My laptop seemed to be working fine until I started it up last night after a week when I had not used it at all. It was slow to boot taking over ten minutes to do so then when I opened windows explorer to locate a download it took minutes for the page to open. It was also taking minutes to load Firefox.
I restarted the computer and it was behaving the same way and then i started the laptop in safe mode and chose a restore point (think that is what the option was) that seemed to make a slight improvement but not much.
I have tried to run the aswMBR tool but I downloaded it begin the scan then at some point it stops and I get a message screen saying something along the lines "Detected a problem Computer need to restart Driver IRQL not less or equal, there is a reference to www.windows.com and aswMBR.sys failed." Having tried to run the scan twice and getting the same problem I have given up.
I ran a full system scan with Norton the day i had last used the computer with nothing untoward showing up and I have run a malwarebytes scan today and again all clear.
I ran the Farbar tool overiding all sorts of warnings from Norton. I have attached the logs below.
Any help gratefully received.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 12-11-2017 03
Ran by [removed] (administrator) on BYROM (14-11-2017 13:15:17)
Running from C:\Users\[removed]\Downloads
[removed]
Platform: Windows 10 Home Version 1703 15063.608 (X64) Language: English (United Kingdom)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcCMService.exe
(Foxit Software Inc.) C:\Program Files (x86)\FOXIT SOFTWARE\Foxit Reader\FoxitConnectedPDFService.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Reason Software Company Inc.) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\nis.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Acer Cloud Technology) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
(Reason Software Company Inc.) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAEvent.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\nis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerWinMonitor.exe
(Acer) C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
() C:\Program Files (x86)\Acer\abDocs\abDocsDllLoaderMonitor.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\conathst.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\BackgroundTransferHost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
() C:\Windows\ERUNT.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16405744 2015-09-10] (Realtek Semiconductor)
HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [297784 2017-09-11] (Apple Inc.)
HKLM-x32\…\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3567928 2017-11-01] (Dropbox, Inc.)
HKLM Group Policy restriction on software: %programdata%\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.txt*.bat <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.js <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.bat <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.avi*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.gif*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.gif*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.wma*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.wav*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.rar*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.zip*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.js <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.doc*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.js <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.docx*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.pub*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.doc*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.wav*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.gif*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.7z*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.docx*.js <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.com <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.avi*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.pub*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.js <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Appdata\Roaming\Microsoft\Windows\IEUpdate\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.com <==== ATTENTION
HKLM Group Policy restriction on software: %programfiles%\*\svchost.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.rar*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.txt*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.gif*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.docx*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.txt*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.docx*.com <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.divx*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.7z*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.avi*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.divx*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.divx*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.js <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.com <==== ATTENTION
HKLM Group Policy restriction on software: vssadmin.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.txt*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.7z*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.js <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.png*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.com <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.pub*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.divx*.js <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.png*.com <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.xls*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.zip*.js <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.com <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.doc*.js <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.docx*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.doc*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.xls*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.pub*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.wma*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.txt*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.xls*.com <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.doc*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.com <==== ATTENTION
HKLM Group Policy restriction on software: lsassw86s.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.zip*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.com <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.gif*.bat <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.txt*.com <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.png*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.docx*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.txt*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.wma*.exe <==== ATTENTION
HKLM Group Policy restriction on software: ** <==== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.jse <==== ATTENTION
HKLM Group Policy restriction on software: lsassvrtdbks.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.wav*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %systemdrive%\*\svchost.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.com <==== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.wav*.js <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.png*.bat <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.com <==== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.docx*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.com <==== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *:\$Recycle.Bin <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.wma*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.avi*.pif <==== ATTENTION
HKLM Group Policy restriction on software: scsvserv.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.wma*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.wav*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.txt*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.png*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.gif*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.com <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.xls*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.avi*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.rar*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.wma*.com <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.wma*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.wma*.js <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.js <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.doc*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.png*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.divx*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.doc*.scr <==== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.js <==== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.rar*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.com <==== ATTENTION
HKLM Group Policy restriction on software: %programfiles(x86)%\*\svchost.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.zip*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.rar*.js <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.wav*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.png*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.7z*.com <==== ATTENTION
HKLM Group Policy restriction on software: syskey.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.doc*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.7z*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.zip*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.avi*.com <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*\svchost.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.gif*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.7z*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.bat <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.rar*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.pub*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.com <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.xls*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.xls*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.avi*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.gif*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: cipher.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.avi*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.divx*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.zip*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.divx*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.xls*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.pub*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.wav*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.7z*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.com <==== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.zip*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.wav*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.xls*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.scr <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.jse <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.rar*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.divx*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.docx*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.com <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.pub*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.pif <==== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.rar*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.pub*.jse <==== ATTENTION
HKLM Group Policy restriction on software: *.7z*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.zip*.com <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.exe <==== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.bat <==== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.js <==== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.js <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.com <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.bat <==== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.pif <==== ATTENTION
HKLM Group Policy restriction on software: *.png*.cmd <==== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.scr <==== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.exe <==== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.com <==== ATTENTION
HKLM\…\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\Run: [Spotify Web Helper] => C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe [1168896 2014-11-18] (Spotify Ltd)
HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2017-09-18] (Apple Inc.)
HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27716568 2017-05-03] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2017-09-24]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.599\SSScheduler.exe (No File)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2015-12-12]
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{22830295-7ee3-4886-96cd-2f375c572c56}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{5569209a-3193-468a-963d-f7d80881db55}: [DhcpNameServer] 192.168.1.254
Internet Explorer:
==================
HKU\S-1-5-21-1915654789-2150397783-107691372-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1915654789-2150397783-107691372-1001 -> {7F8B64E2-EC23-45AF-B980-5D9C60BCAABD} URL = hxxps://uk.search.yahoo.com/search?fr=mcafee&type;=C014GB0D20150211&p;={searchTerms}
SearchScopes: HKU\S-1-5-21-1915654789-2150397783-107691372-1001 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxps://nortonsafe.search.ask.com/web?q={searchTerms}&o;=APN11913&l;=dis&prt;=NS&chn;=1006090&geo;=GB&ver;=22.10.0.85&locale;=en_GB&guid;=CD412F7E-61D7-49BA-9588-6CB36C4C4FDA&doi;=2016-09-01&gct;=kwd&qsrc;=2869
BHO: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\coIEPlg.dll [2017-10-04] (Symantec Corporation)
BHO-x32: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine32\22.11.0.41\coIEPlg.dll [2017-10-04] (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\coIEPlg.dll [2017-10-04] (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine32\22.11.0.41\coIEPlg.dll [2017-10-04] (Symantec Corporation)
Toolbar: HKU\S-1-5-21-1915654789-2150397783-107691372-1001 -> Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\coIEPlg.dll [2017-10-04] (Symantec Corporation)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\x64\McIEPlg.dll [2016-04-20] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\McIEPlg.dll [2016-04-20] (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\x64\McIEPlg.dll [2016-04-20] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\McIEPlg.dll [2016-04-20] (McAfee, Inc.)
FireFox:
========
FF ProfilePath: C:\Users\norman\AppData\Roaming\Mozilla\Firefox\Profiles\yla8dlub.default-1474364354975 [2017-11-14]
FF Homepage: Mozilla\Firefox\Profiles\yla8dlub.default-1474364354975 -> www.google.com
FF Extension: (Safe Browsing Version 4 (temporary add-on)) - C:\Users\norman\AppData\Roaming\Mozilla\Firefox\Profiles\yla8dlub.default-1474364354975\Extensions\[removed] [2017-11-14]
FF Extension: (Flash and Video Download) - C:\Users\norman\AppData\Roaming\Mozilla\Firefox\Profiles\yla8dlub.default-1474364354975\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}.xpi [2017-11-14]
FF Extension: (Motive Extension) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\[removed] [2015-03-19] [not signed]
FF HKLM\…\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF Extension: (McAfee WebAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2017-08-09]
FF HKLM\…\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.0.124\coFFAddon
FF Extension: (Norton Security Toolbar) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.0.124\coFFAddon [2017-07-19]
FF HKLM-x32\…\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF HKLM-x32\…\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.0.124\coFFAddon
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml [2015-07-09]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_27_0_0_159.dll [2017-10-10] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_159.dll [2017-10-10] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-08-04] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-08-04] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-08-04] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-08-04] (Foxit Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @Motive.com/NpMotive,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotive.dll [2012-10-05] (Alcatel-Lucent)
