____ C:\Users\Public\Desktop\Divinity - Original Sin Enhanced Edition.lnk
2017-09-13 11:17 - 2017-09-13 11:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Divinity - Original Sin Enhanced Edition [GOG.com]
2017-09-13 01:10 - 2017-09-13 01:33 - 000000000 ____D C:\Users\MorteTorment\Downloads\Divinity Original Sin - Enhanced Edition (v2.5.0.12 - v2.6.1.15) [GOG]
2017-09-13 00:53 - 2017-09-13 00:53 - 000001059 _____ C:\Users\Public\Desktop\qBittorrent.lnk
2017-09-13 00:53 - 2017-09-13 00:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\qBittorrent
2017-09-13 00:53 - 2017-09-13 00:53 - 000000000 ____D C:\Program Files (x86)\qBittorrent
2017-09-13 00:52 - 2017-09-13 00:53 - 019756156 _____ (The qBittorrent project) C:\Users\MorteTorment\Downloads\qbittorrent_3.3.16_x64_setup.exe
2017-09-10 14:58 - 2017-09-10 14:58 - 000002045 _____ C:\Users\MorteTorment\Downloads\Fantasy.txt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-10-06 20:57 - 2017-01-28 20:43 - 000000000 ____D C:\FRST
2017-10-06 20:49 - 2016-09-14 03:23 - 000000000 ____D C:\Users\MorteTorment\AppData\Roaming\Skype
2017-10-06 15:06 - 2016-09-13 18:47 - 000000000 ____D C:\MISC
2017-10-06 12:59 - 2016-09-13 13:50 - 000003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1988832187-1948698999-1346875777-1001
2017-10-06 12:03 - 2016-09-22 00:31 - 000000000 ____D C:\GOG Games
2017-10-06 12:02 - 2016-10-25 12:43 - 000000000 ____D C:\Program Files (x86)\GOG Galaxy
2017-10-06 12:01 - 2016-10-10 20:56 - 000000000 ____D C:\Users\MorteTorment\AppData\Local\ClassicShell
2017-10-06 09:42 - 2016-10-01 14:55 - 000000000 ____D C:\Steam
2017-10-06 09:41 - 2017-01-21 08:23 - 000000000 ____D C:\Users\MorteTorment\AppData\Local\MyComGames
2017-10-05 21:37 - 2016-09-16 15:29 - 000000000 ____D C:\Users\MorteTorment\AppData\Local\FirestormOS_x64
2017-10-05 10:52 - 2017-03-17 19:10 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-10-05 10:52 - 2016-09-13 13:52 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-10-04 09:03 - 2017-02-03 20:08 - 000000000 ____D C:\ProgramData\VMware
2017-10-04 09:03 - 2016-09-22 07:41 - 000253888 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-10-04 09:03 - 2013-08-22 07:45 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-10-04 09:02 - 2016-10-05 04:24 - 000065536 _____ C:\Windows\system32\spu_storage.bin
2017-10-04 09:02 - 2013-08-22 06:25 - 000262144 ___SH C:\Windows\system32\config\BBI
2017-10-01 15:19 - 2016-09-22 07:41 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-10-01 15:12 - 2016-10-04 19:19 - 000000000 ____D C:\Users\MorteTorment\AppData\Roaming\RenPy
2017-10-01 14:19 - 2017-02-04 08:29 - 000000000 ____D C:\Users\MorteTorment\AppData\Roaming\obs-studio
2017-09-30 16:45 - 2017-02-04 07:15 - 000000000 ____D C:\Users\MorteTorment\AppData\Local\Nox
2017-09-30 16:04 - 2017-02-04 07:16 - 000000000 ____D C:\Users\MorteTorment\vmlogs
2017-09-30 16:04 - 2017-01-13 05:16 - 000000000 ____D C:\Users\MorteTorment\.android
2017-09-30 08:19 - 2016-10-02 14:57 - 000000000 ____D C:\Users\MorteTorment\Documents\Baldur's Gate - Enhanced Edition
2017-09-29 03:16 - 2013-08-22 06:36 - 000000000 ____D C:\Windows\Inf
2017-09-29 01:16 - 2016-09-13 13:45 - 000000000 ____D C:\Users\MorteTorment
2017-09-29 01:15 - 2013-08-22 08:36 - 000000000 ____D C:\Windows\Registration
2017-09-28 15:27 - 2016-09-13 17:26 - 000000000 ____D C:\Users\MorteTorment\AppData\Roaming\qBittorrent
2017-09-26 19:03 - 2017-02-05 04:44 - 000002215 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-09-26 19:03 - 2017-02-05 04:44 - 000002203 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-09-26 01:20 - 2016-09-14 20:38 - 000000000 ____D C:\Users\MorteTorment\AppData\Roaming\discord
2017-09-23 15:34 - 2016-10-01 15:06 - 000000000 ____D C:\Users\MorteTorment\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-09-22 21:45 - 2016-09-13 18:12 - 000000000 ____D C:\Users\MorteTorment\AppData\Roaming\uTorrent
2017-09-21 00:21 - 2016-09-13 13:50 - 000000000 ____D C:\ProgramData\Package Cache
2017-09-18 11:39 - 2013-08-22 08:36 - 000000000 ____D C:\Windows\System
2017-09-18 11:39 - 2013-08-22 08:36 - 000000000 ____D C:\Windows\PLA
2017-09-18 11:39 - 2013-08-22 08:36 - 000000000 ____D C:\Windows\ModemLogs
2017-09-16 12:12 - 2017-08-26 05:36 - 000000000 ____D C:\Users\MorteTorment\AppData\Roaming\IMVU
2017-09-13 23:25 - 2016-09-22 07:35 - 000000000 ____D C:\Windows\SysWOW64\directx
2017-09-13 23:24 - 2016-09-22 07:35 - 000000000 ___HD C:\Windows\msdownld.tmp
2017-09-13 19:14 - 2017-02-02 20:07 - 000000000 ____D C:\Users\MorteTorment\AppData\Local\LogMeIn Hamachi
2017-09-13 10:06 - 2017-03-12 06:05 - 000000000 ____D C:\Program Files (x86)\Overwolf
2017-09-13 03:12 - 2013-08-22 08:20 - 000000000 ____D C:\Windows\CbsTemp
2017-09-12 15:06 - 2016-10-23 11:54 - 000004288 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-09-12 15:06 - 2013-08-22 08:36 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-09-12 15:06 - 2013-08-22 08:36 - 000000000 ____D C:\Windows\system32\Macromed
2017-09-10 23:33 - 2017-04-11 10:47 - 000000000 ___RD C:\Program Files (x86)\Skype
2017-09-10 23:33 - 2016-09-14 03:23 - 000000000 ____D C:\ProgramData\Skype
2017-09-10 17:57 - 2017-09-01 16:09 - 259417603 _____ C:\Users\MorteTorment\Downloads\Audrey Royal.mp4
2017-09-10 13:47 - 2017-09-01 15:54 - 282591911 _____ C:\Users\MorteTorment\Downloads\atkgfs.17.06.05.zaya.cassidy[tk][480p][rarbg].mp4
2017-09-10 13:42 - 2017-09-01 16:55 - 286125678 _____ C:\Users\MorteTorment\Downloads\{18Eighteen - PornMegaLoad} Hailey Little - Making The Shot…….(April 27, 2017)…….mp4

==================== Files in the root of some directories =======

2017-09-13 19:11 - 2017-08-20 21:35 - 006993560 _____ (Falco Software, Inc.                                        ) C:\Program Files (x86)\setup.exe
2017-09-13 19:11 - 2017-09-03 08:23 - 000858624 _____ () C:\Program Files (x86)\setup_m.exe
2017-02-04 06:18 - 2016-11-23 06:37 - 000000570 _____ () C:\Users\MorteTorment\AppData\Local\TroubleshooterConfig.json

Some files in TEMP:
====================
2016-12-03 01:14 - 2016-12-03 01:16 - 072679369 _____ (Baker & Taylor) C:\Users\MorteTorment\AppData\Local\Temp\Axis360Setup_1.0.14.716.exe
2016-12-03 01:17 - 2016-12-03 01:18 - 067825614 _____ (Baker & Taylor) C:\Users\MorteTorment\AppData\Local\Temp\Axis360Setup_1.0.15.720.exe
2017-08-09 14:10 - 2017-08-09 14:10 - 007850088 _____ (Microsoft Corporation) C:\Users\MorteTorment\AppData\Local\Temp\BingBarSetup-Partner.exe
2017-06-11 19:13 - 2017-06-11 19:13 - 000010520 _____ () C:\Users\MorteTorment\AppData\Local\Temp\BullseyeCoverage-x86-3.dll
2017-06-05 02:07 - 2017-06-05 15:54 - 000204800 _____ (Sony DADC Austria AG) C:\Users\MorteTorment\AppData\Local\Temp\drm_dyndata_7380006.dll
2017-06-05 15:36 - 2017-06-05 16:19 - 000204800 _____ (Sony DADC Austria AG) C:\Users\MorteTorment\AppData\Local\Temp\drm_dyndata_7380014.dll
2007-09-18 14:58 - 2007-09-18 14:58 - 000077160 _____ (Microsoft Corporation) C:\Users\MorteTorment\AppData\Local\Temp\DSETUP.dll
2007-09-18 14:58 - 2007-09-18 14:58 - 001673576 _____ (Microsoft Corporation) C:\Users\MorteTorment\AppData\Local\Temp\dsetup32.dll
2007-09-18 14:58 - 2007-09-18 14:58 - 000503144 _____ (Microsoft Corporation) C:\Users\MorteTorment\AppData\Local\Temp\DXSETUP.exe
2017-01-29 14:35 - 2017-01-29 14:35 - 000739904 _____ (Oracle Corporation) C:\Users\MorteTorment\AppData\Local\Temp\jre-8u121-windows-au.exe
2017-05-23 20:48 - 2017-05-23 20:48 - 000739904 _____ (Oracle Corporation) C:\Users\MorteTorment\AppData\Local\Temp\jre-8u131-windows-au.exe
2017-01-04 22:31 - 2017-01-04 22:31 - 006456560 _____ (Black Tree Gaming                                           ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.11.exe
2017-02-05 13:47 - 2017-02-05 13:47 - 006441176 _____ (Black Tree Gaming                                           ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.13.exe
2017-05-14 12:39 - 2017-05-14 12:40 - 006441096 _____ (Black Tree Gaming                                           ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.14.exe
2016-10-29 19:09 - 2016-10-29 19:09 - 006449992 _____ (Black Tree Gaming                                           ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.5.exe
2016-11-02 04:39 - 2016-11-02 04:39 - 006449136 _____ (Black Tree Gaming                                           ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.6.exe
2016-11-14 01:44 - 2016-11-14 01:45 - 006452312 _____ (Black Tree Gaming                                           ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.7.exe
2016-11-17 01:01 - 2016-11-17 01:02 - 006452760 _____ (Black Tree Gaming                                           ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.8.exe
2016-12-17 04:46 - 2016-12-17 04:46 - 006453608 _____ (Black Tree Gaming                                           ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.9.exe
2017-01-22 10:25 - 2017-08-07 21:09 - 000492544 _____ () C:\Users\MorteTorment\AppData\Local\Temp\s3.exe
2017-03-12 06:05 - 2017-03-12 06:05 - 000065280 _____ () C:\Users\MorteTorment\AppData\Local\Temp\utils.dll
2017-04-11 10:46 - 2017-04-11 10:46 - 014456872 _____ (Microsoft Corporation) C:\Users\MorteTorment\AppData\Local\Temp\vc_redist.x86.exe
2016-11-19 10:36 - 2006-05-24 10:10 - 000455600 _____ (Macrovision Corporation) C:\Users\MorteTorment\AppData\Local\Temp\_is9AE3.exe
2016-11-04 01:37 - 2006-05-24 10:10 - 000455600 _____ (Macrovision Corporation) C:\Users\MorteTorment\AppData\Local\Temp\_isFB83.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-10-02 04:18

==================== End of FRST.txt ============================



—


Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-10-2017
Ran by [removed] (06-10-2017 20:58:28)
Running from C:\Users\[removed]\Desktop
Windows 8.1 (X64) (2016-09-13 20:45:18)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1988832187-1948698999-1346875777-500 - Administrator - Disabled)
Guest (S-1-5-21-1988832187-1948698999-1346875777-501 - Limited - Disabled)
MorteTorment (S-1-5-21-1988832187-1948698999-1346875777-1001 - Administrator - Enabled) => C:\Users\MorteTorment

