Am I Infected [Solved]

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-10-2017
Ran by [removed] (administrator) on DICK-CAROL (25-10-2017 16:25:31)
Running from C:\Users\[removed]\Documents\DICKSSTUFF
[removed] Platform: Windows 10 Pro Version 1703 15063.674 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
() C:\Program Files (x86)\BrowseSafer\BrowserSafer.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\FoxitConnectedPDFService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(PasswordBox, Inc.) C:\Program Files (x86)\PasswordBox\pbbtnService.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(Wondershare) C:\Program Files (x86)\Wondershare\Wondershare dr.fone toolkit for Android\Library\DriverInstaller\DriverInstall.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.3.227\WsAppService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Acer Incorporated) C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Acer Incorporated) C:\Program Files (x86)\Gateway\Hotkey Utility\HotkeyUtility.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.7.597.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(Knctr Inc) C:\Users\Marty1946\AppData\Roaming\Knctr\app\KnctrLauncher.exe
(Dashlane, Inc.) C:\Users\Marty1946\AppData\Roaming\Dashlane\Dashlane.exe
(Dashlane, Inc.) C:\Users\Marty1946\AppData\Roaming\Dashlane\DashlanePlugin.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Acer Incorporated) C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe
(Knctr Inc) C:\Users\Marty1946\AppData\Roaming\Knctr\app\KNCTR.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\BPR2\brdiagtool.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(The CefSharp Authors) C:\Users\Marty1946\AppData\Roaming\Knctr\app\Knctr.BrowserSubprocess.exe
(The CefSharp Authors) C:\Users\Marty1946\AppData\Roaming\Knctr\app\Knctr.BrowserSubprocess.exe
(The CefSharp Authors) C:\Users\Marty1946\AppData\Roaming\Knctr\app\Knctr.BrowserSubprocess.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11708.1001.30.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Inc.) C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.17.8162.0_x64__8wekyb3d8bbwe\Solitaire.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1709.2703.0_x64__8wekyb3d8bbwe\Calculator.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
(Microsoft Corporation) C:\Windows\System32\GameBarPresenceWriter.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Dashlane, Inc.) C:\Users\Marty1946\AppData\Roaming\Dashlane\DashlanePlugin.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16781824 2017-01-11] (Realtek Semiconductor)
HKLM\…\Run: [ZAM] => C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [15775888 2017-08-09] (Copyright 2017.)
HKLM\…\Run: [BrowseSafer] => "C:\Program Files\BrowseSafer\BrowserSaferMngr.exe"
HKLM-x32\…\Run: [BrHelp] => C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe [1939968 2014-10-22] (Brother Industries, Ltd.)
HKLM-x32\…\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2075480 2013-06-24] (Flexera Software LLC.)
HKLM-x32\…\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM-x32\…\Run: [Shindan] => C:\Program Files (x86)\Brother\BPR2\brdiagtool.exe [214528 2017-05-19] (Brother Industries, Ltd.)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-21] (Oracle Corporation)
HKLM-x32\…\Run: [BrowseSafer] => C:\Program Files (x86)\BrowseSafer\BrowserSaferMngr.exe
HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\Run: [Knctr] => C:\Users\Marty1946\AppData\Roaming\Knctr\app\KnctrLauncher.exe [36504 2017-10-21] (Knctr Inc)
HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\Run: [Dashlane] => C:\Users\Marty1946\AppData\Roaming\Dashlane\Dashlane.exe [508880 2017-10-16] (Dashlane, Inc.)
HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\Run: [DashlanePlugin] => C:\Users\Marty1946\AppData\Roaming\Dashlane\DashlanePlugin.exe [552912 2017-10-16] (Dashlane, Inc.)
HKU\S-1-5-18\…\RunOnce: [Application Restart #0] => C:\Windows\System32\Magnify.exe [876544 2017-03-18] (Microsoft Corporation)
HKU\S-1-5-18\…\RunOnce: [Application Restart #1] => C:\Windows\System32\Magnify.exe [876544 2017-03-18] (Microsoft Corporation)
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:13101
ProxyEnable: [S-1-5-21-1849213592-940515303-484074275-1001] => Proxy is enabled.
ProxyServer: [S-1-5-21-1849213592-940515303-484074275-1001] => http=127.0.0.1:13101
Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75
Tcpip\..\Interfaces\{2e6910e5-66c9-46c9-a8d9-fddb33652cba}: [DhcpNameServer] [removed]
Tcpip\..\Interfaces\{41466cd4-3887-414e-98a9-68816833ad91}: [DhcpNameServer] [removed]
Tcpip\..\Interfaces\{5008c517-0d0c-4026-9708-536de2f68ca6}: [DhcpNameServer] 75.75.76.76 75.75.75.75
Tcpip\..\Interfaces\{6d94c32c-f671-4002-953e-e26b61f1114f}: [DhcpNameServer] 75.75.76.76 75.75.75.75
ManualProxies: 1http=127.0.0.1:13101

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKU\S-1-5-21-1849213592-940515303-484074275-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
HKU\S-1-5-21-1849213592-940515303-484074275-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=yset_ie_syc_oracle&type;=orcl_hpset
SearchScopes: HKU\S-1-5-21-1849213592-940515303-484074275-1001 -> {39F104E0-9361-4682-A372-28C13B942F44} URL = hxxp://www.search-shield.com/Results.aspx?gd=SY1000136&ctid;=&ISID;=75380AE3-86BF-4DFF-AB31-C5B767836185&SearchSource;=58&UM;=8&D;=100817&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-1849213592-940515303-484074275-1001 -> {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = hxxp://search.xfinity.com/?cat=web&con;=toolbar&cid;=xfstart_tech_search&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-1849213592-940515303-484074275-1001 -> {482BB529-9DBF-4974-8481-6703D541AE97} URL = hxxps://search.yahoo.com/search?p={searchTerms}&intl;=us&fr;=yset_ie_syc_oracle&type;=orcl_default&partnerexternal-oracle;=external-oracle
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-10-20] (Microsoft Corporation)
BHO-x32: Dashlane BHO -> {42D79B50-CC4A-4A8E-860F-BE674AF053A2} -> C:\Users\Marty1946\AppData\Roaming\Dashlane\ie\Dashlanei.dll [2017-10-16] (Dashlane, Inc.)
BHO-x32: PasswordBox Helper -> {5DB69B97-934B-451D-94DB-32EF802A01CD} -> C:\Program Files (x86)\PasswordBox\Application\pbbtn.dll [2015-05-04] (PasswordBox, Inc.)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\ssv.dll [2017-07-26] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-07-26] (Oracle Corporation)
Toolbar: HKLM-x32 - Dashlane Toolbar - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\Users\Marty1946\AppData\Roaming\Dashlane\ie\KWIEBar.dll [2017-10-16] (Dashlane, Inc.)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\MSN Messenger\msgrapp.dll [2005-12-13] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-10-20] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-10-20] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-10-20] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-10-20] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: [removed]
FF ProfilePath: C:\Users\Marty1946\AppData\Roaming\Mozilla\Firefox\Profiles\yzmjh6ut.default [2017-10-08]
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\yzmjh6ut.default -> Search-shield powered by Bing
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\yzmjh6ut.default -> Search-shield powered by Bing
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\yzmjh6ut.default -> Search-shield powered by Bing
FF Homepage: Mozilla\Firefox\Profiles\yzmjh6ut.default -> hxxp://www.search-shield.com/?gd=SY1000136&ctid;=&ISID;=75380AE3-86BF-4DFF-AB31-C5B767836185&SearchSource;=55&UM;=8&D;=100817
FF NewTab: Mozilla\Firefox\Profiles\yzmjh6ut.default -> hxxp://www.search-shield.com/?gd=SY1000136&ctid;=&ISID;=75380AE3-86BF-4DFF-AB31-C5B767836185&SearchSource;=69&SSPV;=EB_SSPV&Lay;=1&UM;=8&D;=100817
FF SearchPlugin: C:\Users\Marty1946\AppData\Roaming\Mozilla\Firefox\Profiles\yzmjh6ut.default\searchplugins\Search-shield powered by Bing.xml [2017-10-08]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_27_0_0_183.dll [2017-10-25] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_183.dll [2017-10-25] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2016-05-18] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2016-05-18] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2016-05-18] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2016-05-18] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-01-19] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-01-19] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-01-19] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-01-19] (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-07-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-07-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-10-20] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll [2016-11-30] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-07-31] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1849213592-940515303-484074275-1001: SkypePlugin -> C:\Users\Marty1946\AppData\Local\SkypePlugin\7.18.0.51\npGatewayNpapi.dll [2016-04-25] (Skype Technologies S.A.)
FF Plugin HKU\S-1-5-21-1849213592-940515303-484074275-1001: SkypePlugin64 -> C:\Users\Marty1946\AppData\Local\SkypePlugin\7.18.0.51\npGatewayNpapi-x64.dll [2016-04-25] (Skype Technologies S.A.)

Chrome:
=======
CHR DefaultProfile: Profile 1
CHR HomePage: Profile 1 -> homepage.ssoextension.com/
CHR NewTab: Profile 1 ->  Not-active:"chrome-extension://aceoljbcjmobkmhngockiadobpelkjim/newtab/newtab.html"
CHR DefaultSearchURL: Profile 1 -> hxxps://search.yahoo.com/search?p={searchTerms}&fr;=yset_chr_syc_oracle&type;=default
CHR DefaultSearchKeyword: Profile 1 -> Yahoo
CHR DefaultSuggestURL: Profile 1 -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command;={searchTerms}&nResults;=10
CHR Profile: C:\Users\Marty1946\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-10-25]
CHR Extension: (Directions and Map V2.1) - C:\Users\Marty1946\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aceoljbcjmobkmhngockiadobpelkjim [2017-06-05]
CHR Extension: (Foxit PDF Creator) - C:\Users\Marty1946\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cifnddnffldieaamihfkhkdgnbhfmaci [2016-11-19]
CHR Extension: (Adobe Acrobat) - C:\Users\Marty1946\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-08-20]
CHR Extension: (Dashlane Secure Password Manager) - C:\Users\Marty1946\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\fdjamakpfbbddfjaooikfcpapjohcfmg [2017-10-20]
CHR Extension: (Email Access Online Version 2.6) - C:\Users\Marty1946\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hplmdffeenfbklegonfooaihgaghgfgc [2017-03-14]
CHR Extension: (Quotes of the Day) - C:\Users\Marty1946\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\kgcglkchocglabfcpdiepkifnfgffipe [2017-10-24]
CHR Extension: (BrowserSafer) - C:\Users\Marty1946\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ngbhaomngilelhnemljngfjfjmbbcbhp [2017-10-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Marty1946\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-21]
CHR Extension: (Amazon Assistant for Chrome) - C:\Users\Marty1946\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam [2017-10-06]
CHR Extension: (Chrome Media Router) - C:\Users\Marty1946\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-26]
CHR HKLM\…\Chrome\Extension: [cifnddnffldieaamihfkhkdgnbhfmaci] - C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\\plugins\Creator\ChromeAddin\ChromeAddin.crx [2016-06-23]
CHR HKU\S-1-5-21-1849213592-940515303-484074275-1001\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [ngbhaomngilelhnemljngfjfjmbbcbhp] - hxxps://chrome.google.com/webstore/detail/ngbhaomngilelhnemljngfjfjmbbcbhp
CHR HKLM-x32\…\Chrome\Extension: [bhfhojbhbnajajgihpicejdalbjlpcep] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [cifnddnffldieaamihfkhkdgnbhfmaci] - C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\\plugins\Creator\ChromeAddin\ChromeAddin.crx [2016-06-23]
CHR HKLM-x32\…\Chrome\Extension: [dofoafnmdocgkdphpkdooahjkhpmakjd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [gkcffmoikcgfhagefelmhiakelnjihik] - hxxps://chrome.google.com/webstore/detail/gkcffmoikcgfhagefelmhiakelnjihik