FF Plugin-x32: @Motive.com/npMotiveRequest,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotiveRequest.dll [2011-12-06] (Alcatel-Lucent)
FF Plugin-x32: @Sibelius.com/Scorch Plugin,version=6.2.0.88 -> C:\Program Files (x86)\Sibelius Software\Scorch\npsibelius.dll [2013-03-11] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-08-06] ()
FF Plugin HKU\S-1-5-21-1915654789-2150397783-107691372-1001: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll [2014-07-10] (Sony Network Entertainment International LLC)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPSibelius.dll [2013-03-11] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\PDFNetC.dll [2010-03-31] (PDFTron Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ScorchAxPlugin.dll [2010-04-08] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ScorchPDFWrapper.dll [2010-04-08] ()
Chrome:
=======
CHR DefaultProfile: Default
CHR DefaultSearchURL: Default -> hxxps://uk.search.yahoo.com/search?fr=mcafee&type;=C214GB0D20150211&p;={searchTerms}
CHR DefaultSearchKeyword: Default -> mcafee
CHR Profile: C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default [2017-11-14]
CHR Extension: (Slides) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-23]
CHR Extension: (Docs) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-23]
CHR Extension: (Google Drive) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-20]
CHR Extension: (YouTube) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-20]
CHR Extension: (Google Search) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-20]
CHR Extension: (Sheets) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-23]
CHR Extension: (McAfee® WebAdvisor) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2017-11-14]
CHR Extension: (Google Docs Offline) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-24]
CHR Extension: (Norton Identity Safe) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2015-03-13]
CHR Extension: (Skype) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-11-14]
CHR Extension: (Chrome Web Store Payments) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-02-13]
CHR Extension: (Gmail) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR Extension: (Chrome Media Router) - C:\Users\norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-11-14]
CHR HKLM\…\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\Exts\Chrome.crx
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-11-2017 03
Ran by [removed] (14-11-2017 13:20:29)
Running from C:\Users\[removed]\Downloads
Windows 10 Home Version 1703 15063.608 (X64) (2017-07-18 11:47:08)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1915654789-2150397783-107691372-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1915654789-2150397783-107691372-503 - Limited - Disabled)
Guest (S-1-5-21-1915654789-2150397783-107691372-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1915654789-2150397783-107691372-1003 - Limited - Enabled)
norman (S-1-5-21-1915654789-2150397783-107691372-1001 - Administrator - Enabled) => C:\Users\norman
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton Internet Security (Enabled - Out of date) {30744133-1E94-7B35-F4A3-82A5AEF1CBAA}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Enabled - Out of date) {8B15A0D7-38AE-74BB-CE13-B9D7D5768117}
FW: Norton Internet Security (Enabled) {084FC016-54FB-7A6D-DFFC-2B9050228CD1}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
abDocs (HKLM-x32\…\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.10.2002 - Acer Incorporated)
abDocs Office AddIn (HKLM-x32\…\{DCBF3379-246B-47E1-8173-639B63940838}) (Version: 3.02.2001 - Acer Incorporated)
abFiles (HKLM-x32\…\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.00.3002 - Acer Incorporated)
abMusic (HKLM-x32\…\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 3.01.2003.6 - Acer Incorporated)
abPhoto (HKLM-x32\…\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 4.00.2001.1 - Acer Incorporated)