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM-x32\…\uTorrent) (Version: 2.2.1 - )
Absent (HKLM\…\Steam App 398450) (Version:  - FNGames)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.012.20098 - Adobe Systems Incorporated)
Adobe Flash Player 27 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 27.0.0.130 - Adobe Systems Incorporated)
AIM for Windows (HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\AIM) (Version:  - AOL Inc.)
Akamai NetSession Interface (HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Akamai) (Version:  - Akamai Technologies, Inc)
Amazon Kindle (HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Amazon Kindle) (Version: 1.17.1.44183 - Amazon)
Andy OS (HKLM\…\Andy OS) (Version: 46.16 - Andy OS, Inc)
Apple Application Support (32-bit) (HKLM-x32\…\{D2FE6376-E549-4F63-A2C5-CA24DA035DE4}) (Version: 5.6 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\…\{BB109E24-EE90-485B-A28B-ADDEFB40540B}) (Version: 5.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{0A596141-97D5-45FA-9281-98DFAF48D579}) (Version: 10.3.2.3 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
Axis 360 (HKLM-x32\…\{F15F940E-1F65-4F10-BD51-6EE5483D6ED1}) (Version: 1.0.15.720 - Baker & Taylor)
Baldur's Gate - Enhanced Edition (HKLM-x32\…\1207666353_is1) (Version: 2.1.0.3 - GOG.com)
Baldurs Gate - Enhanced Edition (HKLM-x32\…\Baldurs Gate - Enhanced Edition_R.G. Mechanics_is1) (Version:  - R.G. Mechanics, markfiter)
Baldur's Gate - Siege of Dragonspear (HKLM-x32\…\Baldur's Gate: Siege of Dragonspear_is1) (Version: 2.1.0.3 - GOG.com)
Baldur's Gate II - Enhanced Edition (HKLM-x32\…\1207666373_is1) (Version: 2.0.0.1 - GOG.com)
Bear With Me (HKLM-x32\…\Bear With Me_is1) (Version:  - )
Bing Bar (HKLM-x32\…\{16793295-2366-40F7-A045-A3E42A81365E}) (Version: 7.1.362.0 - Microsoft Corporation)
BitLord 2.5 (HKLM-x32\…\BitLord) (Version: 2.4.5-316 - House of Life)
Black Rose (HKLM\…\Steam App 453890) (Version:  - Sir Bedlam Productions)
Blameless (HKLM\…\Steam App 530330) (Version:  - Vaclav Hudec)
Blizzard App (HKLM-x32\…\Battle.net) (Version:  - Blizzard Entertainment)
BloodLust Shadowhunter (HKLM\…\Qmxvb2RMdXN0U2hhZG93aHVudGVy_is1) (Version: 1 - )
BloodLustVampireRPG (HKLM\…\UDK-e84adc5f-c5bd-4b65-b7b6-ad3b11835521) (Version:  - Epic Games, Inc.)
BlueStacks App Player (HKLM-x32\…\BlueStacks) (Version: 2.5.90.6347 - BlueStack Systems, Inc.)
Bonjour (HKLM\…\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
CameraHelperMsi (HKLM-x32\…\{15634701-BACE-4449-8B25-1567DA8C9FD3}) (Version: 13.51.815.0 - Logitech) Hidden
Catalyst Control Center (HKLM-x32\…\{8B1A559A-FB9D-42F5-A8A7-2F132CF28414}) (Version: 1.00.0000 - )
Classic Shell (HKLM\…\{383BB30A-B4A7-4666-9A83-22CFA8640097}) (Version: 4.3.0 - IvoSoft)
Community College Hero: Trial by Fire Demo (HKLM\…\Steam App 423130) (Version:  - Hosted Games)
Core Temp 1.3 (HKLM\…\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.3 - ALCPU)
Curse (HKLM-x32\…\{DEE70742-F4E9-44CA-B2B9-EE95DCF37295}) (Version: 6.0.0.0 - Curse)
DAEMON Tools Lite (HKLM\…\DAEMON Tools Lite) (Version: 10.1.0.0074 - Disc Soft Ltd)
Darkest Dungeon (HKLM\…\Steam App 262060) (Version:  - Red Hook Studios)
Darkest Dungeon The Crimson Court (HKLM-x32\…\Darkest Dungeon The Crimson Court_is1) (Version:  - )
Darkstar One (HKLM-x32\…\Darkstar One_is1) (Version:  - GOG.com)
Dead Island (HKLM\…\Steam App 91310) (Version:  - Techland)
Dex (HKLM-x32\…\1929434313_is1) (Version: 2.0.0.3 - GOG.com)
Diablo (HKLM-x32\…\Diablo) (Version:  - )
Diablo (HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Diablo) (Version:  - )
Discord (HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\Discord) (Version: 0.0.298 - Discord Inc.)
Disturbed (HKLM\…\Steam App 529780) (Version:  - Brad Moore)
Divinity - Original Sin Enhanced Edition (HKLM-x32\…\1445516929_is1) (Version: 2.5.0.12 - GOG.com)
Download Updater (AOL Inc.) (HKLM-x32\…\SoftwareUpdUtility) (Version:  - AOL Inc.) <==== ATTENTION
erLT (HKLM-x32\…\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}) (Version: 1.20.138.34 - Logitech, Inc.) Hidden
Eye of the Beholder (HKLM-x32\…\1432575012_is1) (Version: 2.0.0.4 - GOG.com)
Fallout (HKLM-x32\…\1_is1) (Version: 2.1.0.18 - GOG.com)
Fallout (HKLM-x32\…\Fallout) (Version:  - )
Fallout 2 (HKLM-x32\…\2_is1) (Version: 2.1.0.17 - GOG.com)
Fallout 3 - Unofficial Fallout 3 Patch (HKLM-x32\…\{297C7552-BA68-4F73-AB83-82510777421D}_is1) (Version: v1.2.0 - Quarn ([removed]))
Fallout 3 (HKLM-x32\…\1454315831_is1) (Version: 1.7.0.3 - GOG.com)
Fallout 4 (HKLM\…\Steam App 377160) (Version:  - Bethesda Game Studios)
Fallout Fixt 0.81alpha (Full Custom) (HKLM-x32\…\{83D6B5DC-9C8C-4DE2-B66C-14FA5C8680B5}_is1) (Version: 0.81alpha (Full Custom) - Sduibek)
Fallout Shelter (HKLM\…\Steam App 588430) (Version:  - Bethesda Game Studios)
FINAL FANTASY VII (HKLM-x32\…\{141B8BA9-BFFD-4635-AF64-078E31010EC3}_is1) (Version: 1.0 - Square Enix)
FirestormOS-Releasex64 (HKLM\…\FirestormOS-Releasex64) (Version: 5.0.1.52150 - The Phoenix Firestorm Project, Inc.)
Floris Evolved (HKLM-x32\…\Floris Evolved) (Version:  - )
FO2 Restoration Project 2.3.3 (HKLM-x32\…\Fallout 2 Restoration Project_is1) (Version:  - killap)
foobar2000 v1.3.16 (HKLM-x32\…\foobar2000) (Version: 1.3.16 - Peter Pawlowski)
Foxit Reader (HKLM-x32\…\Foxit Reader_is1) (Version: 8.2.0.2051 - Foxit Software Inc.)
Free Alarm Clock (HKLM-x32\…\{8ED5A2F1-338F-4608-8AF7-BCD1ADC1E1F7}_is1) (Version: 4.0.1.0 - Comfort Software Group)
Gateway to the Savage Frontier (HKLM-x32\…\1432649588_is1) (Version: 2.0.0.3 - GOG.com)
GOG Galaxy (HKLM-x32\…\{7258BA11-600C-430E-A759-27E2C691A335}_is1) (Version:  - GOG.com)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 61.0.3163.100 - Google Inc.)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Grammarly (HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\GrammarlyForWindows) (Version: 1.5.29 - Grammarly)
Grand Theft Auto V (HKLM\…\Steam App 271590) (Version:  - Rockstar North)
GTA Save Editor (HKLM-x32\…\GTA Save Editor) (Version: 2.2.0.1 - XB36Hazard)
Guild Wars 2 (HKLM\…\Guild Wars 2) (Version:  - NCsoft Corporation, Ltd.)
HandBrake 1.0.2 (HKLM-x32\…\HandBrake) (Version: 1.0.2 - )
HexChat (HKLM-x32\…\HexChat_is1) (Version: 2.12.4 - HexChat)
HF pAppLoc version 1.1.1 (HKLM-x32\…\{9143B17E-BBDE-4EA7-A4E3-20D384D9C8A5}_is1) (Version: 1.1.1 - Inquisitor)
HITMAN™ (HKLM\…\Steam App 236870) (Version:  - Io-Interactive)
Icecream Ebook Reader version 4.26 (HKLM-x32\…\{B8C30F0F-1F23-49E1-A3ED-44DE17660EE2}_is1) (Version: 4.26 - Icecream Apps)
iCloud (HKLM\…\{C510BB61-AE0B-4420-87AF-9CF646E86364}) (Version: 6.2.3.17 - Apple Inc.)
IMVU Avatar Chat Software (HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\IMVU Avatar chat client software BETA) (Version:  - )
iTunes (HKLM\…\{02F95875-9527-49CC-B32F-970ADAEBD1EF}) (Version: 12.6.2.20 - Apple Inc.)
Java 8 Update 141 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F32180141F0}) (Version: 8.0.1410.15 - Oracle Corporation)
Kathy Rain (HKLM-x32\…\1460710709_is1) (Version: 2.2.0.4 - GOG.com)
Lands Of Lore - The Throne of Chaos (HKLM-x32\…\1207662513_is1) (Version: 2.1.0.19 - GOG.com)
Leisure Suit Larry's Greatest Hits and Misses! (HKLM-x32\…\GOGPACKLARRY16_is1) (Version: 2.0.0.15 - GOG.com)
Logitech Webcam Software (HKLM-x32\…\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.80 - Logitech Inc.)
LogMeIn Hamachi (HKLM-x32\…\{BE82D2D7-6CA2-43B3-8C22-CCF6405806E7}) (Version: 2.2.0.579 - LogMeIn, Inc.) Hidden
LogMeIn Hamachi (HKLM-x32\…\LogMeIn Hamachi) (Version: 2.2.0.579 - LogMeIn, Inc.)
LOOT version 0.11.0 (HKLM-x32\…\{BF634210-A0D4-443F-A657-0DCE38040374}_is1) (Version: 0.11.0 - LOOT Team)
Malwarebytes version 3.2.2.2029 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.2.2.2029 - Malwarebytes)
Marvel Heroes 2016 (HKLM\…\Steam App 226320) (Version:  - Gazillion Entertainment)
MEGAsync (HKLM-x32\…\MEGAsync) (Version:  - Mega Limited)
MEmu (HKLM-x32\…\MEmu) (Version: 2.9.2 - Microvirt)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\…\{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}) (Version: 1.2.0241 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\…\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\…\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Windows Application Compatibility Database (HKLM\…\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb) (Version:  - )
Might and Magic 6 - The Mandate of Heaven (HKLM-x32\…\1207661253_is1) (Version: 2.1.0.42 - GOG.com)
Minds Eyes (HKLM\…\Steam App 519140) (Version:  - Stanislaw Truchowski)
Minion (HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\{Minion}}_is1) (Version: 3.0 - Good Game Mods LLC)
Mount & Blade: Warband (HKLM\…\Steam App 48700) (Version:  - TaleWorlds Entertainment)
Mozilla Firefox 56.0 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 56.0 (x86 en-US)) (Version: 56.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 56.0.0.6478 - Mozilla)
MPC-HC 1.7.10 (64-bit) (HKLM\…\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.7.10 - MPC-HC Team)
My Game Long Name (HKLM\…\UDK-b3a54b26-09db-4946-9a24-bc33f5acacdb) (Version:  - Epic Games, Inc.)
My.com Game Center (HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\MyComGames) (Version: 3.192 - My.com B.V.)
Need for Speed Hot Pursuit 2 version 242.0.0.0 (HKLM-x32\…\Need for Speed Hot Pursuit 2_is1) (Version: 242.0.0.0 - Mr DJ)
Need For Speed Most Wanted Black Edition version 1.3.0.0 (HKLM-x32\…\Need For Speed Most Wanted Black Edition_is1) (Version: 1.3.0.0 - Mr DJ)
Need For Speed Porsche Unleashed 1.4 (HKLM-x32\…\Need For Speed Porsche Unleashed 1.4) (Version: 1.4 - EA Games)
Need for Speed Porsche Unleashed version 3.5.0.0 (HKLM-x32\…\Need for Speed Porsche Unleashed_is1) (Version: 3.5.0.0 - Mr DJ)
Need For Speed Underground version 1.4.0.0 (HKLM-x32\…\Need For Speed Underground_is1) (Version: 1.4.0.0 - Mr DJ)
Neverwinter Nights 2 Complete (HKLM-x32\…\1207659162_is1) (Version: 1.23 - GOG.com)
Neverwinter Nights Diamond Edition (HKLM-x32\…\1207658890_is1) (Version: 2.1.0.21 - GOG.com)
Nexus Mod Manager (HKLM\…\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.63.14 - Black Tree Gaming)
Nox APP Player (HKLM-x32\…\Nox) (Version: 5.2.0.0 - Duodian Technology Co. Ltd.)
NVIDIA PhysX (HKLM-x32\…\{80407BA7-7763-4395-AB98-5233F1B34E65}) (Version: 9.13.1220 - NVIDIA Corporation)
OBS Studio (HKLM-x32\…\OBS Studio) (Version: 17.0.2 - OBS Project)
OpenAL (HKLM-x32\…\OpenAL) (Version:  - )
OpenOffice 4.1.3 (HKLM-x32\…\{EEA30AEB-8BA7-465B-85D4-098BB99733E7}) (Version: 4.13.9783 - Apache Software Foundation)
Overwolf (HKLM-x32\…\Overwolf) (Version: 0.107.36.0 - Overwolf Ltd.)
PeaZip 6.1.1 (WIN64) (HKLM\…\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version: 6.1.1 - Giorgio Tani)
piaip AppLocale (HKLM-x32\…\{394BE3D9-7F57-4638-A8D1-1D88671913B7}) (Version: 1.0.0 - MS)