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 BrowserSafer; C:\Program Files (x86)\BrowseSafer\BrowserSafer.exe [4136232 2017-10-06] () [File not signed]
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [289792 2014-10-23] (Brother Industries, Ltd.) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [7923888 2017-10-12] (Microsoft Corporation)
R2 FoxitPhantomService; C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\FoxitConnectedPDFService.exe [1647808 2016-06-21] (Foxit Software Inc.)
R2 FoxitReaderService; C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe [1659592 2017-02-24] (Foxit Software Inc.)
S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [350064 2016-11-30] (WildTangent)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 PasswordBox; C:\Program Files (x86)\PasswordBox\pbbtnService.exe [67584 2014-05-14] (PasswordBox, Inc.) [File not signed]
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [77336 2015-01-19] (Nuance Communications, Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [3913064 2017-03-18] (Microsoft Corporation)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [752224 2017-01-16] (DEVGURU Co., LTD.)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-06-20] (Microsoft Corporation)
R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.227\WsAppService.exe [492768 2017-06-21] (Wondershare)
R2 WsDrvInst; C:\Program Files (x86)\Wondershare\Wondershare dr.fone toolkit for Android\Library\DriverInstaller\DriverInstall.exe [118048 2017-06-22] (Wondershare)
R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [15775888 2017-08-09] (Copyright 2017.)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\WINDOWS\System32\drivers\amdkmpfd.sys [87584 2017-01-17] (Advanced Micro Devices, Inc.)
S3 aswTap; C:\WINDOWS\System32\drivers\aswTap.sys [44640 2016-05-13] (The OpenVPN Project)
R3 Btcsrusb; C:\WINDOWS\System32\Drivers\btcusb.sys [50952 2016-07-14] (IVT Corporation.)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2017-01-16] (Samsung Electronics Co., Ltd.)
R3 e1cexpress; C:\WINDOWS\system32\DRIVERS\e1c64x64.sys [468752 2014-09-26] (Intel Corporation)
R3 ETDSMBus; C:\WINDOWS\System32\drivers\ETDSMBus.sys [32992 2016-07-03] (ELAN Microelectronic Corp.)
R1 MpKsl3855ecb0; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{39DD2E8B-D1EB-4BDE-B80D-7DE755B16371}\MpKsl3855ecb0.sys [49392 2017-10-25] (Microsoft Corporation)
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [419296 2017-01-19] (Realsil Semiconductor Corporation)
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] ()
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2017-01-16] (Samsung Electronics Co., Ltd.)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation)
R3 WirelessKeyboardFilter; C:\WINDOWS\System32\drivers\WirelessKeyboardFilter.sys [49896 2016-07-22] (Microsoft Corporation)
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2017-05-24] (Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2017-05-24] (Zemana Ltd.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-10-22 10:16 - 2017-10-22 10:16 - 000002203 _____ C:\Users\Public\Desktop\Smart Switch.lnk
2017-10-22 10:16 - 2017-10-22 10:16 - 000000000 ____D C:\Users\Public\Documents\NativeFus_Log
2017-10-22 10:16 - 2017-10-22 10:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2017-10-22 10:16 - 2017-01-16 02:26 - 000165504 _____ (Samsung Electronics Co., Ltd.) C:\WINDOWS\system32\Drivers\ssudmdm.sys
2017-10-22 10:16 - 2017-01-16 02:26 - 000131712 _____ (Samsung Electronics Co., Ltd.) C:\WINDOWS\system32\Drivers\ssudbus.sys
2017-10-22 10:15 - 2017-10-22 10:16 - 000000000 ____D C:\Users\Marty1946\AppData\Roaming\Samsung
2017-10-22 10:15 - 2017-10-22 10:16 - 000000000 ____D C:\Program Files (x86)\Samsung
2017-10-22 10:15 - 2017-10-22 10:15 - 000000000 ____D C:\ProgramData\Samsung
2017-10-22 10:15 - 2016-12-09 09:04 - 000144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\WINDOWS\SysWOW64\secman.dll
2017-10-22 06:30 - 2017-10-22 06:30 - 000000000 ____D C:\ProgramData\wsr
2017-10-22 06:17 - 2017-10-22 06:18 - 000000000 ____D C:\Users\Marty1946\AppData\Roaming\Wondershare
2017-10-22 06:17 - 2017-10-22 06:17 - 000001740 _____ C:\Users\Public\Desktop\dr.fone toolkit for Android.lnk
2017-10-22 06:17 - 2017-10-22 06:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2017-10-22 06:17 - 2015-02-27 10:35 - 000000232 _____ C:\WINDOWS\SysWOW64\dllhost.exe.config
2017-10-22 06:16 - 2017-10-22 06:17 - 000000000 ____D C:\Users\Public\Documents\Wondershare
2017-10-22 06:16 - 2017-10-22 06:17 - 000000000 ____D C:\ProgramData\Wondershare
2017-10-22 06:16 - 2017-10-22 06:17 - 000000000 ____D C:\Program Files (x86)\Wondershare
2017-10-21 19:22 - 2017-10-21 19:22 - 000000000 ____D C:\Users\Marty1946\.android
2017-10-21 19:21 - 2017-10-21 19:21 - 000001536 _____ C:\Users\Public\Desktop\FoneLab for Android.lnk
2017-10-21 19:21 - 2017-10-21 19:21 - 000000000 ____D C:\Users\Marty1946\AppData\Local\Aiseesoft Studio
2017-10-21 19:21 - 2017-10-21 19:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Aiseesoft
2017-10-21 19:21 - 2017-10-21 19:21 - 000000000 ____D C:\ProgramData\Aiseesoft Studio
2017-10-21 19:21 - 2017-10-21 19:21 - 000000000 ____D C:\Program Files (x86)\Aiseesoft Studio
2017-10-16 16:39 - 2017-10-16 16:39 - 000001758 _____ C:\Users\Marty1946\Downloads\invoice_364_from_Seven Ohm.pdf
2017-10-11 09:39 - 2017-10-11 09:39 - 126925120 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
2017-10-11 09:36 - 2017-09-30 01:49 - 001004136 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2017-10-11 09:36 - 2017-09-30 01:49 - 000777400 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2017-10-11 09:36 - 2017-09-30 01:49 - 000135576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2017-10-11 09:36 - 2017-09-30 01:48 - 008319384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-10-11 09:36 - 2017-09-30 01:48 - 002399728 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-10-11 09:36 - 2017-09-30 01:48 - 002327448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-10-11 09:36 - 2017-09-30 01:47 - 002969880 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2017-10-11 09:36 - 2017-09-30 01:47 - 001194792 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2017-10-11 09:36 - 2017-09-30 01:45 - 000511896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2017-10-11 09:36 - 2017-09-30 01:44 - 000181912 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2017-10-11 09:36 - 2017-09-30 01:42 - 000820120 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2017-10-11 09:36 - 2017-09-30 01:41 - 005304496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll
2017-10-11 09:36 - 2017-09-30 01:41 - 000654976 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2017-10-11 09:36 - 2017-09-30 01:41 - 000259400 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2017-10-11 09:36 - 2017-09-30 01:40 - 000724704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2017-10-11 09:36 - 2017-09-30 01:40 - 000336320 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
2017-10-11 09:36 - 2017-09-30 01:40 - 000173976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbccgp.sys
2017-10-11 09:36 - 2017-09-30 01:38 - 002239136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2017-10-11 09:36 - 2017-09-30 01:36 - 002672024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2017-10-11 09:36 - 2017-09-30 01:36 - 000057976 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2017-10-11 09:36 - 2017-09-29 22:29 - 001408536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-10-11 09:36 - 2017-09-29 22:29 - 000804784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2017-10-11 09:36 - 2017-09-29 22:26 - 001333136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2017-10-11 09:36 - 2017-09-29 22:26 - 001292872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2017-10-11 09:36 - 2017-09-29 22:10 - 001839872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-10-11 09:36 - 2017-09-29 22:10 - 001150776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2017-10-11 09:36 - 2017-09-29 22:10 - 000606072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2017-10-11 09:36 - 2017-09-29 22:10 - 000508344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2017-10-11 09:36 - 2017-09-29 22:10 - 000480920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll
2017-10-11 09:36 - 2017-09-29 22:09 - 002259760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2017-10-11 09:36 - 2017-09-29 22:09 - 000787712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2017-10-11 09:36 - 2017-09-29 22:06 - 004471368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2017-10-11 09:36 - 2017-09-29 22:05 - 005827744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2017-10-11 09:36 - 2017-09-29 22:05 - 002603744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneCoreUAPCommonProxyStub.dll
2017-10-11 09:36 - 2017-09-29 22:05 - 001266544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2017-10-11 09:36 - 2017-09-29 22:05 - 000750488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2017-10-11 09:36 - 2017-09-29 22:05 - 000559000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2017-10-11 09:36 - 2017-09-29 22:04 - 004215184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll
2017-10-11 09:36 - 2017-09-29 22:04 - 000612120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2017-10-11 09:36 - 2017-09-29 22:04 - 000519680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2017-10-11 09:36 - 2017-09-29 22:04 - 000438096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll
2017-10-11 09:36 - 2017-09-29 22:04 - 000347544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-10-11 09:36 - 2017-09-29 22:04 - 000182680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2017-10-11 09:36 - 2017-09-29 22:03 - 020373408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-10-11 09:36 - 2017-09-29 22:03 - 006768288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-10-11 09:36 - 2017-09-29 22:03 - 001439032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2017-10-11 09:36 - 2017-09-29 22:02 - 001624096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft.Uev.AppAgent.dll
2017-10-11 09:36 - 2017-09-29 22:02 - 001517464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2017-10-11 09:36 - 2017-09-29 22:02 - 000175512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\basecsp.dll
2017-10-11 09:36 - 2017-09-29 22:01 - 000124544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2017-10-11 09:36 - 2017-09-29 03:46 - 023678976 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-10-11 09:36 - 2017-09-29 03:45 - 002953216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-10-11 09:36 - 2017-09-29 03:44 - 000133120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2017-10-11 09:36 - 2017-09-29 03:43 - 002199552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-10-11 09:36 - 2017-09-29 03:43 - 000142336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\smartscreenps.dll
2017-10-11 09:36 - 2017-09-29 03:43 - 000060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
2017-10-11 09:36 - 2017-09-29 03:42 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mgmtapi.dll
2017-10-11 09:36 - 2017-09-29 03:41 - 013844992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2017-10-11 09:36 - 2017-09-29 03:41 - 000110080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BitLockerCsp.dll
2017-10-11 09:36 - 2017-09-29 03:40 - 006728192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-10-11 09:36 - 2017-09-29 03:40 - 000371200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2017-10-11 09:36 - 2017-09-29 03:40 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2017-10-11 09:36 - 2017-09-29 03:39 - 020511232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-10-11 09:36 - 2017-09-29 03:39 - 011888640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-10-11 09:36 - 2017-09-29 03:39 - 000364032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2017-10-11 09:36 - 2017-09-29 03:38 - 005721600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2017-10-11 09:36 - 2017-09-29 03:38 - 002671616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2017-10-11 09:36 - 2017-09-29 03:38 - 001135616 ____R (The ICU Project) C:\WINDOWS\SysWOW64\icuuc.dll
2017-10-11 09:36 - 2017-09-29 03:38 - 000498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft.Uev.Office2013CustomActions.dll
2017-10-11 09:36 - 2017-09-29 03:38 - 000471040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll
2017-10-11 09:36 - 2017-09-29 03:38 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2017-10-11 09:36 - 2017-09-29 03:38 - 000370688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2017-10-11 09:36 - 2017-09-29 03:38 - 000308224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2017-10-11 09:36 - 2017-09-29 03:38 - 000229376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scksp.dll
2017-10-11 09:36 - 2017-09-29 03:37 - 000306688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.dll
2017-10-11 09:36 - 2017-09-29 03:37 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll
2017-10-11 09:36 - 2017-09-29 03:36 - 019337216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-10-11 09:36 - 2017-09-29 03:36 - 000590336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2017-10-11 09:36 - 2017-09-29 03:35 - 003654656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-10-11 09:36 - 2017-09-29 03:34 - 006255616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-10-11 09:36 - 2017-09-29 03:34 - 002859520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-10-11 09:36 - 2017-09-29 03:34 - 000798720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2017-10-11 09:36 - 2017-09-29 03:34 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2017-10-11 09:36 - 2017-09-29 03:34 - 000434176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll
2017-10-11 09:36 - 2017-09-29 03:33 - 007598080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-10-11 09:36 - 2017-09-29 03:33 - 004559360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2017-10-11 09:36 - 2017-09-29 03:33 - 001506816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll
2017-10-11 09:36 - 2017-09-29 03:33 - 000658944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2017-10-11 09:36 - 2017-09-29 03:32 - 002782720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2017-10-11 09:36 - 2017-09-29 03:32 - 002340864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2017-10-11 09:36 - 2017-09-29 03:32 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-10-11 09:36 - 2017-09-29 03:32 - 001244160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll
2017-10-11 09:36 - 2017-09-29 03:32 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-10-11 09:36 - 2017-09-29 03:32 - 000035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-10-11 09:36 - 2017-09-29 03:32 - 000029184 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2017-10-11 09:36 - 2017-09-29 03:32 - 000023040 _____ (Microsoft Corporation) C:\WINDOWS\system32\mgmtapi.dll
2017-10-11 09:36 - 2017-09-29 03:31 - 003107328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2017-10-11 09:36 - 2017-09-29 03:31 - 000306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2017-10-11 09:36 - 2017-09-29 03:31 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2017-10-11 09:36 - 2017-09-29 03:31 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2017-10-11 09:36 - 2017-09-29 03:30 - 023686144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-10-11 09:36 - 2017-09-29 03:29 - 008333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2017-10-11 09:36 - 2017-09-29 03:29 - 001460736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2017-10-11 09:36 - 2017-09-29 03:29 - 001318912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2017-10-11 09:36 - 2017-09-29 03:29 - 000724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2017-10-11 09:36 - 2017-09-29 03:29 - 000157696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpchttp.dll
2017-10-11 09:36 - 2017-09-29 03:29 - 000102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2017-10-11 09:36 - 2017-09-29 03:29 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll
2017-10-11 09:36 - 2017-09-29 03:28 - 000681472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2017-10-11 09:36 - 2017-09-29 03:28 - 000473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2017-10-11 09:36 - 2017-09-29 03:28 - 000458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2017-10-11 09:36 - 2017-09-29 03:28 - 000297984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe
2017-10-11 09:36 - 2017-09-29 03:28 - 000104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Robocopy.exe
2017-10-11 09:36 - 2017-09-29 03:28 - 000040448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cipher.exe
2017-10-11 09:36 - 2017-09-29 03:27 - 012803072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-10-11 09:36 - 2017-09-29 03:27 - 000409600 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2017-10-11 09:36 - 2017-09-29 03:27 - 000350720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.dll
2017-10-11 09:36 - 2017-09-29 03:26 - 008213504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-10-11 09:36 - 2017-09-29 03:25 - 008199168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-10-11 09:36 - 2017-09-29 03:24 - 003377664 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2017-10-11 09:36 - 2017-09-29 03:24 - 001628672 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2017-10-11 09:36 - 2017-09-29 03:23 - 005557760 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2017-10-11 09:36 - 2017-09-29 03:23 - 004730368 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-10-11 09:36 - 2017-09-29 03:23 - 001887744 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2017-10-11 09:36 - 2017-09-29 03:23 - 000756224 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2017-10-11 09:36 - 2017-09-29 03:22 - 002829824 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2017-10-11 09:36 - 2017-09-29 03:21 - 003304448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2017-10-11 09:36 - 2017-09-29 03:21 - 000476160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2017-10-11 09:36 - 2017-09-29 03:21 - 000414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2017-10-11 09:36 - 2017-09-29 03:21 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2017-10-11 09:36 - 2017-09-29 03:20 - 000804864 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvewiz.dll
2017-10-11 09:36 - 2017-09-29 03:20 - 000385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2017-10-11 09:36 - 2017-09-29 03:20 - 000286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2017-10-11 09:36 - 2017-09-29 03:19 - 000325120 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvecpl.dll
2017-10-11 09:36 - 2017-09-29 03:19 - 000306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveui.dll
2017-10-11 09:36 - 2017-09-29 03:18 - 000364032 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdechangepin.exe
2017-10-11 09:36 - 2017-09-29 03:18 - 000215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\manage-bde.exe