Acer Care Center (HKLM\…\{A424844F-CDB3-45E2-BB77-1DDE4A091E76}) (Version: 1.00.3013 - Acer Incorporated)
Acer Explorer Agent (HKLM\…\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3000 - Acer Incorporated)
Acer Launch Manager (HKLM\…\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.8115 - Acer Incorporated)
Acer Portal (HKLM-x32\…\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.12.2004 - Acer Incorporated)
Acer Power Management (HKLM\…\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8105 - Acer Incorporated)
Acer Quick Access (HKLM\…\{C1FA525F-D701-4B31-9D32-504FC0CF0B98}) (Version: 1.01.3016.0 - Acer Incorporated)
Acer Recovery Management (HKLM\…\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.8108 - Acer Incorporated)
Acer User Experience Improvement Program App Monitor Plugin (HKLM\…\{978724F6-1863-4DD5-9E66-FB77F5AB5613}) (Version: 1.02.3005 - Acer Incorporated)
Acer User Experience Improvement Program Framework (HKLM\…\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 1.02.3005 - Acer Incorporated)
Acer Video Player (HKLM-x32\…\{B6846F20-4821-11E3-8F96-0800200C9A66}) (Version: 1.00.2005.0 - Acer Incorporated)
Adobe Flash Player 27 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 27.0.0.159 - Adobe Systems Incorporated)
Aloha TriPeaks (HKLM-x32\…\WTA-c8a8163c-57d4-47f6-968a-4e2034d246cf) (Version: 2.2.0.98 - WildTangent) Hidden
AOP Framework (HKLM-x32\…\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.25.2001.0 - Acer Incorporated)
Apple Application Support (32-bit) (HKLM-x32\…\{3D1290E6-1F77-46D5-A715-A56679C8D4E3}) (Version: 6.0.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\…\{D0E45DEC-F4B9-4370-A9DF-66837789C2EF}) (Version: 6.0.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{E3C4B99B-BE71-4C27-8E3C-4FAE3C46E1D5}) (Version: 11.0.0.30 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{C1BBFD2A-BCDD-45B3-8C0B-66BD434970A8}) (Version: 2.4.8.1 - Apple Inc.)
Audacity 2.0.6 (HKLM-x32\…\Audacity_is1) (Version: 2.0.6 - Audacity Team)
Audacity 2.1.2 (HKLM-x32\…\Audacity®_is1) (Version: 2.1.2 - Audacity Team)
Bejeweled 2 Deluxe (HKLM-x32\…\WTA-e166a577-4513-495a-9dbe-96a72c2ad755) (Version: 2.2.0.95 - WildTangent) Hidden
Bonjour (HKLM\…\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
BT Desktop Help (HKLM-x32\…\BT Desktop Help) (Version: - )
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CryptoPrevent (HKLM-x32\…\{5C5B24E7-4694-4049-A222-CCE7D3FAC63F}_is1) (Version: - Foolish IT LLC)
CyberLink PhotoDirector 3 (HKLM-x32\…\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.4917 - CyberLink Corp.)
CyberLink Power Media Player 12 (HKLM-x32\…\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.4218 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\…\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.4220 - CyberLink Corp.)
Dropbox (HKLM-x32\…\Dropbox) (Version: 38.4.27 - Dropbox, Inc.)
Dropbox Update Helper (HKLM-x32\…\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.59.1 - Dropbox, Inc.) Hidden
eBay Worldwide (HKLM-x32\…\{91589413-6675-4C27-8AFC-EFB9103B90A5}) (Version: 2.4.0105 - OEM)
Farm to Fork Collector's Edition (HKLM-x32\…\WTA-6e4545af-3e2e-4027-a561-d66ae5840bbb) (Version: 3.0.2.59 - WildTangent) Hidden
FastStone Image Viewer 5.3 (HKLM-x32\…\FastStone Image Viewer) (Version: 5.3 - FastStone Soft)
FFmpeg (Windows) for Audacity version 2.2.2 (HKLM-x32\…\{9C7E31E3-017F-434C-AC40-24431A354A1E}_is1) (Version: 2.2.2 - )
Finale NotePad 2012 (HKLM-x32\…\Finale NotePad 2012) (Version: 2012..r1.5 - MakeMusic)
Foxit PhantomPDF (HKLM-x32\…\{2DF18CA8-86F2-4F3A-A1BF-A2A7D39B9161}) (Version: 7.0.49.127 - Foxit Software Inc.)
Foxit Reader (HKLM-x32\…\{2B801EE2-5AFC-11E6-854E-000C29F04684}) (Version: 8.0.2.805 - Foxit Software Inc.)
Game Explorer Categories - genres (HKLM-x32\…\WildTangentGameProvider-acer-genres) (Version: 11.0.0.7 - WildTangent, Inc.)
Game Explorer Categories - main (HKLM-x32\…\WildTangentGameProvider-acer-main) (Version: 11.0.0.7 - WildTangent, Inc.)