Plague Inc Evolved Shadow Plague (HKLM-x32\…\Plague Inc Evolved Shadow Plague_is1) (Version:  - )
Planescape Torment (HKLM-x32\…\GOGPACKPLANESCAPETORMENT_is1) (Version: 2.0.0.8 - GOG.com)
Port of Call (HKLM\…\Steam App 356520) (Version:  - Underdog Games)
PRC Pack (HKLM-x32\…\PRC Pack) (Version:  - )
Project "Fire" (HKLM\…\Steam App 526430) (Version:  - Distant Alliance)
Puzzle Quest 2 (HKLM\…\Steam App 47540) (Version:  - Infinite Interactive)
qBittorrent 3.3.16 (HKLM-x32\…\qBittorrent) (Version: 3.3.16 - The qBittorrent project)
Risen 2: Dark Waters (HKLM-x32\…\{8CE35C60-D108-4059-9B9A-060CC46FF6B1}_is1) (Version: 1.0.1210.0 - R.G. Revenants)
Rockstar Games Social Club (HKLM-x32\…\Rockstar Games Social Club) (Version: 1.2.1.9 - Rockstar Games)
Saints Row IV (HKLM\…\Steam App 206420) (Version:  - Deep Silver Volition)
Saints Row: The Third (HKLM\…\Steam App 55230) (Version:  - Volition)
Shadowrun: Dragonfall - Director's Cut (HKLM\…\Steam App 300550) (Version:  - Harebrained Schemes)
Shadowrun: Hong Kong - Extended Edition (HKLM\…\Steam App 346940) (Version:  - Harebrained Schemes)
Skype™ 7.40 (HKLM-x32\…\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.40.103 - Skype Technologies S.A.)
Skyrim Script Extender (SKSE) (HKLM\…\Steam App 365720) (Version:  - The SKSE Team)
Steam (HKLM-x32\…\Steam) (Version: 2.10.91.91 - Valve Corporation)
SteamVR (HKLM\…\Steam App 250820) (Version:  - )
Tales Of Berseria (HKLM-x32\…\{66B88C33-80CB-4A26-8434-24E140B49100}_is1) (Version:  - Namco Bandai)
TeamSpeak 3 Client (HKLM\…\TeamSpeak 3 Client) (Version: 3.1.1 - TeamSpeak Systems GmbH)
The Elder Scrolls II - Daggerfall (HKLM-x32\…\1435829353_is1) (Version: 2.0.0.4 - GOG.com)
The Elder Scrolls Online (HKLM-x32\…\The Elder Scrolls Online) (Version: 1.0.0.0 - Zenimax Online Studios)
The Elder Scrolls V: Skyrim (HKLM\…\Steam App 72850) (Version:  - Bethesda Game Studios)
The Elder Scrolls V: Skyrim Special Edition (HKLM\…\Steam App 489830) (Version:  - Bethesda Game Studios)
The Lord of the Rings Online™ v1301.0055.0535.4025 (HKLM-x32\…\12bbe590-c890-11d9-9669-0800200c9a66_is1) (Version: 1301.0055.0535.4025 - Turbine, Inc.)
The Pirate: Caribbean Hunt (HKLM\…\Steam App 512470) (Version:  - Home Net Games)
The Sims 4 Deluxe Edition version 1.0.732.20 Update 5 (HKLM-x32\…\The Sims 4 Deluxe Edition_is1) (Version: 1.0.732.20 Update 5 - GMT-MAX.ORG)
The Witcher 3 - Wild Hunt (HKLM-x32\…\1495134320_is1) (Version: 2.0.0.51 - GOG.com)
Tiberium Wars 1.09 (HKLM-x32\…\Command & Conquer 3: Tiberium Wars_is1) (Version:  - HWMasters.com)
Torment: Tides of Numenera (1.0.1) (HKLM-x32\…\1958306970_is1) (Version: 0.1.1.294 - GOG.com)
Total War WARHAMMER (HKLM\…\Total War WARHAMMER_is1) (Version: 1.0 - )
Total War: WARHAMMER (HKLM\…\Steam App 364360) (Version:  - Creative Assembly)
TrackMania United (HKLM\…\Steam App 7200) (Version:  - Nadeo)
Trillian (HKLM-x32\…\Trillian) (Version:  - Cerulean Studios, LLC)
Tyranny - Coat of Arms (HKLM-x32\…\1104171850_is1) (Version: 2.0.0.1 - GOG.com)
Tyranny - Pre-Order (HKLM-x32\…\1128126797_is1) (Version: 2.0.0.1 - GOG.com)
Tyranny (HKLM-x32\…\1266051739_is1) (Version: 2.0.0.1 - GOG.com)
Unity Web Player (HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\UnityWebPlayer) (Version: 5.3.7f1 - Unity Technologies ApS)
Uplay (HKLM-x32\…\Uplay) (Version: 15.0 - Ubisoft)
Vampire - The Masquerade - Bloodlines (HKLM-x32\…\1207659240_is1) (Version: 2.1.0.8 - GOG.com)
Ventrilo Client for Windows x64 (HKLM\…\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}) (Version: 3.0.8.0 - Flagship Industries, Inc.)
VMware Player (HKLM\…\{6D211A09-EB2A-4B83-ACCB-13B1BC12AF4E}) (Version: 12.5.2 - VMware, Inc.)
VMware VIX (HKLM-x32\…\{F99FC179-EA67-4BBC-8955-BDDA0CB94B88}) (Version: 1.15.6.00000 - VMware, Inc.)
Vulkan Run Time Libraries 1.0.21.0 (HKLM\…\VulkanRT1.0.21.0) (Version: 1.0.21.0 - LunarG, Inc.)
Zombie Defense (HKLM\…\Steam App 533780) (Version:  - Home Net Games)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1988832187-1948698999-1346875777-1001_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1988832187-1948698999-1346875777-1001_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1988832187-1948698999-1346875777-1001_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1988832187-1948698999-1346875777-1001_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1988832187-1948698999-1346875777-1001_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1988832187-1948698999-1346875777-1001_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\ProgramData\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\ProgramData\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\ProgramData\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\ProgramData\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\ProgramData\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\ProgramData\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
ContextMenuHandlers1: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2016-12-23] (Foxit Software Inc.)
ContextMenuHandlers1: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ContextMenuHandlers1: [PhotoStreamsExt] -> {89D984B3-813B-406A-8298-118AFA3A22AE} => C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll [2017-07-14] (Apple Inc.)
ContextMenuHandlers2-x32: [VMDiskMenuHandler] -> {271DC252-6FE1-4D59-9053-E4CF50AB99DE} => C:\Program Files (x86)\VMware\VMware Player\vmdkShellExt.dll [2016-11-12] (VMware, Inc.)
ContextMenuHandlers2-x32: [VMDiskMenuHandler64] -> {E4D28EDC-8C0B-43EE-9E7D-C8A8682334DC} => C:\Program Files (x86)\VMware\VMware Player\x64\vmdkShellExt64.dll [2016-11-12] (VMware, Inc.)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes)
ContextMenuHandlers3: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ContextMenuHandlers4: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ContextMenuHandlers6: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2016-12-23] (Foxit Software Inc.)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes)
ContextMenuHandlers6: [StartMenuExt] -> {E595F05F-903F-4318-8B0A-7F633B520D2B} => C:\Windows\system32\StartMenuHelper64.dll [2016-07-30] (IvoSoft)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0ADC1ADE-A2C5-474D-A6B5-EFD9822B2D56} - System32\Tasks\{F2EA64DD-8227-4BE4-96D8-C5A0C7CA4A2E} => C:\Windows\system32\pcalua.exe -a C:\Users\MorteTorment\Downloads\cep_v1x.exe -d C:\Users\MorteTorment\Downloads
Task: {27B581FD-8AA1-44F0-AA51-39676450111A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-07-19] (Adobe Systems Incorporated)
Task: {64BA79ED-B9D0-4B1F-B27F-5F14F00460BD} - System32\Tasks\NETControlUpdate => C:\Windows\System32\service.exe
Task: {670664C2-5E99-4E73-A46C-4B2CF49F7731} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-02-14] (Apple Inc.)
Task: {6CAACF0C-C4A9-4E4C-881D-98591DEB0DF6} - System32\Tasks\MicrosoftUpdate => C:\Windows\Fonts\svchost.exe <==== ATTENTION
Task: {983E34B9-E0B7-424C-85CD-0C5BC620583C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-09-12] (Adobe Systems Incorporated)
Task: {A7F1AAC9-2892-4104-B517-9297F8B5CA8F} - System32\Tasks\AMD Updater => C:\Program Files\AMD\CIM\\Bin64\InstallManagerApp.exe
Task: {B3ADD53F-467A-4656-A91B-4E5147F4EA5F} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-09-10] (Overwolf LTD)
Task: {C8D4D14D-2B1D-4A8D-800C-F4B20801CA24} - System32\Tasks\Private Internet Access Startup => C:\Program Files\pia_manager\pia_manager.exe [2017-03-29] ()
Task: {CDE48FAD-67A2-4092-B71F-4E22D32DBC68} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-05] (Google Inc.)
Task: {FC7816F9-57AD-4904-8A6E-0AFFC26097BA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-05] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2017-01-13 14:56 - 2017-01-13 14:56 - 000092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-07-13 20:50 - 2017-07-13 20:50 - 001354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-08-31 18:34 - 2014-08-31 18:34 - 000331264 _____ () C:\Windows\appdata\nssm.exe
2017-10-01 15:19 - 2017-08-24 11:27 - 002264528 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2016-10-31 12:45 - 2016-10-31 12:45 - 000592384 _____ () C:\ProgramData\MEGAsync\ShellExtX64.dll
2012-09-13 01:38 - 2012-09-13 01:38 - 000264040 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2017-09-26 19:03 - 2017-09-21 00:29 - 004022616 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libglesv2.dll
2017-09-26 19:03 - 2017-09-21 00:29 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libegl.dll
2015-07-15 11:39 - 1998-12-22 19:28 - 000560128 _____ () C:\MISC\Game Mods\MM6\Might_and_Magic_VI_Hack_Tool\MM6CHE.EXE
2017-08-02 04:10 - 2017-08-02 04:10 - 002883429 _____ () C:\Windows\appdata\svchost.exe
2017-08-08 16:22 - 2017-08-08 15:13 - 001893880 _____ () C:\Users\MorteTorment\AppData\Local\Discord\app-0.0.298\ffmpeg.dll
2017-08-08 22:22 - 2017-08-08 22:22 - 001577976 _____ () \\?\C:\Users\MorteTorment\AppData\Roaming\discord\0.0.298\modules\discord_toaster\discord_toaster.node
2016-10-01 14:58 - 2017-08-04 14:19 - 000678176 _____ () C:\Steam\SDL2.dll
2016-10-01 14:58 - 2016-08-31 18:02 - 004969248 _____ () C:\Steam\v8.dll
2016-10-01 14:58 - 2017-10-04 16:49 - 002507552 _____ () C:\Steam\video.dll
2016-10-01 14:58 - 2016-08-31 18:02 - 001563936 _____ () C:\Steam\icui18n.dll
2016-10-01 14:58 - 2016-08-31 18:02 - 001195296 _____ () C:\Steam\icuuc.dll
2016-10-01 14:58 - 2016-01-27 00:49 - 002549760 _____ () C:\Steam\libavcodec-56.dll
2016-10-01 14:58 - 2016-01-27 00:49 - 000491008 _____ () C:\Steam\libavformat-56.dll
2016-10-01 14:58 - 2016-01-27 00:49 - 000332800 _____ () C:\Steam\libavresample-2.dll
2016-10-01 14:58 - 2016-01-27 00:49 - 000442880 _____ () C:\Steam\libavutil-54.dll
2016-10-01 14:58 - 2016-01-27 00:49 - 000485888 _____ () C:\Steam\libswscale-3.dll
2016-10-01 14:58 - 2017-10-04 16:49 - 000885024 _____ () C:\Steam\bin\chromehtml.DLL
2016-10-01 14:58 - 2016-07-04 15:17 - 000266560 _____ () C:\Steam\openvr_api.dll
2017-08-08 16:22 - 2017-08-08 15:13 - 001938424 _____ () C:\Users\MorteTorment\AppData\Local\Discord\app-0.0.298\libglesv2.dll
2017-08-08 16:22 - 2017-08-08 15:13 - 000095736 _____ () C:\Users\MorteTorment\AppData\Local\Discord\app-0.0.298\libegl.dll
2017-08-17 16:51 - 2017-08-17 16:51 - 001993184 ____R () C:\Program Files (x86)\Skype\Phone\skypert.dll
2017-02-20 00:00 - 2017-02-20 00:00 - 000071680 _____ () C:\Program Files (x86)\Trillian\zlib1.dll
2017-02-20 00:00 - 2017-02-20 00:00 - 000116736 _____ () C:\Program Files (x86)\Trillian\libexpat.dll
2017-02-20 00:00 - 2017-02-20 00:00 - 000006656 _____ () c:\program files (x86)\trillian\languages\en\trillian.dll
2017-02-20 00:00 - 2017-02-20 00:00 - 000220672 _____ () C:\Program Files (x86)\Trillian\libpng16.dll
2017-02-20 00:00 - 2017-02-20 00:00 - 000015360 _____ () C:\Program Files (x86)\Trillian\libgif.dll