2017-10-11 09:36 - 2017-09-29 03:18 - 000141312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BitLockerDeviceEncryption.exe
2017-10-11 09:36 - 2017-09-29 01:40 - 000804312 _____ C:\WINDOWS\SysWOW64\locale.nls
2017-10-11 09:36 - 2017-09-29 01:40 - 000804312 _____ C:\WINDOWS\system32\locale.nls
2017-10-11 09:36 - 2017-09-20 11:08 - 000640512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswstr10.dll
2017-10-11 09:36 - 2017-09-20 11:08 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2017-10-11 09:36 - 2017-09-20 11:08 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjint40.dll
2017-10-11 09:36 - 2017-09-18 19:09 - 000554400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2017-10-11 09:36 - 2017-09-18 18:20 - 000831488 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApiPublic.dll
2017-10-11 09:36 - 2017-09-18 18:20 - 000049664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tetheringclient.dll
2017-10-11 09:36 - 2017-09-18 18:15 - 000648704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApiPublic.dll
2017-10-11 09:35 - 2017-09-30 01:52 - 001595152 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-10-11 09:35 - 2017-09-30 01:51 - 001458320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2017-10-11 09:35 - 2017-09-30 01:51 - 001147288 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-10-11 09:35 - 2017-09-30 01:51 - 000661224 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2017-10-11 09:35 - 2017-09-30 01:50 - 001346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2017-10-11 09:35 - 2017-09-30 01:50 - 001068208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2017-10-11 09:35 - 2017-09-30 01:50 - 001024920 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-10-11 09:35 - 2017-09-30 01:48 - 000644696 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll
2017-10-11 09:35 - 2017-09-30 01:44 - 000712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2017-10-11 09:35 - 2017-09-30 01:43 - 007318888 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2017-10-11 09:35 - 2017-09-30 01:43 - 002442136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-10-11 09:35 - 2017-09-30 01:42 - 004848952 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2017-10-11 09:35 - 2017-09-30 01:42 - 001506712 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2017-10-11 09:35 - 2017-09-30 01:41 - 005477600 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2017-10-11 09:35 - 2017-09-30 01:41 - 002086808 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2017-10-11 09:35 - 2017-09-30 01:41 - 000961944 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2017-10-11 09:35 - 2017-09-30 01:41 - 000651672 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2017-10-11 09:35 - 2017-09-30 01:41 - 000257432 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2017-10-11 09:35 - 2017-09-30 01:41 - 000228248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-10-11 09:35 - 2017-09-30 01:40 - 000849816 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe
2017-10-11 09:35 - 2017-09-30 01:40 - 000701336 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2017-10-11 09:35 - 2017-09-30 01:40 - 000642680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-10-11 09:35 - 2017-09-30 01:40 - 000558912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.dll
2017-10-11 09:35 - 2017-09-30 01:40 - 000408984 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-10-11 09:35 - 2017-09-30 01:40 - 000184728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2017-10-11 09:35 - 2017-09-30 01:40 - 000072944 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe
2017-10-11 09:35 - 2017-09-30 01:39 - 021351760 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-10-11 09:35 - 2017-09-30 01:39 - 001694104 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2017-10-11 09:35 - 2017-09-30 01:39 - 000203672 _____ (Microsoft Corporation) C:\WINDOWS\system32\basecsp.dll
2017-10-11 09:35 - 2017-09-30 01:38 - 007910072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-10-11 09:35 - 2017-09-30 01:38 - 001854872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2017-10-11 09:35 - 2017-09-30 01:37 - 002377112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.AppAgent.dll
2017-10-11 09:35 - 2017-09-30 01:37 - 002229144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2017-10-11 09:35 - 2017-09-30 01:37 - 001464728 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2017-10-11 09:35 - 2017-09-30 01:36 - 000855960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2017-10-11 09:35 - 2017-09-30 01:36 - 000675224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2017-10-11 09:35 - 2017-09-29 03:34 - 017370624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-10-11 09:35 - 2017-09-29 03:34 - 003669504 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-10-11 09:35 - 2017-09-29 03:33 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2017-10-11 09:35 - 2017-09-29 03:32 - 002199552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-10-11 09:35 - 2017-09-29 03:32 - 000209920 _____ (Microsoft Corporation) C:\WINDOWS\system32\smartscreenps.dll
2017-10-11 09:35 - 2017-09-29 03:32 - 000087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\usoapi.dll
2017-10-11 09:35 - 2017-09-29 03:32 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2017-10-11 09:35 - 2017-09-29 03:31 - 000113152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll
2017-10-11 09:35 - 2017-09-29 03:31 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\efssvc.dll
2017-10-11 09:35 - 2017-09-29 03:30 - 007931392 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-10-11 09:35 - 2017-09-29 03:30 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2017-10-11 09:35 - 2017-09-29 03:30 - 000179200 _____ (Microsoft Corporation) C:\WINDOWS\system32\BitLockerCsp.dll
2017-10-11 09:35 - 2017-09-29 03:30 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-10-11 09:35 - 2017-09-29 03:30 - 000043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2017-10-11 09:35 - 2017-09-29 03:29 - 000550400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2017-10-11 09:35 - 2017-09-29 03:29 - 000461824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2017-10-11 09:35 - 2017-09-29 03:29 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2017-10-11 09:35 - 2017-09-29 03:29 - 000304640 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2017-10-11 09:35 - 2017-09-29 03:29 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ServiceWorkerHost.exe
2017-10-11 09:35 - 2017-09-29 03:28 - 000699904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
2017-10-11 09:35 - 2017-09-29 03:28 - 000556032 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll
2017-10-11 09:35 - 2017-09-29 03:28 - 000527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-10-11 09:35 - 2017-09-29 03:28 - 000256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll
2017-10-11 09:35 - 2017-09-29 03:28 - 000254976 _____ (Microsoft Corporation) C:\WINDOWS\system32\scksp.dll
2017-10-11 09:35 - 2017-09-29 03:27 - 001321984 ____R (The ICU Project) C:\WINDOWS\system32\icuuc.dll
2017-10-11 09:35 - 2017-09-29 03:27 - 000616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowManagement.dll
2017-10-11 09:35 - 2017-09-29 03:27 - 000565760 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2017-10-11 09:35 - 2017-09-29 03:27 - 000538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2017-10-11 09:35 - 2017-09-29 03:27 - 000524800 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2017-10-11 09:35 - 2017-09-29 03:27 - 000412160 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-10-11 09:35 - 2017-09-29 03:26 - 002809344 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-10-11 09:35 - 2017-09-29 03:26 - 001468928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-10-11 09:35 - 2017-09-29 03:26 - 001269760 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2017-10-11 09:35 - 2017-09-29 03:26 - 001197568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.CommonBridge.dll
2017-10-11 09:35 - 2017-09-29 03:26 - 001141760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplySettingsTemplateCatalog.exe
2017-10-11 09:35 - 2017-09-29 03:26 - 000772096 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2017-10-11 09:35 - 2017-09-29 03:26 - 000356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll
2017-10-11 09:35 - 2017-09-29 03:26 - 000045056 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerUI.dll
2017-10-11 09:35 - 2017-09-29 03:25 - 004175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2017-10-11 09:35 - 2017-09-29 03:25 - 002760704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.UnifiedTile.CuratedTileCollections.dll
2017-10-11 09:35 - 2017-09-29 03:25 - 000586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll
2017-10-11 09:35 - 2017-09-29 03:24 - 003307008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-10-11 09:35 - 2017-09-29 03:24 - 002503680 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2017-10-11 09:35 - 2017-09-29 03:24 - 001886208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-10-11 09:35 - 2017-09-29 03:24 - 001307648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-10-11 09:35 - 2017-09-29 03:24 - 001201664 _____ (Microsoft Corporation) C:\WINDOWS\system32\AgentService.exe
2017-10-11 09:35 - 2017-09-29 03:24 - 000684032 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 003140096 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 002730496 _____ (Microsoft Corporation) C:\WINDOWS\system32\smartscreen.exe
2017-10-11 09:35 - 2017-09-29 03:23 - 002446336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 002195968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.ModernAppAgent.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 002055680 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-10-11 09:35 - 2017-09-29 03:23 - 001605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 001460224 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 001398784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 001052672 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 000986624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 000972288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 000841216 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 000647168 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2017-10-11 09:35 - 2017-09-29 03:23 - 000512000 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2017-10-11 09:35 - 2017-09-29 03:22 - 001802240 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-10-11 09:35 - 2017-09-29 03:22 - 001438208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Phone.dll
2017-10-11 09:35 - 2017-09-29 03:22 - 000407040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-10-11 09:35 - 2017-09-29 03:21 - 000722944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2017-10-11 09:35 - 2017-09-29 03:21 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2017-10-11 09:35 - 2017-09-29 03:21 - 000154624 _____ (Microsoft Corporation) C:\WINDOWS\system32\regsvc.dll
2017-10-11 09:35 - 2017-09-29 03:21 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TabSvc.dll
2017-10-11 09:35 - 2017-09-29 03:20 - 001811456 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2017-10-11 09:35 - 2017-09-29 03:20 - 000194560 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpchttp.dll
2017-10-11 09:35 - 2017-09-29 03:20 - 000150016 _____ (Microsoft Corporation) C:\WINDOWS\system32\iscsiexe.dll
2017-10-11 09:35 - 2017-09-29 03:19 - 002088448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2017-10-11 09:35 - 2017-09-29 03:19 - 000208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscsvc.dll
2017-10-11 09:35 - 2017-09-29 03:18 - 002438656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
2017-10-11 09:35 - 2017-09-29 03:18 - 001527296 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2017-10-11 09:35 - 2017-09-29 03:18 - 000893440 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2017-10-11 09:35 - 2017-09-29 03:18 - 000603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2017-10-11 09:35 - 2017-09-29 03:18 - 000347648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe
2017-10-11 09:35 - 2017-09-29 03:18 - 000130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Robocopy.exe
2017-10-11 09:35 - 2017-09-29 03:18 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\system32\cipher.exe
2017-10-11 09:35 - 2017-09-18 19:20 - 001065104 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2017-10-11 09:35 - 2017-09-18 19:20 - 000900376 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2017-10-11 09:35 - 2017-09-18 19:18 - 000965024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.efi
2017-10-11 09:35 - 2017-09-18 19:17 - 001395664 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2017-10-11 09:35 - 2017-09-18 19:17 - 001186464 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2017-10-11 09:35 - 2017-09-18 19:17 - 000821664 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.exe
2017-10-11 09:35 - 2017-09-18 19:11 - 001018272 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2017-10-11 09:35 - 2017-09-18 18:26 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringclient.dll
2017-10-11 09:35 - 2017-09-18 18:25 - 000117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\eShims.dll
2017-10-11 09:35 - 2017-09-18 18:23 - 000210432 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2017-10-08 10:59 - 2017-10-09 07:43 - 000000000 ____D C:\Program Files (x86)\PrimUp!
2017-10-08 10:59 - 2017-10-08 10:59 - 000000000 ____D C:\Users\Marty1946\AppData\Roaming\PrimeUpdater
2017-10-08 10:58 - 2017-10-08 10:58 - 000001130 _____ C:\Users\Marty1946\Desktop\Knctr.lnk
2017-10-08 10:58 - 2017-10-08 10:58 - 000000000 ____D C:\Users\Marty1946\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Knctr
2017-10-08 10:58 - 2017-10-08 10:58 - 000000000 ____D C:\Users\Marty1946\AppData\Roaming\Knctr
2017-10-08 10:57 - 2017-10-09 08:05 - 000000000 ____D C:\Program Files (x86)\WebDiscoverBrowser
2017-10-08 10:57 - 2017-10-09 07:33 - 000000000 ____D C:\Program Files (x86)\BrowseSafer
2017-10-08 10:57 - 2017-10-08 10:59 - 000000000 ____D C:\Users\Marty1946\AppData\Local\AHSW!Prime!PUCQ
2017-10-08 10:57 - 2017-10-08 10:57 - 000000000 ____D C:\Users\Marty1946\AppData\Roaming\KnctrDownloader
2017-10-08 10:57 - 2017-10-08 10:57 - 000000000 ____D C:\ProgramData\BrowserSafer
2017-10-08 10:55 - 2017-10-08 10:55 - 000000032 _____ C:\Users\Marty1946\Desktop\1181740
2017-10-08 10:55 - 2017-10-08 10:55 - 000000000 ____D C:\Program Files (x86)\HyperDSetup
2017-10-06 09:51 - 2017-10-06 09:51 - 000000590 _____ C:\Users\Marty1946\Downloads\Upcoming Appointment.ics
2017-10-03 19:54 - 2017-10-03 19:54 - 000002872 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-10-25 16:25 - 2017-05-24 15:44 - 003108536 _____ C:\WINDOWS\ZAM.krnl.trace
2017-10-25 16:25 - 2017-05-24 15:44 - 000392732 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2017-10-25 16:25 - 2017-05-23 19:56 - 000000000 ____D C:\FRST
2017-10-25 16:12 - 2017-05-12 02:08 - 000000000 ____D C:\Users\Marty1946\Documents\DICKSSTUFF
2017-10-25 16:10 - 2017-06-15 08:58 - 000004162 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{584ED03E-2FE1-4C71-91DA-FA8EF4E8A1FF}
2017-10-25 16:09 - 2017-06-15 08:39 - 000016201 _____ C:\WINDOWS\BRRBCOM.INI
2017-10-25 13:21 - 2014-10-11 10:51 - 000000000 __SHD C:\Users\Marty1946\IntelGraphicsProfiles
2017-10-25 13:20 - 2017-06-15 08:35 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-10-25 06:24 - 2017-06-15 08:58 - 000004550 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-10-25 06:24 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-10-25 06:24 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\system32\Macromed
2017-10-24 22:41 - 2017-03-18 17:03 - 000000000 ___HD C:\Program Files\WindowsApps
2017-10-24 22:41 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-10-24 06:32 - 2013-08-15 11:18 - 000000000 ____D C:\Users\Marty1946\AppData\Local\Packages
2017-10-24 06:27 - 2017-06-15 08:58 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-10-24 06:27 - 2016-07-24 15:20 - 000000000 ____D C:\ProgramData\Foxit Software
2017-10-24 06:27 - 2013-07-06 23:19 - 000000000 ____D C:\ProgramData\boost_interprocess
2017-10-24 06:26 - 2017-03-18 07:40 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2017-10-23 14:55 - 2017-06-15 08:41 - 000000000 ____D C:\Users\Marty1946
2017-10-23 06:18 - 2017-08-25 08:36 - 000000000 _____ C:\Users\Marty1946\AppData\LocalLow\rightsCheck_1.txt
2017-10-22 10:38 - 2017-03-18 16:51 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-10-22 10:19 - 2017-03-18 17:01 - 000000000 ____D C:\WINDOWS\INF
2017-10-22 10:18 - 2013-08-18 18:12 - 000000000 ____D C:\Users\Marty1946\AppData\Local\CyberLink
2017-10-22 10:15 - 2013-03-01 02:25 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-10-20 15:37 - 2017-03-18 17:03 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-10-20 15:36 - 2013-07-06 23:17 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2017-10-19 10:21 - 2017-08-21 22:11 - 000002016 _____ C:\Users\Marty1946\Desktop\Dashlane.lnk
2017-10-19 10:21 - 2017-08-21 22:10 - 000000000 ____D C:\Users\Marty1946\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dashlane
2017-10-19 10:21 - 2017-08-21 22:10 - 000000000 ____D C:\Users\Marty1946\AppData\Roaming\Dashlane
2017-10-19 09:35 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\rescache
2017-10-18 14:59 - 2013-08-15 10:05 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-10-18 12:12 - 2017-06-15 08:59 - 001572618 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-10-18 12:06 - 2017-06-15 08:35 - 000404448 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-10-18 12:04 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\ShellExperiences
2017-10-18 12:04 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\Provisioning
2017-10-18 12:04 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2017-10-18 12:03 - 2017-03-18 17:03 - 000230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msclmd.dll
2017-10-18 12:03 - 2017-03-18 17:03 - 000207872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msclmd.dll
2017-10-15 18:49 - 2016-08-18 17:48 - 000000000 ____D C:\Users\Marty1946\AppData\Roaming\Skype
2017-10-12 20:21 - 2017-03-18 17:06 - 000835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-10-12 20:21 - 2017-03-18 17:06 - 000177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-10-12 09:49 - 2013-08-15 16:37 - 000000000 ____D C:\Users\Marty1946\AppData\Local\ElevatedDiagnostics
2017-10-11 09:42 - 2013-08-15 12:31 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-10-11 09:39 - 2015-07-17 08:30 - 126925120 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-10-09 07:22 - 2014-11-23 13:38 - 000000000 ___RD C:\Users\Marty1946\OneDrive
2017-10-03 19:54 - 2016-03-19 07:56 - 000000000 ____D C:\Program Files\CCleaner
2017-09-26 16:16 - 2017-04-11 21:22 - 000002279 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-09-26 16:16 - 2017-04-11 21:22 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-09-26 06:02 - 2016-09-04 07:48 - 000000000 ____D C:\Users\Marty1946\AppData\Roaming\SmartDraw