GNU Ghostscript 7.06 (HKLM-x32\…\GNU Ghostscript 7.06) (Version: - )
GNU Ghostscript Fonts (HKLM-x32\…\GNU Ghostscript Fonts) (Version: - )
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 61.0.3163.100 - Google Inc.)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (HKLM-x32\…\WTA-76ca1901-3f54-493f-81b5-c79808454dff) (Version: 3.0.2.59 - WildTangent) Hidden
HP Deskjet 2540 series Basic Device Software (HKLM\…\{6A79CD11-0C1C-4E24-A8C6-46A02F680346}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Deskjet 2540 series Help (HKLM-x32\…\{4539575D-C09D-4E71-B207-0F2D6BD74DA2}) (Version: 30.0.0 - Hewlett Packard)
HP Photo Creations (HKLM-x32\…\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Support Solutions Framework (HKLM-x32\…\{00612F78-52C4-46C0-97F0-F50B6036B5E2}) (Version: 12.7.27.15 - HP Inc.)
HP Update (HKLM-x32\…\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticCoreDll (HKLM-x32\…\{9262B08F-E183-4FED-A2BD-23FF1A84EB79}) (Version: 1.0.15.0 - Hewlett Packard)
iCloud (HKLM\…\{7464D896-C63C-412E-8ED3-3261C9F14E21}) (Version: 7.0.1.210 - Apple Inc.)
Intel(R) Control Center (HKLM-x32\…\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
Intel(R) Technology Access (HKLM-x32\…\{413fe921-b226-41c8-bc3c-574074ceec4d}) (Version: 1.4.4.1000 - Intel Corporation)
Intel(R) Technology Access Software Asset Manager (HKLM-x32\…\{22EC308C-6294-4924-9546-56B0B9164593}) (Version: 1.0.1562 - Intel Corporation) Hidden
Intel(R) Trusted Execution Engine (HKLM\…\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\…\{7224B7CE-196C-4E2A-A1AE-1D7BF259FD36}) (Version: 3.4.1942 - Intel Corporation)
iTunes (HKLM\…\{A7186CCF-A94A-4BB3-A38D-DEDC70C66A53}) (Version: 12.7.0.166 - Apple Inc.)
Jewel Match 3 (HKLM-x32\…\WTA-5755ee5c-133b-4207-b4c3-7dbd077d0c8b) (Version: 3.0.2.59 - WildTangent) Hidden
King Oddball (HKLM-x32\…\WTA-238fe9f9-b6cf-4229-ac6c-6d098ab63f37) (Version: 3.0.2.48 - WildTangent) Hidden
Lenovo Moto Smart Assistant (HKLM-x32\…\{C050AF2D-DD41-455E-A65E-628637B4A9CC}) (Version: 3.0.0.6 - Lenovo)
LUXOR Evolved (HKLM-x32\…\WTA-8fa673ea-77d1-4458-9ff7-57255c515186) (Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (HKLM-x32\…\WTA-f0a00875-9924-4842-8297-cd4535da7589) (Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes version 3.2.2.2029 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.2.2.2029 - Malwarebytes)
McAfee Security Scan Plus (HKLM\…\McAfee Security Scan) (Version: 3.11.599.11 - McAfee, Inc.)
McAfee WebAdvisor (HKLM-x32\…\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.0.165 - McAfee, Inc.)