2017-02-20 00:00 - 2017-02-20 00:00 - 000003072 _____ () c:\program files (x86)\trillian\languages\en\toolkit.dll
2017-02-20 00:00 - 2017-02-20 00:00 - 000010752 _____ () c:\program files (x86)\trillian\languages\en\buddy.dll
2017-02-20 00:00 - 2017-02-20 00:00 - 000005120 _____ () c:\program files (x86)\trillian\languages\en\talk.dll
2017-02-20 00:00 - 2017-02-20 00:00 - 000061952 _____ () C:\Program Files (x86)\Trillian\libtinyxml2.dll
2012-09-13 01:38 - 2012-09-13 01:38 - 002144104 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll
2012-09-13 01:38 - 2012-09-13 01:38 - 007955304 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll
2012-09-13 01:38 - 2012-09-13 01:38 - 000341352 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll
2012-09-13 01:38 - 2012-09-13 01:38 - 000028008 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2012-09-13 01:38 - 2012-09-13 01:38 - 000127336 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-09-13 01:39 - 2012-09-13 01:39 - 000336232 _____ () C:\Program Files (x86)\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2017-08-08 22:22 - 2017-10-06 09:39 - 009722360 _____ () \\?\C:\Users\MorteTorment\AppData\Roaming\discord\0.0.298\modules\discord_voice\discord_voice.node
2017-08-08 22:22 - 2017-08-08 22:22 - 001440248 _____ () \\?\C:\Users\MorteTorment\AppData\Roaming\discord\0.0.298\modules\discord_utils\discord_utils.node
2017-10-06 09:40 - 2017-10-06 09:40 - 000148992 _____ () \\?\C:\Users\MorteTorment\AppData\Local\Temp\6215.tmp.node
2017-08-08 22:22 - 2017-08-08 22:22 - 002658296 _____ () \\?\C:\Users\MorteTorment\AppData\Roaming\discord\0.0.298\modules\discord_rpc\discord_rpc.node
2017-08-08 22:22 - 2017-08-08 22:22 - 002673656 _____ () \\?\C:\Users\MorteTorment\AppData\Roaming\discord\0.0.298\modules\discord_contact_import\discord_contact_import.node
2016-12-12 13:15 - 2017-07-17 15:50 - 073115424 _____ () C:\Steam\bin\cef\cef.win7\libcef.dll
2017-06-08 07:10 - 2017-05-16 18:54 - 000678176 _____ () C:\Steam\bin\cef\cef.win7\SDL2.dll
2016-10-01 14:58 - 2015-09-24 16:52 - 000119208 _____ () C:\Steam\winh264.dll
2016-10-25 12:43 - 2016-10-25 15:40 - 053018112 _____ () C:\Program Files (x86)\GOG Galaxy\libcef.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000507968 _____ () C:\Program Files (x86)\GOG Galaxy\PocoUtil.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 001076800 _____ () C:\Program Files (x86)\GOG Galaxy\PocoNet.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 001854528 _____ () C:\Program Files (x86)\GOG Galaxy\PocoData.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000393280 _____ () C:\Program Files (x86)\GOG Galaxy\PocoDataSQLite.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 001589312 _____ () C:\Program Files (x86)\GOG Galaxy\PocoFoundation.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000307776 _____ () C:\Program Files (x86)\GOG Galaxy\PocoNetSSL.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000330816 _____ () C:\Program Files (x86)\GOG Galaxy\PocoJSON.dll
2017-07-22 05:26 - 2017-10-06 12:02 - 000130112 _____ () C:\Program Files (x86)\GOG Galaxy\xdelta3.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000104000 _____ () C:\Program Files (x86)\GOG Galaxy\zlib.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000520768 _____ () C:\Program Files (x86)\GOG Galaxy\PocoXML.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000272448 _____ () C:\Program Files (x86)\GOG Galaxy\PocoZip.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000680000 _____ () C:\Program Files (x86)\GOG Galaxy\sqlite.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000425536 _____ () C:\Program Files (x86)\GOG Galaxy\pcre.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000157760 _____ () C:\Program Files (x86)\GOG Galaxy\PocoCrypto.dll
2016-10-25 12:43 - 2017-10-06 12:01 - 000152128 _____ () C:\Program Files (x86)\GOG Galaxy\expat.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 001589312 _____ () C:\ProgramData\GOG.com\Galaxy\redists\PocoFoundation.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000330816 _____ () C:\ProgramData\GOG.com\Galaxy\redists\PocoJSON.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000507968 _____ () C:\ProgramData\GOG.com\Galaxy\redists\PocoUtil.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000104000 _____ () C:\ProgramData\GOG.com\Galaxy\redists\zlib.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000425536 _____ () C:\ProgramData\GOG.com\Galaxy\redists\pcre.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000520768 _____ () C:\ProgramData\GOG.com\Galaxy\redists\PocoXML.dll
2016-10-25 12:43 - 2017-10-06 12:02 - 000152128 _____ () C:\ProgramData\GOG.com\Galaxy\redists\expat.dll
2016-10-25 12:43 - 2016-10-25 15:40 - 001738752 _____ () C:\Program Files (x86)\GOG Galaxy\libglesv2.dll
2016-10-25 12:43 - 2016-10-25 15:40 - 000078848 _____ () C:\Program Files (x86)\GOG Galaxy\libegl.dll
2017-10-06 12:03 - 2002-08-08 01:15 - 000348160 _____ () C:\GOG Games\Might and Magic 6\mss32.dll
2017-10-06 12:03 - 2005-05-20 12:52 - 000138752 _____ () C:\GOG Games\Might and Magic 6\smackw32.dll
2017-10-06 12:32 - 2015-09-16 06:39 - 000179200 _____ () C:\GOG Games\Might and Magic 6\MM6patch.dll
2017-10-06 12:32 - 2000-05-12 13:30 - 000126976 _____ () C:\GOG Games\Might and Magic 6\MP3DEC.ASI
2016-10-31 12:43 - 2016-10-31 12:43 - 000564736 _____ () C:\ProgramData\MEGAsync\ShellExtX32.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 06:25 - 2013-08-22 06:25 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\…\StartupApproved\StartupFolder: => "HandyAndy.lnk"
HKLM\…\StartupApproved\Run: => "iTunesHelper"
HKLM\…\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\StartupFolder: => "Curse.lnk"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\StartupFolder: => "MEGAsync.lnk"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\Run: => "uTorrent"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\Run: => "Akamai NetSession Interface"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\Run: => "GalaxyClient"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\Run: => "BlueStacks Agent"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\Run: => "iCloudDrive"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\Run: => "iCloudPhotos"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\Run: => "iCloudServices"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\Run: => "Overwolf"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\Run: => "DashlanePlugin"
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\…\StartupApproved\Run: => "Dashlane"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{D84BD05B-7322-43FC-A596-966852A06C5F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{250CA795-A388-4EB8-A18D-DA7E7249D20A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3A399959-7C69-4D76-9292-0C15472FDED0}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{FA4E3F27-8C5B-485D-A200-F63F23B134DB}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{2E3273C1-A830-4349-A689-36CBBEE4EDD6}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{27ADF0C4-D832-4750-8B93-695F6C8843B2}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [TCP Query User{0CCF9E88-922E-4B1A-9979-65B57CD18421}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{81273C80-2456-466B-8587-55209F7CDE38}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{7153A11C-563B-4000-8EB2-3BA9FCB14CAE}] => (Allow) C:\Program Files (x86)\AIM\aim.exe
FirewallRules: [{F66AAAAE-AB62-4140-8BEC-DF0E7A530A5F}] => (Allow) C:\Program Files (x86)\AIM\aim.exe
FirewallRules: [TCP Query User{68588870-D06A-47C1-96C6-F8B55D534D5D}C:\users\mortetorment\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\mortetorment\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{7514E5B9-8966-4708-8471-90A911EB2873}C:\users\mortetorment\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\mortetorment\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{15FEDE7F-820C-4068-8344-6158A105B605}C:\program files (x86)\turbine\the lord of the rings online\lotroclient.exe] => (Allow) C:\program files (x86)\turbine\the lord of the rings online\lotroclient.exe
FirewallRules: [UDP Query User{6039FFF4-6C2A-4B3A-85F5-4EB9B837A8CE}C:\program files (x86)\turbine\the lord of the rings online\lotroclient.exe] => (Allow) C:\program files (x86)\turbine\the lord of the rings online\lotroclient.exe
FirewallRules: [TCP Query User{BCFA05DC-788F-425F-97C6-702AD1DDCC4A}C:\program files\firestorm-releasex64\slvoice.exe] => (Allow) C:\program files\firestorm-releasex64\slvoice.exe
FirewallRules: [UDP Query User{9BD628BD-87B9-48C1-9D74-A7F2F02CE89C}C:\program files\firestorm-releasex64\slvoice.exe] => (Allow) C:\program files\firestorm-releasex64\slvoice.exe
FirewallRules: [{A06A5D63-7678-4F3D-B216-41C6BA33F298}] => (Allow) C:\Steam\Steam.exe
FirewallRules: [{88283997-B40F-419F-B17F-FABB9ABF02EB}] => (Allow) C:\Steam\Steam.exe
FirewallRules: [{98B3F618-3096-4CD8-972E-5AB39FF56E2F}] => (Allow) C:\Steam\bin\steamwebhelper.exe
FirewallRules: [{92001062-1BAE-47C0-962D-2D2E53055DBD}] => (Allow) C:\Steam\bin\steamwebhelper.exe
FirewallRules: [{9F8191A4-DA91-4AA3-BACD-8E417F3ECB8D}] => (Allow) C:\Steam\steamapps\common\Project Fire\Pfire.exe
FirewallRules: [{22836BC5-ED4D-4CF1-8D87-8DFC54D15D37}] => (Allow) C:\Steam\steamapps\common\Project Fire\Pfire.exe
FirewallRules: [{02EBDAC4-4EB1-423C-9996-DFB2F49B0250}] => (Allow) C:\Steam\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{DA5E974D-3045-4BD0-9BF0-D657A8C2F102}] => (Allow) C:\Steam\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [TCP Query User{06970569-D1DF-4B6F-88FE-4327739706B3}C:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [UDP Query User{1F35CBF6-783C-4A77-9A42-C8278C73981E}C:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [TCP Query User{1138160C-9BC3-4F4C-AC19-9EDB2F87AD09}C:\program files (x86)\r.g. mechanics\baldurs gate - enhanced edition\bgee.exe] => (Allow) C:\program files (x86)\r.g. mechanics\baldurs gate - enhanced edition\bgee.exe
FirewallRules: [UDP Query User{2E4327D6-DD65-436E-A5FE-F9EE241785EF}C:\program files (x86)\r.g. mechanics\baldurs gate - enhanced edition\bgee.exe] => (Allow) C:\program files (x86)\r.g. mechanics\baldurs gate - enhanced edition\bgee.exe
FirewallRules: [{1D1A0D6B-86EB-43D3-9CF5-C4858968881C}] => (Allow) C:\Steam\steamapps\common\Zombie Defense\ZombieDefense.exe
FirewallRules: [{336E9D7B-356F-4EDF-BF98-6D8A4C2F4AA4}] => (Allow) C:\Steam\steamapps\common\Zombie Defense\ZombieDefense.exe
FirewallRules: [{BFFFCB51-0146-4030-B9E8-3218DB501407}] => (Allow) C:\Steam\steamapps\common\Disturbed\Disturbed.exe
FirewallRules: [{DB6A3614-4647-4D0A-878D-7EA65BFAE5B2}] => (Allow) C:\Steam\steamapps\common\Disturbed\Disturbed.exe