==================== Files in the root of some directories =======

2016-12-30 06:06 - 2016-12-30 06:06 - 021874200 _____ (LastPass) C:\Program Files (x86)\Common Files\lpuninstall.exe
2017-05-18 05:51 - 2017-05-18 05:51 - 000081084 _____ () C:\Users\Marty1946\AppData\Roaming\PhotoPad.dmp
2017-03-30 06:05 - 2017-05-22 19:18 - 001801715 _____ () C:\Users\Marty1946\AppData\Local\ars.cache
2017-03-30 06:06 - 2017-05-22 19:20 - 001347065 _____ () C:\Users\Marty1946\AppData\Local\census.cache
2017-03-30 05:51 - 2017-03-30 05:51 - 000000036 _____ () C:\Users\Marty1946\AppData\Local\housecall.guid.cache
2017-03-30 06:00 - 2017-05-22 18:57 - 000000010 _____ () C:\Users\Marty1946\AppData\Local\sponge.last.runtime.cache
2017-06-15 08:38 - 2017-06-15 08:38 - 000000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-10-23 10:27

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-10-2017
Ran by [removed] (25-10-2017 16:26:34)
Running from C:\Users\[removed]\Documents\DICKSSTUFF
Windows 10 Pro Version 1703 15063.674 (X64) (2017-06-15 13:07:21)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1849213592-940515303-484074275-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1849213592-940515303-484074275-503 - Limited - Disabled)
Guest (S-1-5-21-1849213592-940515303-484074275-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1849213592-940515303-484074275-1005 - Limited - Enabled)
Marty1946 (S-1-5-21-1849213592-940515303-484074275-1001 - Administrator - Enabled) => C:\Users\Marty1946