Media Go (HKLM-x32\…\{AF06B8FA-B916-4001-AE51-6645488DEF09}) (Version: 2.8.303 - Sony)
Media Go Network Downloader (HKLM-x32\…\{5562F05F-908C-4F15-9B3C-98D5FD32DCAB}) (Version: 1.5.19.0 - Sony)
Media Go Video Playback Engine 2.12.102.06300 (HKLM-x32\…\{6E69B344-A081-487D-775B-F55A04DAF2E5}) (Version: 2.12.102.06300 - Sony)
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\…\{90850409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\OneDriveSetup.exe) (Version: 17.3.6998.0830 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{d491dd9d-2eda-4d75-b504-1a201436e7fd}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\…\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\…\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\…\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 56.0.2 (x64 en-GB) (HKLM\…\Mozilla Firefox 56.0.2 (x64 en-GB)) (Version: 56.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 56.0.2.6506 - Mozilla)
Node.js (HKLM-x32\…\{433128B8-9F15-4EEE-9A21-BC8EFCFD3EF8}) (Version: 0.10.40 - Joyent, Inc. and other Node contributors)
Norton Internet Security (HKLM-x32\…\NIS) (Version: 22.11.0.41 - Symantec Corporation)
OpenOffice 4.1.3 (HKLM-x32\…\{747C5547-7483-4605-8B2F-A9696610A7FA}) (Version: 4.13.9783 - Apache Software Foundation)
Peggle Nights (HKLM-x32\…\WTA-01303eba-7d07-4a8c-aedd-4bbbc4303cd5) (Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (HKLM-x32\…\WTA-a9ce2a46-b987-410f-b7f7-5c046691c30a) (Version: 3.0.2.59 - WildTangent) Hidden
Polar Bowler 1st Frame (HKLM-x32\…\WTA-bae20991-9609-4614-86db-d2d89ab99842) (Version: 3.0.2.59 - WildTangent) Hidden
Product Improvement Study for HP Deskjet 2540 series (HKLM\…\{DF34643B-A745-430C-B27B-A48F853C81E4}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\…\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.322 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\…\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.33 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.39059 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.33.529.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7606 - Realtek Semiconductor Corp.)
Secunia PSI (3.0.0.11003) (HKLM-x32\…\Secunia PSI) (Version: 3.0.0.11003 - Secunia)
Sibelius Scorch (Firefox, Opera, Netscape, Chrome only) (HKLM-x32\…\{41626CC0-A854-4402-AD06-D7939515C282}) (Version: 6.2.0 - Sibelius Software, a division of Avid Technology, Inc.)
Skype Click to Call (HKLM-x32\…\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype™ 7.36 (HKLM-x32\…\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.36.101 - Skype Technologies S.A.)
Smart View (HKLM-x32\…\{1800D8A5-F7B2-4C20-868E-1CF55CBBDF21}) (Version: 1.0.0.0 - Samsung )
Spotify (HKLM-x32\…\Spotify) (Version: 0.9.6.81.gd359a796 - Spotify AB)
SpywareBlaster 5.5 (HKLM-x32\…\SpywareBlaster_is1) (Version: 5.5.0 - BrightFort LLC)
The Chronicles of Emerland Solitaire (HKLM-x32\…\WTA-384663e7-70fc-4b6e-b0e2-d0e43378bae1) (Version: 3.0.2.51 - WildTangent) Hidden
Trinklit Supreme (HKLM-x32\…\WTA-de98649c-aca3-431a-b8f8-21431f7f8089) (Version: 2.2.0.98 - WildTangent) Hidden
Unchecky v1.1 (HKLM-x32\…\Unchecky) (Version: 1.1 - Reason Software Company Inc.)
Update Installer for WildTangent Games App (HKLM-x32\…\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version: - WildTangent) Hidden
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.6 - VideoLAN)
WavePad Sound Editor (HKLM-x32\…\WavePad) (Version: 6.18 - NCH Software)
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HKLM-x32\…\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-acer) (Version: 4.0.11.13 - WildTangent) Hidden
Windows 10 Update and Privacy Settings (HKLM\…\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation)
Zuma's Revenge (HKLM-x32\…\WTA-fddc3f7a-8382-4eae-b627-1cde9b7049bb) (Version: 2.2.0.97 - WildTangent) Hidden
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1915654789-2150397783-107691372-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-1915654789-2150397783-107691372-1001_Classes\CLSID\{DAE467D6-5C66-404A-BD99-4AC8261A733A}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\buShell.dll [2017-10-04] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\buShell.dll [2017-10-04] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\buShell.dll [2017-10-04] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-09-09] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-09-09] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-09-09] (Acer Incorporated)
ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\buShell.dll [2017-10-04] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\buShell.dll [2017-10-04] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\buShell.dll [2017-10-04] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-09-09] (Acer Incorporated)
ShellIconOverlayIdentifiers-x32: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-09-09] (Acer Incorporated)
ShellIconOverlayIdentifiers-x32: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-09-09] (Acer Incorporated)
ContextMenuHandlers1: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\buShell.dll [2017-10-04] (Symantec Corporation)
ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ContextMenuHandlers1: [Foxit_ConvertToPDF] -> {C5269811-4A29-4818-A4BB-111F9FC63A5F} => C:\Program Files (x86)\Foxit PhantomPDF\plugins\ConvertToPDFShellExtension_x64.dll [2015-01-27] (Foxit Software Inc.)