FirewallRules: [TCP Query User{640618C4-972C-4BA1-AD93-F237ECB60D0C}C:\users\mortetorment\downloads\bloodlust.shadowhunter.v1.4.4.6\binaries\win32\udk.exe] => (Allow) C:\users\mortetorment\downloads\bloodlust.shadowhunter.v1.4.4.6\binaries\win32\udk.exe
FirewallRules: [UDP Query User{203A9F85-3C69-4AF2-B6A1-710CE65AB13D}C:\users\mortetorment\downloads\bloodlust.shadowhunter.v1.4.4.6\binaries\win32\udk.exe] => (Allow) C:\users\mortetorment\downloads\bloodlust.shadowhunter.v1.4.4.6\binaries\win32\udk.exe
FirewallRules: [TCP Query User{76BB1788-3321-40BD-8926-A6B74C2E27D5}C:\program files\bloodlust shadowhunter\binaries\win32\udk.exe] => (Allow) C:\program files\bloodlust shadowhunter\binaries\win32\udk.exe
FirewallRules: [UDP Query User{96000C93-88C9-48BF-A728-594D73E786BF}C:\program files\bloodlust shadowhunter\binaries\win32\udk.exe] => (Allow) C:\program files\bloodlust shadowhunter\binaries\win32\udk.exe
FirewallRules: [TCP Query User{CCEF365B-3573-4D56-A430-CB8ADBC8C74E}C:\program files (x86)\doom\doomx64.exe] => (Allow) C:\program files (x86)\doom\doomx64.exe
FirewallRules: [UDP Query User{F2DF5369-9885-42CE-AC77-2E79A513511E}C:\program files (x86)\doom\doomx64.exe] => (Allow) C:\program files (x86)\doom\doomx64.exe
FirewallRules: [TCP Query User{23BF6ABC-5398-4927-A291-BCEDA1D4D29E}C:\users\mortetorment\appdata\local\temp\i1475700380\windows\resource\jre\bin\javaw.exe] => (Allow) C:\users\mortetorment\appdata\local\temp\i1475700380\windows\resource\jre\bin\javaw.exe
FirewallRules: [UDP Query User{F3BFAFD1-71F5-495F-B3D5-9F1F5E53E0EC}C:\users\mortetorment\appdata\local\temp\i1475700380\windows\resource\jre\bin\javaw.exe] => (Allow) C:\users\mortetorment\appdata\local\temp\i1475700380\windows\resource\jre\bin\javaw.exe
FirewallRules: [TCP Query User{AD869DA6-6E4C-4A43-8D80-4711CDD38C77}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{149B86A8-8C19-496F-95C9-7CE98A2FC4CB}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{2A1DAD69-BEC6-432F-8AAB-F3DE9A4DE916}] => (Allow) C:\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{3CF44C61-D799-4A99-9D99-5470845106AA}] => (Allow) C:\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{DB1CCB02-C673-421F-9816-F10065E20435}] => (Allow) C:\Steam\steamapps\common\Skyrim\skse_steam_boot.exe
FirewallRules: [{F0C0F7B2-075B-4CE4-A694-79D70168D86F}] => (Allow) C:\Steam\steamapps\common\Skyrim\skse_steam_boot.exe
FirewallRules: [{2847A4C3-0871-4051-95E8-C0546DB333FA}] => (Allow) C:\Steam\steamapps\common\Blameless\Blameless.exe
FirewallRules: [{9E59C7BB-CA87-4885-B77A-0E34A99721B8}] => (Allow) C:\Steam\steamapps\common\Blameless\Blameless.exe
FirewallRules: [{53440500-490F-4D30-A0EB-89421BE5F0F2}] => (Allow) C:\Steam\steamapps\common\Black Rose\Black Rose.exe
FirewallRules: [{E8201601-1A87-4F8A-B977-6618F415F189}] => (Allow) C:\Steam\steamapps\common\Black Rose\Black Rose.exe
FirewallRules: [{4397F7F8-8882-4E6E-B33A-41A99E8AE19F}] => (Allow) C:\Steam\steamapps\common\Absent\Absent.exe
FirewallRules: [{675B4FFB-8FE5-4256-8E48-214805EEED79}] => (Allow) C:\Steam\steamapps\common\Absent\Absent.exe
FirewallRules: [{8DE45DD3-8AE2-4DBA-9A4F-05FAF133A477}] => (Allow) C:\Steam\steamapps\common\Minds Eyes\MindsEyesLaunch.exe
FirewallRules: [{B124BEA8-8F96-4898-AEF8-20D855901EED}] => (Allow) C:\Steam\steamapps\common\Minds Eyes\MindsEyesLaunch.exe
FirewallRules: [{4F1D5AF6-ABD8-454E-8EE2-2A6DC8DA7B57}] => (Allow) C:\Steam\steamapps\common\Port of Call\PortOfCall.exe
FirewallRules: [{78EF6DBE-E313-4567-A981-187C631F86A8}] => (Allow) C:\Steam\steamapps\common\Port of Call\PortOfCall.exe
FirewallRules: [TCP Query User{538CF3AF-C412-4076-BCD8-FA418071AA1E}C:\gog games\we happy few\glimpsegame\binaries\win64\glimpsegame.exe] => (Allow) C:\gog games\we happy few\glimpsegame\binaries\win64\glimpsegame.exe
FirewallRules: [UDP Query User{F1ABAF4B-6E63-4746-9201-63779FED0E84}C:\gog games\we happy few\glimpsegame\binaries\win64\glimpsegame.exe] => (Allow) C:\gog games\we happy few\glimpsegame\binaries\win64\glimpsegame.exe
FirewallRules: [TCP Query User{043DA168-AC45-488D-91C7-828BA99CB9F5}C:\program files\cloud imperium games\patcher\cigpatcher.exe] => (Allow) C:\program files\cloud imperium games\patcher\cigpatcher.exe
FirewallRules: [UDP Query User{362E65A6-7A48-48AB-B6B5-FF9C8D203408}C:\program files\cloud imperium games\patcher\cigpatcher.exe] => (Allow) C:\program files\cloud imperium games\patcher\cigpatcher.exe
FirewallRules: [TCP Query User{1EDA69C6-B635-433F-BE9E-B64B3C1EFACE}C:\program files\cloud imperium games\starcitizen\public\bin64\starcitizen.exe] => (Allow) C:\program files\cloud imperium games\starcitizen\public\bin64\starcitizen.exe
FirewallRules: [UDP Query User{44C6F8AF-4510-4481-BB6E-53ABFC09774D}C:\program files\cloud imperium games\starcitizen\public\bin64\starcitizen.exe] => (Allow) C:\program files\cloud imperium games\starcitizen\public\bin64\starcitizen.exe
FirewallRules: [{213C6626-49C0-416F-85F6-A0CCFF6FFA43}] => (Allow) C:\Steam\steamapps\common\Skyrim Special Edition\SkyrimSELauncher.exe
FirewallRules: [{A8B2B66B-DD52-4D44-B635-FDC9C759FA94}] => (Allow) C:\Steam\steamapps\common\Skyrim Special Edition\SkyrimSELauncher.exe
FirewallRules: [{A870FBFB-04CB-41F5-ABA6-D1391D41F091}] => (Allow) C:\Steam\steamapps\common\Shadowrun Dragonfall Director's Cut\Dragonfall.exe
FirewallRules: [{8F2FB637-C00C-4E6B-A4D8-7616112D772D}] => (Allow) C:\Steam\steamapps\common\Shadowrun Dragonfall Director's Cut\Dragonfall.exe
FirewallRules: [{EFEC6BC1-0571-4FEB-8DF2-E46251E2DAB5}] => (Allow) C:\Steam\steamapps\common\Fallout 4\Fallout4Launcher.exe
FirewallRules: [{DC9383B3-C58E-4006-97D3-D9A160C16145}] => (Allow) C:\Steam\steamapps\common\Fallout 4\Fallout4Launcher.exe
FirewallRules: [{A5215779-7C49-42C6-9E45-2C445ED22F6B}] => (Allow) C:\Steam\steamapps\common\Hitman™\Launcher.exe
FirewallRules: [{E07A37E7-705D-4F7A-BBB0-24B28F40C7A0}] => (Allow) C:\Steam\steamapps\common\Hitman™\Launcher.exe
FirewallRules: [TCP Query User{359515C9-4DCC-4BD0-8CEF-A43857B61F1A}C:\program files (x86)\diablo\diablo.exe] => (Allow) C:\program files (x86)\diablo\diablo.exe
FirewallRules: [UDP Query User{3647BA3F-5A02-47E8-A764-DEB97F89F6B9}C:\program files (x86)\diablo\diablo.exe] => (Allow) C:\program files (x86)\diablo\diablo.exe
FirewallRules: [{5E0BA17A-BD9C-440E-9272-422A5E53CDFD}] => (Allow) C:\Steam\steamapps\common\Saints Row the Third\game_launcher.exe
FirewallRules: [{BD309136-4EB6-4A1A-A2AD-31FE2DC95D97}] => (Allow) C:\Steam\steamapps\common\Saints Row the Third\game_launcher.exe
FirewallRules: [{67B169C9-B298-4D0F-8709-2F3BC1CB7A7B}] => (Allow) C:\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird.exe
FirewallRules: [{20EB0A18-D681-4357-82F1-B8829D66387D}] => (Allow) C:\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird.exe
FirewallRules: [{43D64C69-2727-4DAB-8163-C352E5C53930}] => (Allow) C:\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird_DX11.exe
FirewallRules: [{1761AEE0-EF8B-42FB-89B4-F87695ED37AB}] => (Allow) C:\Steam\steamapps\common\Saints Row the Third\SaintsRowTheThird_DX11.exe
FirewallRules: [{73A4156F-D1A6-43EF-907E-04F3693A52E4}] => (Allow) C:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{FC422081-426D-42E5-98E2-BAA0CF51374E}] => (Allow) C:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{132D4E0E-812F-4F69-B908-124D102BB1A3}] => (Allow) C:\Steam\steamapps\common\The Pirate Caribbean Hunt\ThePirate.exe
FirewallRules: [{2830A177-25FF-409C-927C-BD6CE49AE6D2}] => (Allow) C:\Steam\steamapps\common\The Pirate Caribbean Hunt\ThePirate.exe
FirewallRules: [{DE633DAB-F7D3-4357-8FD5-478A93161B06}] => (Allow) C:\Steam\steamapps\common\MountBlade Warband\mb_warband.exe
FirewallRules: [{49064C91-C505-4092-8386-1264450D8775}] => (Allow) C:\Steam\steamapps\common\MountBlade Warband\mb_warband.exe
FirewallRules: [{5A316274-1F0D-4D2A-99C8-7281CD239EC5}] => (Allow) C:\Steam\steamapps\common\Dead Island\DeadIslandGame.exe
FirewallRules: [{89BC43C6-95C6-40F0-B8FE-18093BB712E1}] => (Allow) C:\Steam\steamapps\common\Dead Island\DeadIslandGame.exe
FirewallRules: [TCP Query User{88DF5B90-386C-416A-BDCC-3706CCBF1A19}C:\users\mortetorment\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\mortetorment\appdata\local\mycomgames\mycomgames.exe
FirewallRules: [UDP Query User{F3F14F47-1B77-4DBA-A69C-FBEE1510CD6E}C:\users\mortetorment\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\mortetorment\appdata\local\mycomgames\mycomgames.exe
FirewallRules: [TCP Query User{3C7DFA3F-D315-4693-B14E-5CB46D99EAF4}C:\misc\roms\fusion364\fusion.exe] => (Allow) C:\misc\roms\fusion364\fusion.exe
FirewallRules: [UDP Query User{3CE22A53-5F49-4959-90F8-75B9DB57AA07}C:\misc\roms\fusion364\fusion.exe] => (Allow) C:\misc\roms\fusion364\fusion.exe
FirewallRules: [{F057F4F2-8B7D-4A6A-ADF3-D2F86DBBF90D}] => (Allow) C:\Steam\steamapps\common\Hitman™\Launcher.exe
FirewallRules: [{828D7C1A-88D7-45F1-B756-6AB038F127AC}] => (Allow) C:\Steam\steamapps\common\Hitman™\Launcher.exe
FirewallRules: [{61A837C0-2C92-4BA6-9B7F-37D64AC95D60}] => (Allow) C:\Users\MorteTorment\AppData\Local\Temp\andy-x64\Setup.exe
FirewallRules: [{BCDA5F49-1772-4B88-BE83-80651F6FCD95}] => (Allow) C:\Users\MorteTorment\AppData\Local\Temp\andy-x64\Setup.exe
FirewallRules: [{635EE7AE-7CE8-4FB0-A239-8E70955161B5}] => (Allow) C:\Program Files\Andy\andy.exe
FirewallRules: [{DD59DFD8-356A-45C9-9D32-1E0139600058}] => (Allow) C:\Program Files\Andy\andy.exe
FirewallRules: [{1BB94A4E-9645-46A8-96F8-372B16A16922}] => (Allow) C:\Program Files\Andy\AndyConsole.exe
FirewallRules: [{FA9ECF3F-11E7-49BF-B013-8DE1949755A0}] => (Allow) C:\Program Files\Andy\AndyConsole.exe
FirewallRules: [{A6D914C9-40BB-4681-8579-C6F6173511C7}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [{449E2AA0-0180-46DE-90B6-C952420ED341}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [{F5DB7A04-C3B8-4394-AE38-A4FAE7C6351C}] => (Allow) C:\Program Files\Andy\SetupFiles\Uninstall.exe
FirewallRules: [{437ED98C-20FA-49C2-B9E9-7BE8FEC839DA}] => (Allow) C:\Program Files\Andy\SetupFiles\Uninstall.exe
FirewallRules: [{3281DFC1-DE9E-4BA7-A5EC-697D41393B2A}] => (Allow) C:\Program Files\Andy\SetupFiles\VMwareCheck.exe
FirewallRules: [{BFB3DC42-37C4-4968-A23C-5BCB02234CBB}] => (Allow) C:\Program Files\Andy\SetupFiles\VMwareCheck.exe
FirewallRules: [{6F00F06B-3B25-46D6-AB55-B80D5F8CEE3B}] => (Allow) C:\Program Files\Andy\SetupFiles\AndyDoctor.exe
FirewallRules: [{9897B6D5-CCA7-4E1B-82DF-C8CEB0AA042A}] => (Allow) C:\Program Files\Andy\SetupFiles\AndyDoctor.exe
FirewallRules: [{C8E392C5-C095-4D57-AC42-3CD72ECF81E7}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{DCE4F1F6-E670-4CFB-A359-81A3AEE93386}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{E136FC23-B5BA-4AF5-80A5-CCFA7974E697}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{B8538832-5587-4049-B83B-4839B8117D71}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{C46FBE14-3577-4EB4-922E-226E324A6D50}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{3BF81ED4-0D90-4E2F-AF14-20C57E017EA2}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2669FD4C-5AFC-44EA-9F98-483309474126}] => (Allow) C:\Program Files\Ventrilo\Ventrilo.exe