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 16.04 (HKLM-x32\…\{23170F69-40C1-2701-1604-000001000000}) (Version: 16.04.00.0 - Igor Pavlov)
Acer Remote (HKLM-x32\…\Acer Remote1.0) (Version: 1.0 - Acer Inc.)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.012.20098 - Adobe Systems Incorporated)
Adobe Flash Player 27 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 27.0.0.183 - Adobe Systems Incorporated)
Adobe Flash Player 27 PPAPI (HKLM-x32\…\Adobe Flash Player PPAPI) (Version: 27.0.0.183 - Adobe Systems Incorporated)
Atlantic Quest 2: The New Adventures (HKLM-x32\…\WTA-963b20ca-489a-4f08-a650-67e016d95408) (Version: 3.0.2.59 - WildTangent) Hidden
AVG 2014 (HKLM\…\{F6C6FA81-E7E5-46D3-A37B-75B3950BC6F8}) (Version: 14.0.4830 - AVG Technologies) Hidden
AVG PC TuneUp 2014 (en-US) (HKLM-x32\…\{8CD86D42-C4DD-4E40-9211-164DFFBCA4DB}) (Version: 14.0.1001.229 - AVG) Hidden
AVG PC TuneUp 2014 (HKLM-x32\…\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}) (Version: 14.0.1001.229 - AVG) Hidden
Bejeweled 2 Deluxe (HKLM-x32\…\WTA-aa71e6f6-a876-4256-a434-8b5a266e1504) (Version: 2.2.0.95 - WildTangent) Hidden
Bejeweled 3 (HKLM-x32\…\WTA-c34378bc-0f26-49e4-a058-aacd38cb26ad) (Version: 2.2.0.98 - WildTangent) Hidden
BrLauncher (HKLM-x32\…\{C661197A-6B93-4E37-9E3F-2A1DFCD64234}) (Version: 1.1.15.0 - Brother Industries Ltd.) Hidden
BrLogRx (HKLM-x32\…\{B556F816-FF4D-4BB6-9339-ED28639E2EF3}) (Version: 1.0.2.1 - Brother Industries Ltd.) Hidden
Brother PCFax Driver (HKLM-x32\…\{56BA05BD-7A67-4EF8-85A7-8C6528AEE2AC}) (Version: 1.4.0.0 - Brother Industries Ltd.) Hidden
Brother Port Driver (HKLM-x32\…\{A1562B01-0760-40EB-BCA7-5A15CE039B6B}) (Version: 1.1.8.8 - Brother Industries Ltd.) Hidden
Brother Printer Driver (HKLM-x32\…\{A17C3197-24C9-493B-BB9A-A73800A0B61A}) (Version: 1.6.0.1 - Brother Industries Ltd.) Hidden
Brother Scanner Driver (HKLM-x32\…\{AE0056FC-36C2-4C09-B9BB-9111617914EA}) (Version: 1.0.11.11 - Brother Industries Ltd.) Hidden
BrotherHelpInstaller (HKLM-x32\…\{4E461C2A-EC1C-46D1-AF5B-7FEFD0054AF8}) (Version: 1.0.0.0 - Brother) Hidden
BrowserSafer (HKLM-x32\…\BrowserSafer) (Version: 2.0.2.4 - BrowserSafer Co ©)
BrSupportTools (HKLM-x32\…\{F8F9EB58-33BA-4FF8-80E7-66D87D2E0C3C}) (Version: 1.0.9.0 - Brother Industries Ltd.) Hidden
CameraHelperMsi (HKLM-x32\…\{15634701-BACE-4449-8B25-1567DA8C9FD3}) (Version: 13.51.815.0 - Logitech) Hidden
Caribbean Jewel (HKLM-x32\…\WTA-fc18bf87-67a5-40d9-aa2c-d2fa1e8d1936) (Version: 3.0.2.48 - WildTangent) Hidden
CCleaner (HKLM\…\CCleaner) (Version: 5.35 - Piriform)
Chinese Dragon (HKLM-x32\…\WTA-000efbe5-f84a-4887-8ae2-51ee3ccdc934) (Version: 3.0.2.59 - WildTangent) Hidden
ControlCenter4 (HKLM-x32\…\{9ADB625A-7F6D-4C48-9058-4767A55D5424}) (Version: 4.2.438.1 - Brother Insutries Ltd.) Hidden
ControlCenter4 CSDK (HKLM-x32\…\{1BAE50D4-5F2A-4E34-BD81-B4555109F7C2}) (Version: 4.2.3.1 - Brother Insutries Ltd.) Hidden
Cradle Of Egypt Collector's Edition (HKLM-x32\…\WTA-53116b10-9e0e-4b2a-8a8b-fea878e7eb81) (Version: 2.2.0.110 - WildTangent) Hidden
CyberLink MediaEspresso 6.5 (HKLM-x32\…\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.5.3318_45364 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\…\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2531.57 - CyberLink Corp.)
Dashlane (HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\Dashlane) (Version: 4.9.0.38517 - Dashlane, Inc.)
Defraggler (HKLM\…\Defraggler) (Version: 2.21 - Piriform)
Delicious: Emily's Childhood Memories Premium Edition (HKLM-x32\…\WTA-da76454a-3427-497a-8c1c-1fdec93f23cb) (Version: 3.0.2.32 - WildTangent) Hidden
DeviceDetect (HKLM-x32\…\{F805D16D-AB79-4DC7-A60F-436621995275}) (Version: 1.2.1.0 - Brother Industries Ltd.) Hidden
dr.fone toolkit for Android (Version 8.3.3) (HKLM-x32\…\{7B08A1E1-3644-4237-B39D-762B5F5564D0}_is1) (Version: 8.3.3.64 - Wondershare Technology Co.,Ltd.)
eBay Worldwide (HKLM-x32\…\{91589413-6675-4C27-8AFC-EFB9103B90A5}) (Version: 2.4.0105 - OEM)
erLT (HKLM-x32\…\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}) (Version: 1.20.138.34 - Logitech, Inc.) Hidden
Express Burn Disc Burning Software (HKLM-x32\…\ExpressBurn) (Version: 6.09 - NCH Software)
Facebook Gameroom 1.2.1.5 (HKLM-x32\…\{61373D8E-915C-49C2-B9B9-1834EBD9B64B}) (Version: 1.2.1.5 - Facebook)
Fairyland Match (HKLM-x32\…\WTA-13f8de43-4548-4546-934f-1cad64782cc4) (Version: 1.1.0.23 - WildTangent) Hidden
FoneLab for Android 2.2.10 (HKLM-x32\…\{7A7ACBDD-FED6-4ec5-BD26-5549FEB5B968}_is1) (Version: 2.2.10 - Aiseesoft Studio)
Foxit PhantomPDF Standard (HKLM-x32\…\{EA576878-3D17-11E6-B85F-000C2992F709}) (Version: 8.0.1.628 - Foxit Software Inc.)
Foxit Reader (HKLM-x32\…\Foxit Reader_is1) (Version: 8.2.1.6871 - Foxit Software Inc.)
Game Channels (HKLM-x32\…\WildTangentGameProvider-gateway-genres) (Version: 8.1.0.17 - WildTangent, Inc.)
Game Channels (HKLM-x32\…\WildTangentGameProvider-gateway-main) (Version: 8.1.0.17 - WildTangent, Inc.) Hidden
Gateway Power Management (HKLM\…\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3012 - Gateway Incorporated)
Gateway Recovery Management (HKLM\…\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3016 - Gateway Incorporated)
Gem Smashers (HKLM-x32\…\WTA-f0ba9ca5-0890-4a60-869a-2d647e91a85b) (Version: 2.2.0.98 - WildTangent) Hidden
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 61.0.3163.100 - Google Inc.)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Holiday Cheer (HKLM-x32\…\WTA-529ab5da-ac11-46ee-94fb-b543cdcf66b0) (Version: 3.0.2.32 - WildTangent) Hidden
Hotkey Utility (HKLM-x32\…\{A6DC88AD-501A-44BC-884D-57435F972E2C}) (Version: 3.00.3004 - Gateway Incorporated)
HowToGuide (HKLM-x32\…\{36580EEB-4EDF-4880-BBD4-097E2C645ECD}) (Version: 1.0.1.0 - Brother Industries Ltd.) Hidden
Identity Card (HKLM-x32\…\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.3004 - Gateway Incorporated)
Intel(R) Control Center (HKLM-x32\…\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\…\PROSet) (Version: 17.2 - Intel)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\…\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.4.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\…\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Java 8 Update 144 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F32180144F0}) (Version: 8.0.1440.1 - Oracle Corporation)
Jewel Match 3 (HKLM-x32\…\WTA-439b2538-9d01-4153-95b1-1c4bf003b0e1) (Version: 2.2.0.98 - WildTangent) Hidden
Jewel Match Winter Wonderland (HKLM-x32\…\WTA-e961ecb7-6006-4c88-a108-9fff873f1563) (Version: 3.0.2.38 - WildTangent) Hidden
Knctr version 2.0.0.0 (HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\{1AA9C6FF-63D8-439A-B2EC-D4934B2B4D31}_is1) (Version: 2.0.0.0 - Knctr, Inc.)
Live Updater (HKLM-x32\…\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.3007 - Gateway Incorporated)
Logitech Webcam Software (HKLM-x32\…\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.80 - Logitech Inc.)
Luxor 2 HD (HKLM-x32\…\WTA-6e8c636f-251a-4be6-b195-67182ce8df40) (Version: 3.0.2.38 - WildTangent) Hidden
Mah Jong Medley (HKLM-x32\…\WTA-03388870-9a70-48d8-88ee-75bbb94e4d87) (Version: 2.2.0.95 - WildTangent) Hidden
Mahjong World Contest (HKLM-x32\…\WTA-ff224d59-dc7d-42e3-8692-fd772121b616) (Version: 3.0.2.51 - WildTangent) Hidden
Microsoft Mouse and Keyboard Center (HKLM\…\Microsoft Mouse and Keyboard Center) (Version: 2.8.106.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 365 - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 16.0.8528.2139 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Standard 2007 (HKLM-x32\…\STANDARDR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\OneDriveSetup.exe) (Version: 17.3.6998.0830 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4048 (HKLM\…\{91415F19-4C22-3609-A105-92ED3522D83C}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 (HKLM-x32\…\{5B1F2843-B379-3FF2-B0D3-64DD143ED53A}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\…\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
MSN Messenger 7.5 (HKLM-x32\…\{CEB3A11A-03EA-11DA-BFBD-00065BBDC0B5}) (Version: 7.5.0322.0 - Microsoft Corporation)
MSN Toolbar (HKLM-x32\…\MSN Toolbar) (Version:  - )
Mystery P.I. - Curious Case of Counterfeit Cove (HKLM-x32\…\WTA-d61e2831-36f4-455a-8f09-9af29d7ae61b) (Version: 2.2.0.98 - WildTangent) Hidden
Nero BackItUp 12 Essentials OEM.a01 (HKLM-x32\…\{4CA8F973-6377-4ABF-9ED5-CC2323B3C000}) (Version: 12.5.00500 - Nero AG)
NetworkRepairTool (HKLM-x32\…\{4694AD3E-D4A2-4D98-9848-662A0475E872}) (Version: 1.2.11.0 - Brother Insutries Ltd.) Hidden
Nuance PaperPort 14 (HKLM-x32\…\{6CC9391F-D441-4D2E-9ECC-1F7084C733ED}) (Version: 14.5.0006 - Nuance Communications, Inc.)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\…\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8528.2139 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\…\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8528.2139 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\…\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8528.2139 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\…\{90160000-008C-0409-0000-0000000FF1CE}) (Version: 16.0.8326.2107 - Microsoft Corporation) Hidden
PaperPort Image Printer 64-bit (HKLM\…\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0002 - Nuance Communications, Inc.)
PasswordBox (HKLM-x32\…\PasswordBox) (Version: 1.38.11.4170 - PasswordBox, Inc.)
Path of Hercules (HKLM-x32\…\WTA-3953d52c-6195-4c83-8ffb-d0eee871f51f) (Version: 3.0.2.51 - WildTangent) Hidden
PC-FAXReceive (HKLM-x32\…\{DD40894F-7575-4905-90AB-695FD827E358}) (Version: 1.4.24.0 - Brother Insutries Ltd.) Hidden
PCFaxTx (HKLM-x32\…\{63530B2D-3A34-4D79-A52D-F3EB5D99A7C1}) (Version: 1.1.1.1 - Brother Industries Ltd.) Hidden
Peggle Nights (HKLM-x32\…\WTA-922a4b59-b24a-4917-9b7a-db8e15afe575) (Version: 2.2.0.98 - WildTangent) Hidden
PhotoPad Image Editor (HKLM-x32\…\PhotoPad) (Version: 3.09 - NCH Software)
Plants vs. Zombies - Game of the Year (HKLM-x32\…\WTA-8280ec03-bd49-4def-8a1d-2369e4365877) (Version: 2.2.0.98 - WildTangent) Hidden
Prerequisite installer (HKLM-x32\…\{3AAB08A3-F129-4BD5-B409-AE674F93759D}) (Version: 12.0.0003 - Nero AG) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\…\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.214 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\…\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 11.31 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.14393.31233 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8036 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\…\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.2.8400.30137 - Realtek Semiconductor Corp.)
Recuva (HKLM\…\Recuva) (Version: 1.53 - Piriform)
RemoteSetup (HKLM-x32\…\{BDD8C463-1183-4A91-9EC8-BF68E4ECA9B6}) (Version: 3.9.2.1 - Brother Industries Ltd.) Hidden
Rolling Idols: Lost City (HKLM-x32\…\WTA-ee54d8c9-5fe6-4e4e-a079-86954261fa96) (Version: 3.0.2.51 - WildTangent) Hidden
Royal Jigsaw (HKLM-x32\…\WTA-3ff97e84-8c50-4249-a98f-06b005042e09) (Version: 3.0.2.51 - WildTangent) Hidden
SaferWeb 1.5.13 (HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\SaferWeb) (Version: 1.5.13 - SaferWeb)
Samsung USB Driver for Mobile Phones (HKLM\…\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.63.0 - Samsung Electronics Co., Ltd.)
ScannerUtilityInstaller (HKLM-x32\…\{5B645FE2-19E9-4B15-B5B2-3D8766F6FA27}) (Version: 1.0.0.0 - Brother) Hidden
Skype Web Plugin (HKLM-x32\…\{575E7A6A-F93E-4C3F-AAEB-AF96D8679532}) (Version: 7.18.0.51 - Skype Technologies S.A.)
Skype™ 7.37 (HKLM-x32\…\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.37.103 - Skype Technologies S.A.)
Smart Switch (HKLM-x32\…\{74FA5314-85C8-4E2A-907D-D9ECCCB770A7}) (Version: 4.1.17054.16 - Samsung Electronics Co., Ltd.) Hidden
Smart Switch (HKLM-x32\…\InstallShield_{74FA5314-85C8-4E2A-907D-D9ECCCB770A7}) (Version: 4.1.17054.16 - Samsung Electronics Co., Ltd.)
SmartDraw 2017 (HKLM-x32\…\SmartDraw 2017) (Version:  - SmartDraw, LLC)
Sparkle 2 (HKLM-x32\…\WTA-9307080c-38d1-49d9-9764-4bd757758b5e) (Version: 3.0.2.51 - WildTangent) Hidden
Speccy (HKLM\…\Speccy) (Version: 1.30 - Piriform)
Spotify (HKLM-x32\…\Spotify) (Version: 0.8.4.99.ga249b5f1 - Spotify AB)
SpywareBlaster 5.5 (HKLM-x32\…\SpywareBlaster_is1) (Version: 5.5.0 - BrightFort LLC)
StatusMonitor (HKLM-x32\…\{86D16055-3C14-44C6-BCD7-5514B83BAD34}) (Version: 1.12.4.0 - Brother Insutries Ltd.) Hidden
Super Collapse Puzzle Gallery 2 (HKLM-x32\…\WTA-7451b3f9-1127-4364-9075-76299112551a) (Version: 2.2.0.98 - WildTangent) Hidden
Tales of Lagoona (HKLM-x32\…\WTA-2d41ff4c-dd89-40e7-9a2c-4865d5e25756) (Version: 2.2.0.110 - WildTangent) Hidden
The Brother Product Research & Support Program (HKLM-x32\…\{BCE40480-3D49-4D27-8C64-DCDFB06CEEC8}) (Version: 3.0.6 - Brother Industries, Ltd.)
The Chronicles of Emerland Solitaire (HKLM-x32\…\WTA-98df0d98-d744-4d37-b2b5-a960d8cf2cab) (Version: 3.0.2.32 - WildTangent) Hidden
The Treasures of Montezuma 4 (HKLM-x32\…\WTA-f111ee44-05eb-471e-be45-1ad5e4acf17a) (Version: 3.0.2.51 - WildTangent) Hidden
The Treasures of Montezuma 5 (HKLM-x32\…\WTA-7024dedc-fc80-494e-a47c-e8a89bc348c0) (Version: 1.1.2.4 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update Installer for WildTangent Games App (HKLM-x32\…\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version:  - WildTangent) Hidden
UsbRepairTool (HKLM-x32\…\{523276A4-5779-4105-9163-CA1CF94EC533}) (Version: 1.4.0.0 - Brother Insutries Ltd.) Hidden
Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.1.0.28 - WildTangent)
WildTangent Games App (HKLM-x32\…\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-gateway) (Version: 4.0.11.2 - WildTangent) Hidden
WildTangent Games App (HKLM-x32\…\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-wildgames) (Version: 4.1.1.8 - WildTangent) Hidden
Windows 10 Update and Privacy Settings (HKLM\…\{293F2009-0145-450B-B4AA-063D43FB368C}) (Version: 1.0.13.0 - Microsoft Corporation)
Windows Deployment Tools (HKLM-x32\…\{BFC9778E-9765-C94C-C082-C2514F8DEB9B}) (Version: 8.59.25584 - Microsoft)
Windows Driver Package - AMD (amdkmpfd) System  (12/09/2016 16.60.0.0000) (HKLM\…\D2BE684635541753B7ADEB903A532F1A701A5CB7) (Version: 12/09/2016 16.60.0.0000 - AMD)
Windows Driver Package - ELAN SMBus (ETDSMBus) System  (05/31/2016 15.1.2.9) (HKLM\…\F069782784DB514BAC37C846F2CF3B7C1374AFB3) (Version: 05/31/2016 15.1.2.9 - ELAN SMBus)
Windows Driver Package - Intel (ICCWDT) System  (03/13/2016 11.0.0.1010) (HKLM\…\262F224EEDD1DB9B9F2CC1808546760F1633498C) (Version: 03/13/2016 11.0.0.1010 - Intel)
Windows Driver Package - Intel (MEIx64) System  (03/28/2016 11.0.5.1189) (HKLM\…\63CEF5543DBF9887E6220C5C2F7F85C2D4C726D5) (Version: 03/28/2016 11.0.5.1189 - Intel)
Windows Driver Package - Intel Corporation (iaStorA) HDC  (11/16/2012 11.5.12.1002) (HKLM\…\BE427296AE826CFD7BAB134514191C4D7632BD00) (Version: 11/16/2012 11.5.12.1002 - Intel Corporation)
Windows Driver Package - INTEL System  (01/03/2017 10.1.1.40) (HKLM\…\8CEDD5129B707E5E3DBDA8D3505BBF287C775830) (Version: 01/03/2017 10.1.1.40 - INTEL)
Windows Driver Package - INTEL System  (01/03/2017 10.1.1.40) (HKLM\…\FDF41EC50250C5521FE27B83ED0C111EDF03AF17) (Version: 01/03/2017 10.1.1.40 - INTEL)
Windows Driver Package - Intel USB  (07/09/2013 9.3.0.1028) (HKLM\…\6AB557A44DB5C90C1F398266C338F5468520E2C0) (Version: 07/09/2013 9.3.0.1028 - Intel)
Windows Driver Package - IVT Corporation (Btcsrusb) Bluetooth Device  (07/14/2016 6.2.84.276) (HKLM\…\4793ED4F0CFB9806CAB4A59B5B74C1F5AADEDF1A) (Version: 07/14/2016 6.2.84.276 - IVT Corporation)
Windows Driver Package - Qualcomm Atheros Communications Inc. (athr) Net  (11/17/2016 10.0.0.350) (HKLM\…\C79B1056D3097782666BD909F9205C80629AD8B7) (Version: 11/17/2016 10.0.0.350 - Qualcomm Atheros Communications Inc.)
Windows Driver Package - Realtek Semiconductor Corp. (RTSUER) USB  (01/19/2017 10.0.14393.31233) (HKLM\…\787822D15B7B58DDF1F545269848918564D61930) (Version: 01/19/2017 10.0.14393.31233 - Realtek Semiconductor Corp.)
Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (11/27/2015 6.0.1.6095) (HKLM\…\4FB5B0F9C824F3CD2D51C1736F6293C50999A86B) (Version: 11/27/2015 6.0.1.6095 - Realtek Semiconductor Corp.)
Windows PE x86 x64 (HKLM-x32\…\{F89D69CA-6EE1-E037-DD3B-08CDDE1BED1C}) (Version: 8.59.25584 - Microsoft)
Windows PE x86 x64 wims (HKLM-x32\…\{85F4ACB1-E7DC-C3C6-F4FD-BB936DF2695E}) (Version: 8.59.25584 - Microsoft)
Winning Putt (HKLM-x32\…\{B6DECC70-4F95-402B-B07D-ADFFB2DCFA6D}) (Version: 0.6.0.0 - BANDAI NAMCO Entertainment America)
Yahoo Search Set (HKLM-x32\…\Yahoo! SearchSet) (Version:  - Yahoo Inc.)
Zemana AntiMalware (HKLM-x32\…\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.74.0.150 - Zemana Ltd.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1849213592-940515303-484074275-1001_Classes\CLSID\{41CA1685-6816-4DDD-BD49-62E8527FF5FC}\InprocServer32 -> C:\Users\Marty1946\AppData\Local\SkypePlugin\7.18.0.51\GatewayActiveX-x64.dll (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-1849213592-940515303-484074275-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-1849213592-940515303-484074275-1001_Classes\CLSID\{AECD7203-A7DC-437F-BB84-CAFCB8726531}\localserver32 -> C:\Users\Marty1946\AppData\Local\SkypePlugin\7.18.0.51\GatewayVersion-x64.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-1849213592-940515303-484074275-1001_Classes\CLSID\{CBF9CD8C-2714-4F36-B76A-43E6C7547BC2}\localserver32 -> C:\Users\Marty1946\AppData\Local\SkypePlugin\7.18.0.51\EdgeCalling.exe (Skype Technologies S.A.)
ContextMenuHandlers1: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll [2017-06-15] ()
ContextMenuHandlers1-x32: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files (x86)\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers1-x32: [AVG Shell Extension] -> {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} =>  -> No File
ContextMenuHandlers1-x32: [DefragglerShellExtension] -> {4380C993-0C43-4E02-9A7A-0D40B6EA7590} => C:\Program Files\Defraggler\DefragglerShell64.dll [2016-03-08] (Piriform Ltd)
ContextMenuHandlers1-x32: [Foxit_ConvertToPDF] -> {C5269811-4A29-4818-A4BB-111F9FC63A5F} => C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\ConvertToPDFShellExtension_x64.dll [2016-06-18] (Foxit Software Inc.)
ContextMenuHandlers1-x32: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2017-02-15] (Foxit Software Inc.)
ContextMenuHandlers4-x32: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files (x86)\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers4-x32: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-01] (Piriform Ltd)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-05-03] (Intel Corporation)
ContextMenuHandlers5: [igfxOSP] -> {FA507C3F-30C6-4DCA-9EE5-2656072EEC14} => C:\WINDOWS\system32\igfxOSP.dll [2016-05-03] (Intel Corporation)
ContextMenuHandlers6: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll [2017-06-15] ()
ContextMenuHandlers6-x32: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files (x86)\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers6-x32: [AVG Shell Extension] -> {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} =>  -> No File
ContextMenuHandlers6-x32: [DefragglerShellExtension] -> {4380C993-0C43-4E02-9A7A-0D40B6EA7590} => C:\Program Files\Defraggler\DefragglerShell64.dll [2016-03-08] (Piriform Ltd)
ContextMenuHandlers6-x32: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2017-02-15] (Foxit Software Inc.)
ContextMenuHandlers6-x32: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-01] (Piriform Ltd)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {02933E2B-48C1-4CFD-84B2-94E74E2FD38F} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2016-08-15] (Microsoft Corporation)
Task: {07F1CA25-22CE-418A-A841-F2684EB396B5} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-10-12] (Microsoft Corporation)
Task: {0C382707-C6B7-4622-99A5-EA9543568ECD} - System32\Tasks\TechUtilities => C:\Program Files\TechUtilities\TechUtilities.exe
Task: {1F3BAFB3-C2AF-4378-9764-377A094F6BDF} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-07-20] (Adobe Systems Incorporated)
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe
Task: {36EDBF9A-8B2E-47B4-AF80-5FDF0FA122C3} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2016-08-15] (Microsoft Corporation)
Task: {405B9784-287C-4B01-AB12-8BB4E3AE776F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-10-12] (Microsoft Corporation)
Task: {47D47355-6D75-428A-ADC3-F1FECB365FDC} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-09-28] ()
Task: {4C4AAB5F-95F9-4BE4-A845-99FFEFC529A0} - System32\Tasks\Power Management => C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe [2013-01-18] (Acer Incorporated)
Task: {4C7A74AD-5728-4EBD-AFA9-B52DF7DE8148} - System32\Tasks\SafeZone scheduled Autoupdate 1463140307 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe
Task: {4CAD7C65-4649-4F0F-B7DB-2BA34B4B563F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-10-25] (Adobe Systems Incorporated)
Task: {4E4FC1B7-8D9A-48F1-86FF-1DB4B8375F41} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\AVG\AVG PC TuneUp\OneClick.exe
Task: {556CBB0B-A9CC-472C-ABAC-7BAD3393588F} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1849213592-940515303-484074275-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {57284EE0-EE59-408D-88A3-AE83FA03A03E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-04-11] (Google Inc.)
Task: {5A740AD2-E37B-4D73-AB71-729F1E8C7C27} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_27_0_0_183_pepper.exe [2017-10-25] (Adobe Systems Incorporated)
Task: {6BDFBB83-B6D0-481B-98B3-C723079C273A} - System32\Tasks\ALU => C:\Program Files (x86)\Gateway\Live Updater\updater.exe [2013-01-22] ()
Task: {6D0270A2-636C-4371-9177-CAB38391B4A1} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1849213592-940515303-484074275-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {6F462BBE-EEE2-4A8F-9BC4-D57AE606D2D7} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2016-08-15] (Microsoft)
Task: {75FE6D6D-C878-40C3-86F3-F014F9282F72} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2017-10-11] (Microsoft Corporation)
Task: {80FB7A14-EDB0-49B3-8B64-DD6A6300C9C6} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-09-28] ()
Task: {87B3CF98-1F37-42E2-AEF2-C9B9F4EA65E3} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2016-08-15] (Microsoft Corporation)
Task: {91D263C0-0313-4923-8644-E9F00E3320C4} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-10-20] (Microsoft Corporation)
Task: {AAE8C7AB-43D1-4E6E-BE32-39FE4493A097} - System32\Tasks\SDMsgUpdate (SD) => C:\Program Files (x86)\SmartDraw 2017\Messages\SDNotify.exe [2017-01-20] ()
Task: {AAED8165-1991-4A09-805E-560F63E4486B} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-09-19] (CyberLink)
Task: {ADB7CA1D-193C-437E-B9EC-A7A8965FCAB2} - System32\Tasks\Hotkey Utility => C:\Program Files (x86)\Gateway\Hotkey Utility\HotkeyUtility.exe [2012-09-20] (Acer Incorporated)
Task: {AF8DBF79-D850-4FFE-BDCC-CB95F6DA0AF7} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Gateway\Live Updater\liveupdater_agent.exe [2013-01-22] ()
Task: {BC587A81-78A3-43AA-8FB0-5FBDE4F37251} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner64.exe [2017-09-20] (Piriform Ltd)
Task: {D9CDF24A-9C2E-4AC0-9AED-CA404BFB0DE3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-04-11] (Google Inc.)
Task: {DD6E3BD5-268B-47B8-9FE1-4D3F3E66356B} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2016-08-15] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\SDMsgUpdate (SD).job => C:\PROGRA~2\SMARTD~1\Messages\SDNotify.exe\-PSD -V24000001 -SSDU.ini -A -Mhxxp:/www.smartdraw.com/msgs/messagecheck.asp
Task: C:\WINDOWS\Tasks\TechUtilities.job => C:\Program Files\TechUtilities\TechUtilities.exe-t C:\Program Files\TechUtilities\TechUtilities.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\Marty1946\Favorites\NCH Software Download Site.lnk -> hxxp://www.nch.com.au/index.htm
Shortcut: C:\Users\Marty1946\Favorites\Gateway\Gateway.lnk -> hxxp://www.gateway.com