FirewallRules: [{9AD0CA4C-181B-4D8E-8050-0332183EC47A}] => (Allow) C:\Program Files\Ventrilo\Ventrilo.exe
FirewallRules: [TCP Query User{715CF147-703B-46BD-A7AA-6BE79B18F124}C:\gog games\torment - tides of numenera\tidesofnumenera.exe] => (Allow) C:\gog games\torment - tides of numenera\tidesofnumenera.exe
FirewallRules: [UDP Query User{B70AFE2F-E51B-4BE1-930F-1E96F78851B4}C:\gog games\torment - tides of numenera\tidesofnumenera.exe] => (Allow) C:\gog games\torment - tides of numenera\tidesofnumenera.exe
FirewallRules: [TCP Query User{90A64786-F73C-4518-87A9-B1184029EF29}C:\program files\firestorm-releasex64\slvoice.exe] => (Allow) C:\program files\firestorm-releasex64\slvoice.exe
FirewallRules: [UDP Query User{56AC2D16-47AB-4E8C-95F8-A47E40B2E93E}C:\program files\firestorm-releasex64\slvoice.exe] => (Allow) C:\program files\firestorm-releasex64\slvoice.exe
FirewallRules: [{E57FFF74-4B9C-4B03-8878-1651A0BA7722}] => (Allow) C:\Steam\steamapps\common\PuzzleQuest2\PuzzleQuest2.exe
FirewallRules: [{25310E34-1BA7-4CF7-B1E3-1286472A920A}] => (Allow) C:\Steam\steamapps\common\PuzzleQuest2\PuzzleQuest2.exe
FirewallRules: [{A43DF2EF-BB29-407A-A5D1-22BEACD24EA4}] => (Allow) C:\Steam\steamapps\common\CommunityCollegeHeroTrialByFireDemo\CommunityCollegeHeroTrialByFire.exe
FirewallRules: [{32D4C0CC-CB75-40B1-8F40-50B472B01925}] => (Allow) C:\Steam\steamapps\common\CommunityCollegeHeroTrialByFireDemo\CommunityCollegeHeroTrialByFire.exe
FirewallRules: [{FC8032DC-0B97-4EE4-9F1E-04CB13E16FE3}] => (Allow) C:\Program Files (x86)\AIM\aim.exe
FirewallRules: [{3775BB58-2F9D-4399-B266-CCC197E88F8C}] => (Allow) C:\Program Files (x86)\AIM\aim.exe
FirewallRules: [{1A703AE1-4926-485C-9C12-1A9129D8C762}] => (Allow) C:\Steam\steamapps\common\Fallout Shelter\FalloutShelter.exe
FirewallRules: [{C3AA9AE1-218C-4F0D-9EAC-3FA49FA04A87}] => (Allow) C:\Steam\steamapps\common\Fallout Shelter\FalloutShelter.exe
FirewallRules: [{E35C99A5-C761-4589-B8CD-6551CAC1E1D9}] => (Allow) C:\Steam\steamapps\common\SteamVR\tools\bin\win32\vrmonitor.exe
FirewallRules: [{6636C469-ECC6-4BEC-9EFD-4A06963AA0FD}] => (Allow) C:\Steam\steamapps\common\SteamVR\tools\bin\win32\vrmonitor.exe
FirewallRules: [TCP Query User{8157E4D4-6445-4E4B-B82C-DAD47688AC1B}C:\program files\firestormos-releasex64\slvoice.exe] => (Allow) C:\program files\firestormos-releasex64\slvoice.exe
FirewallRules: [UDP Query User{D715A2D0-B6A6-4583-8FAB-B23A25C53836}C:\program files\firestormos-releasex64\slvoice.exe] => (Allow) C:\program files\firestormos-releasex64\slvoice.exe
FirewallRules: [{EB7A460D-64D5-4F94-8624-10B39D471E6A}] => (Allow) C:\Steam\steamapps\common\SteamVR\bin\win32\vrstartup.exe
FirewallRules: [{BDBA368E-919E-4E31-82ED-C508143B7D9F}] => (Allow) C:\Steam\steamapps\common\SteamVR\bin\win32\vrstartup.exe
FirewallRules: [TCP Query User{119AD5CD-3501-4E56-8316-C3D22E961CD9}C:\program files (x86)\trillian\trillian.exe] => (Allow) C:\program files (x86)\trillian\trillian.exe
FirewallRules: [UDP Query User{FA5BA0B7-4EFC-41F8-8F9D-7E382408B1D1}C:\program files (x86)\trillian\trillian.exe] => (Allow) C:\program files (x86)\trillian\trillian.exe
FirewallRules: [TCP Query User{D973C261-F486-41DB-85F4-25AFA2C5DFE3}C:\users\mortetorment\downloads\utorrent_2.2.1.exe] => (Allow) C:\users\mortetorment\downloads\utorrent_2.2.1.exe
FirewallRules: [UDP Query User{9EB6D86B-CDF7-4583-B9E7-40C4BEEE3A94}C:\users\mortetorment\downloads\utorrent_2.2.1.exe] => (Allow) C:\users\mortetorment\downloads\utorrent_2.2.1.exe
FirewallRules: [TCP Query User{537B43E6-A73A-4A62-B1BF-B53FB24A17A3}C:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [UDP Query User{20FA13EE-DA99-4B1D-81C9-BE6836A09E8A}C:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [TCP Query User{83E1197F-BA09-4B7C-9445-9D7EA2FA2258}C:\program files (x86)\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [UDP Query User{5F2E5ECC-6E54-4D51-909B-8532BC17DA8F}C:\program files (x86)\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [{A171CAC8-C94E-4427-94FF-E3EDB5DB25CA}] => (Allow) C:\Steam\steamapps\common\Saints Row IV\SaintsRowIV.exe
FirewallRules: [{10520C8F-C37F-4B37-B830-814241E29632}] => (Allow) C:\Steam\steamapps\common\Saints Row IV\SaintsRowIV.exe
FirewallRules: [{C96FD71A-2409-4EC1-BD2C-CC53509C100E}] => (Allow) C:\Steam\steamapps\common\Shadowrun Hong Kong\SRHK.exe
FirewallRules: [{FCCC1872-CDC3-4570-8FCC-D2FCC4567921}] => (Allow) C:\Steam\steamapps\common\Shadowrun Hong Kong\SRHK.exe
FirewallRules: [{7D992D21-088E-4A12-8E4D-5A41A2B36B91}] => (Allow) C:\Steam\steamapps\common\Marvel Heroes\UnrealEngine3\Binaries\Win64\MarvelHeroes2016.exe
FirewallRules: [{F947D51F-A4F1-494D-8D0B-D8AD4444F0E2}] => (Allow) C:\Steam\steamapps\common\Marvel Heroes\UnrealEngine3\Binaries\Win64\MarvelHeroes2016.exe
FirewallRules: [TCP Query User{4A5E9FA4-23C6-4DA1-B298-D825EAC564D1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{21459703-6B22-4107-9F84-D75DA0FEB196}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{20879B64-C99D-41B4-B69A-1FF1E11D56C2}C:\users\mortetorment\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\mortetorment\appdata\local\mycomgames\mycomgames.exe
FirewallRules: [UDP Query User{F8965881-7DB9-497B-B783-87850DC24ACE}C:\users\mortetorment\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\mortetorment\appdata\local\mycomgames\mycomgames.exe
FirewallRules: [{1458F788-66FE-4A2C-8B4F-358DE13E99AB}] => (Allow) C:\Steam\steamapps\common\Marvel Heroes\UnrealEngine3\Binaries\Win64\MarvelHeroesOmega.exe
FirewallRules: [{A52CA73F-6F84-4DBF-9E15-48B00B5FB96C}] => (Allow) C:\Steam\steamapps\common\Marvel Heroes\UnrealEngine3\Binaries\Win64\MarvelHeroesOmega.exe
FirewallRules: [{84F612B6-A3D3-4634-88CC-AC88BF56B8FE}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{B740D735-3942-4574-9F7A-2A589DD6D9C1}] => (Allow) C:\Steam\steamapps\common\TrackMania United\TmForever.exe
FirewallRules: [{8FB52209-C987-49C6-88F8-F20331857DC8}] => (Allow) C:\Steam\steamapps\common\TrackMania United\TmForever.exe
FirewallRules: [{9E94B267-EF55-4E89-8CFE-32727EEA2BBB}] => (Allow) C:\Steam\steamapps\common\TrackMania United\TmForeverLauncher.exe
FirewallRules: [{5EDDA674-EEC8-4D00-B15E-A298AC56FBC9}] => (Allow) C:\Steam\steamapps\common\TrackMania United\TmForeverLauncher.exe
FirewallRules: [{99D79111-B9E1-4056-BE89-7F533BC8319A}] => (Allow) C:\Games\Mr DJ\Need For Speed Most Wanted Black Edition\speed.exe
FirewallRules: [{55F51DF0-45C9-4474-BD96-0FFF14216188}] => (Allow) C:\Games\Mr DJ\Need For Speed Most Wanted Black Edition\speed.exe
FirewallRules: [{B8FD3664-44D8-455C-A4BB-8DE320CE1D4C}] => (Allow) C:\Games\Mr DJ\Need for Speed Porsche Unleashed\Porsche.exe
FirewallRules: [{6ACBEDAA-8224-4D51-8723-7C5381B5B9AC}] => (Allow) C:\Games\Mr DJ\Need for Speed Porsche Unleashed\Porsche.exe
FirewallRules: [{861B4991-D274-4F5F-8806-20C510545F07}] => (Allow) C:\Games\Mr DJ\Need for Speed Hot Pursuit 2\NFSHP2.exe
FirewallRules: [{3970EEA6-85DD-4AAB-9F1E-BD2E21FB4686}] => (Allow) C:\Games\Mr DJ\Need for Speed Hot Pursuit 2\NFSHP2.exe
FirewallRules: [{D0604CE0-AC01-4448-99B5-25206D422D44}] => (Allow) C:\Games\Mr DJ\Need For Speed Underground\speed.exe
FirewallRules: [{FAC1D039-1A07-4F9B-A851-A0B068FE6E85}] => (Allow) C:\Games\Mr DJ\Need For Speed Underground\speed.exe
FirewallRules: [{63046509-952A-4E4C-AB62-1D40B2E361CD}] => (Allow) C:\Games\Mr DJ\Need For Speed Underground\uniws.exe
FirewallRules: [{7574C6DE-805B-40E8-BA67-3A02BDFD0211}] => (Allow) C:\Games\Mr DJ\Need For Speed Underground\uniws.exe
FirewallRules: [{427401F0-5EDB-4525-B797-1A77CFD8BF22}] => (Allow) C:\Steam\steamapps\common\SteamVR\tools\steamvr_environments\game\bin\win64\steamtours.exe
FirewallRules: [{A61B7A46-C3B9-499A-94E8-3A560DE90B6A}] => (Allow) C:\Steam\steamapps\common\SteamVR\tools\steamvr_environments\game\bin\win64\steamtours.exe
FirewallRules: [{9F9D6B4C-8DAF-4A74-A252-4278525FB570}] => (Allow) C:\Steam\steamapps\common\SteamVR\tools\steamvr_environments\game\bin\win64\steamtourscfg.exe
FirewallRules: [{CDBDED8D-6558-44EB-A21A-6F4FA299C8BD}] => (Allow) C:\Steam\steamapps\common\SteamVR\tools\steamvr_environments\game\bin\win64\steamtourscfg.exe
FirewallRules: [{0B6652B8-1B7D-42CD-A6B5-400D64AC71DC}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{553DD2E6-C217-49AE-99EA-8CA522AB250D}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [TCP Query User{E1260118-1698-4250-9027-934364523048}C:\gog games\divinity - original sin enhanced edition\shipping\eocapp.exe] => (Allow) C:\gog games\divinity - original sin enhanced edition\shipping\eocapp.exe
FirewallRules: [UDP Query User{C45CD8BC-EF54-43E2-8FBF-2574D0F33729}C:\gog games\divinity - original sin enhanced edition\shipping\eocapp.exe] => (Allow) C:\gog games\divinity - original sin enhanced edition\shipping\eocapp.exe
FirewallRules: [{E1F7FC8B-2DE2-497D-9040-0AA863BD601E}] => (Allow) C:\Program Files (x86)\BitLord\BitLord.exe
FirewallRules: [{A83A5ACF-392B-4595-95E5-49854D702DD1}] => (Allow) C:\Program Files (x86)\BitLord\BitLord.exe
FirewallRules: [TCP Query User{B3BA6933-4201-419D-864D-E49E9D88EADC}C:\program files\total war warhammer\warhammer.exe] => (Allow) C:\program files\total war warhammer\warhammer.exe
FirewallRules: [UDP Query User{60561FB4-29CB-4832-A4BF-E16680C0ACE7}C:\program files\total war warhammer\warhammer.exe] => (Allow) C:\program files\total war warhammer\warhammer.exe
FirewallRules: [{042D046A-9E34-49AA-A2A9-3A455DDFF109}] => (Allow) C:\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe
FirewallRules: [{C3190206-EEB6-4DE6-9B39-FF871F52F10F}] => (Allow) C:\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe
FirewallRules: [TCP Query User{DEBEBC0E-DC88-4335-A134-BBBC9CFB9A6A}C:\steam\steamapps\common\total war warhammer\warhammer.exe] => (Allow) C:\steam\steamapps\common\total war warhammer\warhammer.exe
FirewallRules: [UDP Query User{D6C92AEC-7CC7-4431-82CE-664E0B20CFFE}C:\steam\steamapps\common\total war warhammer\warhammer.exe] => (Allow) C:\steam\steamapps\common\total war warhammer\warhammer.exe
FirewallRules: [{DA5EFE32-7A75-4098-ABAF-CA5C8E7B6416}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{D57B0BD7-20B1-44ED-9D4F-5EAB2ABEE475}] => (Allow) C:\Steam\steamapps\common\DarkestDungeon\_windows\Darkest.exe
FirewallRules: [{23D91A6C-56EA-452C-9A80-282AB794D7EF}] => (Allow) C:\Steam\steamapps\common\DarkestDungeon\_windows\Darkest.exe
FirewallRules: [{B0236618-F1F0-4D6D-AB13-ACFFB7E0ABD0}] => (Allow) C:\Program Files (x86)\Nox\bin\Nox.exe
FirewallRules: [{F6B74F78-02EC-4BD3-A776-F0D20C882019}] => (Allow) C:\Program Files (x86)\Bignox\BigNoxVM\RT\NoxVMHandle.exe