==================== Loaded Modules (Whitelisted) ==============

2017-10-06 12:51 - 2017-10-06 12:51 - 004136232 _____ () C:\Program Files (x86)\BrowseSafer\BrowserSafer.exe
2017-04-14 22:23 - 2005-04-22 13:36 - 000143360 _____ () C:\WINDOWS\system32\BrSNMP64.dll
2017-03-18 16:58 - 2017-03-18 16:58 - 000138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-05-24 15:44 - 2017-06-15 11:28 - 000155504 _____ () C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll
2017-03-18 16:59 - 2017-03-18 22:30 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-10-18 15:04 - 2017-10-18 15:04 - 000087552 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.7.597.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-10-18 15:04 - 2017-10-18 15:04 - 000206336 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.7.597.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-10-18 15:04 - 2017-10-18 15:04 - 025446400 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.7.597.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-10-18 15:04 - 2017-10-18 15:04 - 002542592 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.7.597.0_x64__kzf8qxf38zg5c\skypert.dll
2017-10-18 15:04 - 2017-10-18 15:04 - 000685056 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.7.597.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 000264040 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2017-09-14 01:09 - 2017-09-14 01:09 - 003553704 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11708.1001.30.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2017-10-05 05:28 - 2017-10-05 05:28 - 010634752 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11708.1001.30.0_x64__8wekyb3d8bbwe\WinStore.Entertainment.Mobile.dll
2017-10-05 05:28 - 2017-10-05 05:28 - 002640896 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11708.1001.30.0_x64__8wekyb3d8bbwe\MS.Entertainment.Common.Mobile.dll
2017-05-26 21:34 - 2017-05-26 21:34 - 002156752 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.17.8162.0_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll
2017-09-20 14:59 - 2017-09-20 14:59 - 005201816 _____ () C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1709.1.0_x64__8wekyb3d8bbwe\Microsoft.Advertising.dll
2016-11-22 11:26 - 2016-11-22 11:27 - 003379200 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.17.8162.0_x64__8wekyb3d8bbwe\Avatars.dll
2016-11-22 11:26 - 2016-11-22 11:27 - 000370176 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.17.8162.0_x64__8wekyb3d8bbwe\Gamerpics.dll
2017-08-29 17:55 - 2017-08-29 17:55 - 004285440 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.17.8162.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.Services.dll
2017-08-29 17:55 - 2017-08-29 17:55 - 001335808 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.17.8162.0_x64__8wekyb3d8bbwe\cpprest140_uwp_2_9.dll
2017-07-27 23:38 - 2017-07-27 23:38 - 000843672 _____ () C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\Microsoft.Services.Store.Engagement.dll
2017-10-10 04:58 - 2017-10-10 04:58 - 004252672 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1709.2703.0_x64__8wekyb3d8bbwe\Calculator.exe
2017-09-26 15:59 - 2017-09-26 16:00 - 003553704 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1709.2703.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2017-09-26 16:16 - 2017-09-21 03:29 - 004022616 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libglesv2.dll
2017-09-26 16:16 - 2017-09-21 03:29 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libegl.dll
2014-05-14 12:45 - 2014-05-14 12:45 - 000090624 _____ () C:\Program Files (x86)\PasswordBox\libwebsocketswin32.dll
2013-07-06 23:06 - 2012-07-18 14:55 - 001198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2009-02-27 16:38 - 2009-02-27 16:38 - 000139264 _____ () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 002144104 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 000341352 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 007955304 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 000028008 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 000127336 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2017-10-08 10:58 - 2017-07-21 19:39 - 001162752 _____ () C:\Users\Marty1946\AppData\Roaming\Knctr\app\CefSharp.Core.dll
2017-10-08 10:58 - 2017-07-21 06:38 - 066703360 _____ () C:\Users\Marty1946\AppData\Roaming\Knctr\app\libcef.dll
2012-09-13 00:39 - 2012-09-13 00:39 - 000336232 _____ () C:\Program Files (x86)\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2017-10-08 10:58 - 2017-07-21 21:33 - 000748032 _____ () C:\Users\Marty1946\AppData\Roaming\Knctr\app\Knctr.BrowserSubprocess.Core.dll
2017-10-08 10:58 - 2017-07-21 06:38 - 002918400 _____ () C:\Users\Marty1946\AppData\Roaming\Knctr\app\libglesv2.dll
2017-10-08 10:58 - 2017-07-21 06:38 - 000079872 _____ () C:\Users\Marty1946\AppData\Roaming\Knctr\app\libegl.dll
2017-10-22 05:45 - 2017-09-16 00:23 - 017822720 _____ () C:\Users\Marty1946\AppData\Roaming\Knctr\app\plugins\pepflashplayer.dll
2017-08-18 03:09 - 2017-10-20 15:34 - 001010856 _____ () C:\Program Files (x86)\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll
2017-08-17 02:02 - 2017-10-07 06:03 - 001444560 _____ () C:\Program Files (x86)\Microsoft Office\root\Office16\ClientTelemetry.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [125]
AlternateDataStreams: C:\Users\Marty1946\Documents\MaryKsht1.jpeg:3or4kl4x13tuuug3Byamue2s4b [83]
AlternateDataStreams: C:\Users\Marty1946\Documents\Maryksht2.jpeg:3or4kl4x13tuuug3Byamue2s4b [83]
AlternateDataStreams: C:\Users\Marty1946\Documents\Maryksht3.jpeg:3or4kl4x13tuuug3Byamue2s4b [83]
AlternateDataStreams: C:\Users\Marty1946\Documents\Onions.jpeg:3or4kl4x13tuuug3Byamue2s4b [83]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\1001movie.com -> 1001movie.com

There are 6091 more sites.

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2017-08-30 05:43 - 000000029 _____ C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1       localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1849213592-940515303-484074275-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Marty1946\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\signature01.jpg
DNS Servers: 75.75.76.76 - 75.75.75.75
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Prompt)
Windows Firewall is disabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\…\StartupApproved\StartupFolder: => "Acer Remote.lnk"
HKLM\…\StartupApproved\Run: => "HotKeysCmds"
HKLM\…\StartupApproved\Run: => "Persistence"
HKLM\…\StartupApproved\Run32: => "Norton Online Backup"
HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\StartupApproved\StartupFolder: => "Facebook Gameroom.lnk"
HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\StartupApproved\StartupFolder: => "Logitech . Product Registration.lnk"
HKU\S-1-5-21-1849213592-940515303-484074275-1001\…\StartupApproved\Run: => "CCleaner Monitoring"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{B67C23A5-899B-4E88-B724-F41789B4BC74}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{7F1AE06D-D2AE-4203-8DCC-D344C0C4F102}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{469FA887-2442-4D20-8EEF-7A0D37B1F9DA}] => (Allow) c:\program files (x86)\pc-faxreceive\brengineprocess.exe
FirewallRules: [{4AA496E8-E8D7-46CC-B46F-0EA74AF65F4C}] => (Allow) c:\program files (x86)\pc-faxreceive\brengineprocess.exe
FirewallRules: [{01D1A950-EFB9-4857-8AA8-03ED88E871DE}] => (Allow) LPort=54925
FirewallRules: [{8253489E-4ADF-4A79-92BD-5037634D86AA}] => (Allow) E:\Install\wlan_wiz\.\wlan_assistant\waw.exe
FirewallRules: [{0E501789-9A27-49C2-A49A-DB08FECA7F4D}] => (Allow) C:\Users\Marty1946\Desktop\install\wlan_wiz\.\wlan_assistant\waw.exe
FirewallRules: [{43AD579C-30A9-4595-A8E3-DB13EC4544CD}] => (Allow) C:\Program Files (x86)\Nero\Nero 12\Nero BackItUp\BackItUp.exe
FirewallRules: [{A9670390-2F3E-442F-BBEC-A6A0824AF48F}] => (Allow) C:\Program Files (x86)\Nero\Nero 12\Nero BackItUp\BackItUp.exe
FirewallRules: [UDP Query User{3EC10814-62BC-45C0-AE85-6983BE5965CB}C:\program files (x86)\acer remote\arcserver.exe] => (Allow) C:\program files (x86)\acer remote\arcserver.exe
FirewallRules: [TCP Query User{F041E4B6-B2E1-476C-A160-2B51D5145247}C:\program files (x86)\acer remote\arcserver.exe] => (Allow) C:\program files (x86)\acer remote\arcserver.exe
FirewallRules: [{30B94D1F-42F9-416D-A903-86A4B4BA2F49}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{53A1E0D2-57A5-46C1-AF03-B6FC590B5E7E}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{B95BC9F1-113D-408C-86DE-0B24E1475CE4}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{3A03E5D5-C987-4741-A95F-423AE5735110}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{1A01346F-2170-4807-A7A3-CD8F0318C698}] => (Allow) C:\Program Files (x86)\Acer Remote\ArcServer.exe
FirewallRules: [{C1875871-1B07-44CB-9735-F2A90F068693}] => (Allow) C:\Program Files (x86)\Acer Remote\ArcServer.exe
FirewallRules: [{30F29B0F-1CB4-4101-AB16-1207BD571DA1}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{E3BBAC9F-F919-4433-8DC3-B11C4E9E21F2}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{11225F6A-715B-4DCE-8750-29062E3AA961}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{1E717365-51F3-43A7-BEEF-FD7F5CDBC74B}] => (Allow) C:\Program Files (x86)\Nero\Nero 12\Nero BackItUp\BackItUp.exe
FirewallRules: [{A72B66C7-20AE-4DC8-9E48-A84F747673EA}] => (Allow) C:\Program Files (x86)\Nero\Nero 12\Nero BackItUp\BackItUp.exe
FirewallRules: [{0E86CC71-AC4F-41BD-B814-278231ACF662}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

17-10-2017 14:42:28 Scheduled Checkpoint
22-10-2017 10:18:55 Windows Update

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (10/25/2017 04:37:19 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\Nuance\PaperPort\CheckPPFolders.exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_26002d27e7c744a2.manifest.

Error: (10/24/2017 09:43:09 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: updater.exe, version: 2.0.3007.0, time stamp: 0x50ff2992
Faulting module name: KERNELBASE.dll, version: 10.0.15063.674, time stamp: 0x93d2100b
Exception code: 0xe0434352
Fault offset: 0x0000000000069e08
Faulting process id: 0x1678
Faulting application start time: 0x01d34cce06f5dd61
Faulting application path: C:\Program Files (x86)\Gateway\Live Updater\updater.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: 30830063-4366-44bc-b3be-415ca32529af
Faulting package full name:
Faulting package-relative application ID:

Error: (10/24/2017 09:43:09 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: updater.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Xml.XmlException
   at System.Xml.XmlTextReaderImpl.Throw(System.Exception)
   at System.Xml.XmlTextReaderImpl.ParseDocumentContent()
   at System.Xml.XmlLoader.Load(System.Xml.XmlDocument, System.Xml.XmlReader, Boolean)
   at System.Xml.XmlDocument.Load(System.Xml.XmlReader)
   at System.Xml.XmlDocument.Load(System.String)
   at updater.Report.AddFPToResult(updater.Result)
   at updater.UpgradeItem.DiagnosticDownloadEvent(NotifyMgrArgs)
   at updater.DownloadMgr.DownloadFile(System.String, System.String)
   at updater.DownloadMgr.Worker(System.Object)
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   at System.Threading.ThreadPoolWorkQueue.Dispatch()

Error: (10/24/2017 07:43:09 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: updater.exe, version: 2.0.3007.0, time stamp: 0x50ff2992
Faulting module name: KERNELBASE.dll, version: 10.0.15063.674, time stamp: 0x93d2100b
Exception code: 0xe0434352
Fault offset: 0x0000000000069e08
Faulting process id: 0x2de4
Faulting application start time: 0x01d34cbd439380dc
Faulting application path: C:\Program Files (x86)\Gateway\Live Updater\updater.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: 22013987-3aff-4841-93df-7e86f27af344
Faulting package full name:
Faulting package-relative application ID:

Error: (10/24/2017 07:43:09 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: updater.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Xml.XmlException
   at System.Xml.XmlTextReaderImpl.Throw(System.Exception)
   at System.Xml.XmlTextReaderImpl.ParseDocumentContent()
   at System.Xml.XmlLoader.Load(System.Xml.XmlDocument, System.Xml.XmlReader, Boolean)
   at System.Xml.XmlDocument.Load(System.Xml.XmlReader)
   at System.Xml.XmlDocument.Load(System.String)
   at updater.Report.AddFPToResult(updater.Result)
   at updater.UpgradeItem.DiagnosticDownloadEvent(NotifyMgrArgs)
   at updater.DownloadMgr.DownloadFile(System.String, System.String)
   at updater.DownloadMgr.Worker(System.Object)
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   at System.Threading.ThreadPoolWorkQueue.Dispatch()

Error: (10/24/2017 06:43:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: updater.exe, version: 2.0.3007.0, time stamp: 0x50ff2992
Faulting module name: KERNELBASE.dll, version: 10.0.15063.674, time stamp: 0x93d2100b
Exception code: 0xe0434352
Fault offset: 0x0000000000069e08
Faulting process id: 0x2eec
Faulting application start time: 0x01d34cb4e1cf25f8
Faulting application path: C:\Program Files (x86)\Gateway\Live Updater\updater.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: d9933d77-0ab6-40b5-92cf-960747aae41e
Faulting package full name:
Faulting package-relative application ID:

Error: (10/24/2017 06:43:13 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: updater.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Xml.XmlException
   at System.Xml.XmlTextReaderImpl.Throw(System.Exception)
   at System.Xml.XmlTextReaderImpl.ParseDocumentContent()
   at System.Xml.XmlLoader.Load(System.Xml.XmlDocument, System.Xml.XmlReader, Boolean)
   at System.Xml.XmlDocument.Load(System.Xml.XmlReader)
   at System.Xml.XmlDocument.Load(System.String)
   at updater.Report.AddFPToResult(updater.Result)
   at updater.UpgradeItem.DiagnosticDownloadEvent(NotifyMgrArgs)
   at updater.DownloadMgr.DownloadFile(System.String, System.String)
   at updater.DownloadMgr.Worker(System.Object)
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   at System.Threading.ThreadPoolWorkQueue.Dispatch()

Error: (10/24/2017 06:08:06 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: updater.exe, version: 2.0.3007.0, time stamp: 0x50ff2992
Faulting module name: KERNELBASE.dll, version: 10.0.15063.674, time stamp: 0x93d2100b
Exception code: 0xe0434352
Fault offset: 0x0000000000069e08
Faulting process id: 0x1f64
Faulting application start time: 0x01d34caffc827990
Faulting application path: C:\Program Files (x86)\Gateway\Live Updater\updater.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: c8b939d7-c3ef-4c66-adda-4ba86d780a89
Faulting package full name:
Faulting package-relative application ID:

Error: (10/24/2017 06:08:06 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: updater.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Xml.XmlException
   at System.Xml.XmlTextReaderImpl.Throw(System.Exception)
   at System.Xml.XmlTextReaderImpl.ParseDocumentContent()
   at System.Xml.XmlLoader.Load(System.Xml.XmlDocument, System.Xml.XmlReader, Boolean)
   at System.Xml.XmlDocument.Load(System.Xml.XmlReader)
   at System.Xml.XmlDocument.Load(System.String)
   at updater.Report.AddFPToResult(updater.Result)
   at updater.UpgradeItem.DiagnosticDownloadEvent(NotifyMgrArgs)
   at updater.DownloadMgr.DownloadFile(System.String, System.String)
   at updater.DownloadMgr.Worker(System.Object)
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   at System.Threading.ThreadPoolWorkQueue.Dispatch()

Error: (10/24/2017 05:08:06 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: updater.exe, version: 2.0.3007.0, time stamp: 0x50ff2992
Faulting module name: KERNELBASE.dll, version: 10.0.15063.674, time stamp: 0x93d2100b
Exception code: 0xe0434352
Fault offset: 0x0000000000069e08
Faulting process id: 0xbf4
Faulting application start time: 0x01d34ca79abe1297
Faulting application path: C:\Program Files (x86)\Gateway\Live Updater\updater.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: 5746e6c9-5cb3-46fb-ad72-77f3193ed9e3
Faulting package full name:
Faulting package-relative application ID:

System errors:
=============
Error: (10/25/2017 04:24:02 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (10/25/2017 02:19:26 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (10/25/2017 01:35:30 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (10/24/2017 04:24:02 PM) (Source: DCOM) (EventID: 10016) (User: DICK-CAROL)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user Dick-Carol\Marty1946 SID (S-1-5-21-1849213592-940515303-484074275-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/24/2017 04:24:02 PM) (Source: DCOM) (EventID: 10016) (User: DICK-CAROL)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user Dick-Carol\Marty1946 SID (S-1-5-21-1849213592-940515303-484074275-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/24/2017 04:24:02 PM) (Source: DCOM) (EventID: 10016) (User: DICK-CAROL)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user Dick-Carol\Marty1946 SID (S-1-5-21-1849213592-940515303-484074275-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.

Error: (10/24/2017 06:27:27 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The CldFlt service failed to start due to the following error:
The request is not supported.

Error: (10/23/2017 02:52:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The CldFlt service failed to start due to the following error:
The request is not supported.

Error: (10/23/2017 02:52:45 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 2:47:54 PM on ‎10/‎23/‎2017 was unexpected.

Error: (10/22/2017 09:45:42 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The CldFlt service failed to start due to the following error:
The request is not supported.

CodeIntegrity:
===================================
  Date: 2017-10-24 17:41:47.063
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-10-22 10:39:45.829
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-10-20 16:18:27.155
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-10-19 13:50:08.561
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-10-09 11:19:53.100
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-09-14 09:52:02.625
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-09-10 11:05:11.030
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-09-09 14:05:24.711
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-09-07 16:38:19.936
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-09-01 10:35:09.896
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3-3240 CPU @ 3.40GHz
Percentage of memory in use: 60%
Total physical RAM: 6013.61 MB
Available physical RAM: 2401.14 MB
Total Virtual: 6397.61 MB
Available Virtual: 2314.12 MB

==================== Drives ================================

Drive c: (Gateway) (Fixed) (Total:914 GB) (Free:838.98 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 4F534257)

Partition: GPT.

==================== End of Addition.txt ============================

Version: 8.1.4 (07.09.2017)

Operating System: Windows 10 Pro x64 

Ran by [removed] (Administrator) on 10/25/2017 at 20:23:30.29

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

File System: 6 

 

Successfully deleted: C:\Users\Marty1946\AppData\Local\befrugal (Folder) 

Successfully deleted: C:\Users\Marty1946\AppData\Local\ysearchutil (Folder) 

Successfully deleted: C:\Users\Marty1946\AppData\Roaming\alawarentertainment (Folder) 

Successfully deleted: C:\Users\Marty1946\Desktop\knctr.lnk (Shortcut) 

Successfully deleted: C:\Users\Marty1946\Start Menu\Programs\knctr (Folder) 

Successfully deleted: C:\WINDOWS\system32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 (Task)

 

 

 

Registry: 1 

 

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Search\\SearchAssistant (Registry Value) 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 10/25/2017 at 20:25:27.23

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~