==================== Restore Points =========================

22-09-2017 21:47:31 Installed DirectX
02-10-2017 04:23:58 Scheduled Checkpoint
06-10-2017 12:52:00 Installed DirectX
06-10-2017 12:52:52 Installed DirectX

==================== Faulty Device Manager Devices =============

Name: LogMeIn Hamachi Virtual Ethernet Adapter
Description: LogMeIn Hamachi Virtual Ethernet Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: LogMeIn Inc.
Service: Hamachi
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/06/2017 07:30:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program firefox.exe version 56.0.0.6478 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 66c

Start Time: 01d33ec82dde9cf6

Termination Time: 4294967295

Application Path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Report Id: 7698a9fe-ab07-11e7-82ed-fcaa14cc9bee

Faulting package full name:

Faulting package-relative application ID:

Error: (10/06/2017 07:29:34 PM) (Source: nssm) (EventID: 1026) (User: )
Description: Failed to open process handle for process with PID 1648 when terminating service Defender:
The parameter is incorrect.

Error: (10/06/2017 02:03:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: MM6.exe, version: 1.0.0.1, time stamp: 0x374b1850
Faulting module name: smackw32.dll, version: 3.0.0.0, time stamp: 0x39497d89
Exception code: 0xc0000005
Fault offset: 0x000096f0
Faulting process id: 0x1544
Faulting application start time: 0x01d33ee69bd271b9
Faulting application path: C:\GOG Games\Might and Magic 6\MM6.exe
Faulting module path: C:\GOG Games\Might and Magic 6\smackw32.dll
Report Id: dbf71a67-aad9-11e7-82ed-fcaa14cc9bee
Faulting package full name:
Faulting package-relative application ID:

Error: (10/06/2017 02:01:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: MM6.exe, version: 1.0.0.1, time stamp: 0x374b1850
Faulting module name: smackw32.dll, version: 3.0.0.0, time stamp: 0x39497d89
Exception code: 0xc0000005
Fault offset: 0x000096f0
Faulting process id: 0x498
Faulting application start time: 0x01d33ee6377daf51
Faulting application path: C:\GOG Games\Might and Magic 6\MM6.exe
Faulting module path: C:\GOG Games\Might and Magic 6\smackw32.dll
Report Id: 77ef198d-aad9-11e7-82ed-fcaa14cc9bee
Faulting package full name:
Faulting package-relative application ID:

Error: (10/05/2017 01:02:06 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program firefox.exe version 56.0.0.6478 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: b58

Start Time: 01d33e02bba1a655

Termination Time: 4294967295

Application Path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Report Id: 0de025ea-aa08-11e7-82ed-fcaa14cc9bee

Faulting package full name:

Faulting package-relative application ID:

Error: (10/02/2017 08:35:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15484

Error: (10/02/2017 08:35:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15484

Error: (10/02/2017 08:35:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/01/2017 10:31:30 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program firefox.exe version 55.0.3.6445 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: f80

Start Time: 01d33aae19b67fa0

Termination Time: 4294967295

Application Path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Report Id: 5b81b366-a6ce-11e7-82eb-fcaa14cc9bee

Faulting package full name:

Faulting package-relative application ID:

Error: (09/30/2017 08:52:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15547


System errors:
=============
Error: (10/06/2017 07:29:43 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The BlueStacks Log Rotator Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (10/06/2017 12:54:19 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{135FD325-45B7-4C30-89F8-4386961669F0}
 and APPID
{135FD325-45B7-4C30-89F8-4386961669F0}
 to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (10/06/2017 12:23:20 AM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 5

Error: (10/05/2017 11:16:49 AM) (Source: DCOM) (EventID: 10010) (User: Morte)
Description: The server {1B1F472E-3221-4826-97DB-2C2324D389AE} did not register with DCOM within the required timeout.

Error: (10/05/2017 11:16:18 AM) (Source: DCOM) (EventID: 10010) (User: Morte)
Description: The server {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} did not register with DCOM within the required timeout.

Error: (10/05/2017 10:51:57 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Steam Client Service service failed to start due to the following error:
%%1053 = The service did not respond to the start or control request in a timely fashion.

Error: (10/05/2017 10:51:57 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.

Error: (10/05/2017 01:26:00 AM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 5

Error: (10/04/2017 03:13:30 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 5

Error: (10/04/2017 09:03:15 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The VMware USB Arbitration Service service terminated with the following error:
%%2 = The system cannot find the file specified.


==================== Memory info ===========================

Processor: AMD FX™-8350 Eight-Core Processor
Percentage of memory in use: 72%
Total physical RAM: 8158.66 MB
Available physical RAM: 2270.45 MB
Total Virtual: 12523.66 MB
Available Virtual: 5329.07 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1862.67 GB) (Free:399.52 GB) NTFS
Drive d: (Fallout 3) (CDROM) (Total:5.51 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 3745A1D0)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1862.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Here you go, and thank you so much for helping me out.

Fix result of Farbar Recovery Scan Tool (x64) Version: 08-10-2017
Ran by [removed] (08-10-2017 13:39:07) Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKU\S-1-5-21-1988832187-1948698999-1346875777-1001 -> DefaultScope {518b33ae-375d-712d-6742-d1fe0400268d} URL =
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation.)
FF user.js: detected! => C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\user.js [2017-04-14]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\dweesm80.default -> Yahoo! Powered Search
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\dweesm80.default -> Yahoo! Powered Search
S2 MEmusvc; C:\Program Files\Microvirt\MEmu\MemuService.exe [X]
S3 ALSysIO; \??\C:\Users\MORTET~1\AppData\Local\Temp\ALSysIO64.sys [X] <==== ATTENTION
S2 AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
2016-12-03 01:14 - 2016-12-03 01:16 - 072679369 _____ (Baker & Taylor) C:\Users\MorteTorment\AppData\Local\Temp\Axis360Setup_1.0.14.716.exe
2016-12-03 01:17 - 2016-12-03 01:18 - 067825614 _____ (Baker & Taylor) C:\Users\MorteTorment\AppData\Local\Temp\Axis360Setup_1.0.15.720.exe
2017-08-09 14:10 - 2017-08-09 14:10 - 007850088 _____ (Microsoft Corporation) C:\Users\MorteTorment\AppData\Local\Temp\BingBarSetup-Partner.exe
2017-06-11 19:13 - 2017-06-11 19:13 - 000010520 _____ () C:\Users\MorteTorment\AppData\Local\Temp\BullseyeCoverage-x86-3.dll
2017-06-05 02:07 - 2017-06-05 15:54 - 000204800 _____ (Sony DADC Austria AG) C:\Users\MorteTorment\AppData\Local\Temp\drm_dyndata_7380006.dll
2017-06-05 15:36 - 2017-06-05 16:19 - 000204800 _____ (Sony DADC Austria AG) C:\Users\MorteTorment\AppData\Local\Temp\drm_dyndata_7380014.dll
2007-09-18 14:58 - 2007-09-18 14:58 - 000077160 _____ (Microsoft Corporation) C:\Users\MorteTorment\AppData\Local\Temp\DSETUP.dll
2007-09-18 14:58 - 2007-09-18 14:58 - 001673576 _____ (Microsoft Corporation) C:\Users\MorteTorment\AppData\Local\Temp\dsetup32.dll
2007-09-18 14:58 - 2007-09-18 14:58 - 000503144 _____ (Microsoft Corporation) C:\Users\MorteTorment\AppData\Local\Temp\DXSETUP.exe
2017-01-29 14:35 - 2017-01-29 14:35 - 000739904 _____ (Oracle Corporation) C:\Users\MorteTorment\AppData\Local\Temp\jre-8u121-windows-au.exe
2017-05-23 20:48 - 2017-05-23 20:48 - 000739904 _____ (Oracle Corporation) C:\Users\MorteTorment\AppData\Local\Temp\jre-8u131-windows-au.exe
2017-01-04 22:31 - 2017-01-04 22:31 - 006456560 _____ (Black Tree Gaming ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.11.exe
2017-02-05 13:47 - 2017-02-05 13:47 - 006441176 _____ (Black Tree Gaming ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.13.exe
2017-05-14 12:39 - 2017-05-14 12:40 - 006441096 _____ (Black Tree Gaming ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.14.exe
2016-10-29 19:09 - 2016-10-29 19:09 - 006449992 _____ (Black Tree Gaming ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.5.exe
2016-11-02 04:39 - 2016-11-02 04:39 - 006449136 _____ (Black Tree Gaming ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.6.exe
2016-11-14 01:44 - 2016-11-14 01:45 - 006452312 _____ (Black Tree Gaming ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.7.exe
2016-11-17 01:01 - 2016-11-17 01:02 - 006452760 _____ (Black Tree Gaming ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.8.exe
2016-12-17 04:46 - 2016-12-17 04:46 - 006453608 _____ (Black Tree Gaming ) C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.9.exe
2017-01-22 10:25 - 2017-08-07 21:09 - 000492544 _____ () C:\Users\MorteTorment\AppData\Local\Temp\s3.exe
2017-03-12 06:05 - 2017-03-12 06:05 - 000065280 _____ () C:\Users\MorteTorment\AppData\Local\Temp\utils.dll
2017-04-11 10:46 - 2017-04-11 10:46 - 014456872 _____ (Microsoft Corporation) C:\Users\MorteTorment\AppData\Local\Temp\vc_redist.x86.exe
2016-11-19 10:36 - 2006-05-24 10:10 - 000455600 _____ (Macrovision Corporation) C:\Users\MorteTorment\AppData\Local\Temp\_is9AE3.exe
2016-11-04 01:37 - 2006-05-24 10:10 - 000455600 _____ (Macrovision Corporation) C:\Users\MorteTorment\AppData\Local\Temp\_isFB83.exe
Task: {6CAACF0C-C4A9-4E4C-881D-98591DEB0DF6} - System32\Tasks\MicrosoftUpdate => C:\Windows\Fonts\svchost.exe <==== ATTENTION
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
Emptytemp:

*****************

Processes closed successfully.
Restore point was successfully created.
HKU\S-1-5-21-1988832187-1948698999-1346875777-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} => key removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} => key removed successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} => value removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f} => key removed successfully
C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\dweesm80.default\user.js => moved successfully
Firefox DefaultSearchEngine removed successfully
Firefox SelectedSearchEngine removed successfully
HKLM\System\CurrentControlSet\Services\MEmusvc => key removed successfully
MEmusvc => service removed successfully
HKLM\System\CurrentControlSet\Services\ALSysIO => key removed successfully
ALSysIO => service removed successfully
HKLM\System\CurrentControlSet\Services\AODDriver4.2.0 => key removed successfully
AODDriver4.2.0 => service removed successfully
C:\Users\MorteTorment\AppData\Local\Temp\Axis360Setup_1.0.14.716.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\Axis360Setup_1.0.15.720.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\BingBarSetup-Partner.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\BullseyeCoverage-x86-3.dll => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\drm_dyndata_7380006.dll => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\drm_dyndata_7380014.dll => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\DSETUP.dll => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\dsetup32.dll => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\DXSETUP.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\jre-8u121-windows-au.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\jre-8u131-windows-au.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.11.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.13.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.14.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.5.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.6.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.7.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.8.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\Nexus Mod Manager-0.63.9.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\s3.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\utils.dll => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\vc_redist.x86.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\_is9AE3.exe => moved successfully
C:\Users\MorteTorment\AppData\Local\Temp\_isFB83.exe => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{6CAACF0C-C4A9-4E4C-881D-98591DEB0DF6} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6CAACF0C-C4A9-4E4C-881D-98591DEB0DF6} => key removed successfully
C:\Windows\System32\Tasks\MicrosoftUpdate => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MicrosoftUpdate => key removed successfully

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh winsock reset all =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


========= netsh int ipv4 reset =========

Resetting Global, OK!
Resetting Interface, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting Route, OK!
Resetting Subinterface, OK!
Resetting , failed.
Access is denied.

Resetting , OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= netsh int ipv6 reset =========

Resetting Interface, OK!
Resetting Unicast Address, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting Route, OK!
Resetting , failed.
Access is denied.

Resetting , OK!
Resetting , OK!
Restart the computer to complete this action.


========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 40034783 B
Java, Flash, Steam htmlcache => 485397384 B
Windows/system/drivers => 201246342 B
Edge => 0 B
Chrome => 861891975 B
Firefox => 432451965 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 98676 B
systemprofile32 => 560 B
LocalService => 6614 B
NetworkService => 5371732 B
MorteTorment => 4331530178 B

RecycleBin => 0 B
EmptyTemp: => 5.9 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 13:42:46 ====

—

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 10/8/17
Scan Time: 2:08 PM
Log File: db229768-ac6c-11e7-bd14-00ff5d7be276.json
Administrator: Yes

-Software Information-
Version: 3.2.2.2029
Components Version: 1.0.188
Update Package Version: 1.0.2976
License: Trial

-System Information-
OS: Windows 8.1
CPU: x64
File System: NTFS
User: Morte\MorteTorment

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 436506
Threats Detected: 0
(No malicious items detected)
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 17 min, 50 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)


(end)

—-

# AdwCleaner 7.0.3.1 - Logfile created on Sun Oct 08 20:55:19 2017
# Updated on 2017/29/09 by Malwarebytes
# Running on Windows 8.1 (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

Deleted: C:\Program Files (x86)\Common Files\Software Update Utility


***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

Deleted: [Data] - HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{5D7BE276-0FAC-4E13-B4FE-1297C52DE160}|DhcpNameServer [[removed] [removed]]
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Deleted: [Key] - HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Deleted: [Key] - HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Deleted: [Key] - HKLM\SOFTWARE\Classes\AppID\dnu.EXE


***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [2090 B] - [2017/10/8 20:8:26]
C:/AdwCleaner/AdwCleaner[S1].txt - [2109 B] - [2017/10/8 20:54:0]


########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

• Run JavaRa.exe, then click on Remove Java Runtime.
• Select the Java version you have from the drop down list, and then click on Run Uninstaller
• Press Yes if it asks to uninstall the product.
• Allow the uninstaller to remove the installed version.
• When its finished, go back to JavaRa, and click Back
• Click on Update Java Runtime and then select Download and install latest version.
• Press Next
• Press Java Manual Download.
• A browser window will open with the Java download page.
• Click the Windows offline link to download Java.
• Run the installer.
• Close JavaRa

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

• Download Malwarebytes Anti-Rootkit Beta and extract it to your desktop (MBAR will be launched shortly after the extraction);
  🖼Click to load external image (HTCF1SV.png)
• Click on Next, and then on the Update button to let it update its database. Once the database has been successfully updated, click on Next;
  🖼Click to load external image (UJCQPAS.png)
• Make sure all the checkboxes are checked, then click on the Scan button, and let it completes its scan (this can take a while);
  🖼Click to load external image (v4lJKL5.png)
• Once the scan is done, make sure that every item is checked, and click on the Cleanup button (a reboot might be required);
• After that (and the reboot, if one was required), go back in the mbar folder and look for a text file called mbar-log-TODAY'S-DATE.txt;
• Copy/paste the content of that log in your next reply;

Ok, so there was no log with MBAR as nothing showed up.

BTW, I'm pretty sure it's connected to svchost, and I think that roguekiller combined with your knowledge is gonna be my birthday savior!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 8.1 x64
Ran by [removed] (Administrator) on Wed 10/11/2017 at 13:06:19.08
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 0


Deleted the following from C:\Users\MorteTorment\AppData\Roaming\Mozilla\Firefox\Profiles\4p3hzkkp.default-1507514874667\prefs.js
user_pref([removed], [{\label\:\Downloading Junkware Removal Tool\,\url\:\hxxps://www.bleepingcomputer.com/download/ju



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 10/11/2017 at 13:08:53.20
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

—-

RogueKiller V12.11.19.0 (x64) [Oct  9 2017] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Normal mode
User : MorteTorment [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Scan – Date : 10/11/2017 13:14:56 (Duration : 01:56:50)
Switches : -refid

¤¤¤ Processes : 2 ¤¤¤
[Hj.Name] svchost.exe(1624) – C:\Windows\appdata\svchost.exe[-] -> Found
[Proc.Svchost] svchost.exe(1624) – C:\Windows\appdata\svchost.exe[-] -> Found

¤¤¤ Registry : 8 ¤¤¤
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-1988832187-1948698999-1346875777-1001\Software\OCS -> Found
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-1988832187-1948698999-1346875777-1001\Software\OCS -> Found
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-1988832187-1948698999-1346875777-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\OCS -> Found
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-1988832187-1948698999-1346875777-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\OCS -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{23BF6ABC-5398-4927-A291-BCEDA1D4D29E}C:\users\mortetorment\appdata\local\temp\i1475700380\windows\resource\jre\bin\javaw.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\users\mortetorment\appdata\local\temp\i1475700380\windows\resource\jre\bin\javaw.exe|Name=javaw.exe|Desc=javaw.exe|Defer=User| [x] -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{F3BFAFD1-71F5-495F-B3D5-9F1F5E53E0EC}C:\users\mortetorment\appdata\local\temp\i1475700380\windows\resource\jre\bin\javaw.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\users\mortetorment\appdata\local\temp\i1475700380\windows\resource\jre\bin\javaw.exe|Name=javaw.exe|Desc=javaw.exe|Defer=User| [x] -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {61A837C0-2C92-4BA6-9B7F-37D64AC95D60} : v2.22|Action=Allow|Active=TRUE|Dir=In|App=C:\Users\MorteTorment\AppData\Local\Temp\andy-x64\Setup.exe|Name=AndySetupIn| [x] -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {BCDA5F49-1772-4B88-BE83-80651F6FCD95} : v2.22|Action=Allow|Active=TRUE|Dir=Out|App=C:\Users\MorteTorment\AppData\Local\Temp\andy-x64\Setup.exe|Name=AndySetupOut| [x] -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 1 ¤¤¤
[PUP.AutoIt.Gen][File] C:\Games\DarkestDungeon.Build.20108.Incl.DLC\Darkest.exe -> Found

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: TOSHIBA DT01ACA200 +++++
— User —
[MBR] 04ab827ab369c31b77740ee586faedb8
[BSP] f653138930434d64efb4b62ebc782ed0 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 350 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 718848 | Size: 1907377 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 … OK
User = LL2 … OK