ContextMenuHandlers1: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2016-08-05] (Foxit Software Inc.)
ContextMenuHandlers1: [PhotoStreamsExt] -> {89D984B3-813B-406A-8298-118AFA3A22AE} => C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll [2017-09-18] (Apple Inc.)
ContextMenuHandlers1: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\NavShExt.dll [2017-10-04] (Symantec Corporation)
ContextMenuHandlers2: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\NavShExt.dll [2017-10-04] (Symantec Corporation)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes)
ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-11-01] (Dropbox, Inc.)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2015-10-15] (Intel Corporation)
ContextMenuHandlers5: [igfxOSP] -> {FA507C3F-30C6-4DCA-9EE5-2656072EEC14} => C:\WINDOWS\system32\igfxOSP.dll [2015-10-15] (Intel Corporation)
ContextMenuHandlers6: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\buShell.dll [2017-10-04] (Symantec Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes)
ContextMenuHandlers6: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\NavShExt.dll [2017-10-04] (Symantec Corporation)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {01DE5A00-B56F-4265-8BD1-B7E18D829C11} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {05BDC1C3-EDD4-4069-B93F-A03FA6BB8E39} - \Microsoft\Windows\Shell\FamilySafetyUpload -> No File <==== ATTENTION
Task: {08C282D0-5F02-4635-91FD-AA908E475823} - \Microsoft\Windows\WindowsUpdate\AUSessionConnect -> No File <==== ATTENTION
Task: {0A219F8A-FEBC-4DF2-9E43-AD26C38135D2} - \GoogleUpdateTaskMachineUA -> No File <==== ATTENTION
Task: {0C44A4D8-5EDB-444B-9FA7-5C11A5F307B2} - \ACC -> No File <==== ATTENTION
Task: {0D9856D4-0F42-44BE-A3DD-87F0372FC50C} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe
Task: {1126DA71-FBBA-4BE2-ADBE-A70AE662CA51} - \Microsoft\Windows\WindowsUpdate\AUScheduledInstall -> No File <==== ATTENTION
Task: {16297C68-5C4D-4251-B488-16B6E1EC9AE3} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {1A4230A2-E136-4936-9B22-DDF624BB8332} - \Microsoft\Windows\IME\SQM data sender -> No File <==== ATTENTION
Task: {1AA0870C-9917-48C8-B062-22B3A1FDB744} - \Microsoft\Windows\WindowsUpdate\AUFirmwareInstall -> No File <==== ATTENTION
Task: {1C0A4D80-590A-4486-8FC9-C6E4792ED44F} - \WPD\SqmUpload_S-1-5-21-1915654789-2150397783-107691372-1001 -> No File <==== ATTENTION
Task: {26017BFB-4F6C-4228-BD0A-E1FD8088A606} - \Recovery Management\Notification -> No File <==== ATTENTION
Task: {2E71FB31-10AA-48F6-9DF8-4D1EE12FAD91} - System32\Tasks\Norton Internet Security\Norton Internet Security Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\SymErr.exe [2017-10-04] (Symantec Corporation)
Task: {2EFC0DD6-E667-466A-8D4F-086BF1CC040E} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - \Microsoft\Windows\Workplace Join\Automatic-Workplace-Join -> No File <==== ATTENTION
Task: {3B2A3370-6FCA-4A12-8FC7-9A522A8DE273} - \Adobe Flash Player Updater -> No File <==== ATTENTION
Task: {3C2BF58F-B2F5-4360-9CC6-674E7DD41CD1} - \Launch Manager -> No File <==== ATTENTION
Task: {429E2EAE-A977-4CC0-9456-53E8DF825F6F} - \ACCAgent -> No File <==== ATTENTION
Task: {4520E8A9-AF06-4122-859B-E4B655B29B36} - \Microsoft\Windows\AppID\SmartScreenSpecific -> No File <==== ATTENTION
Task: {4635395E-DBD1-44A0-9318-C5DC9EE66F15} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {4B6FA5C7-0309-4025-AE19-1E0F53CB34FA} - \Microsoft\XblGameSave\XblGameSaveTaskLogon -> No File <==== ATTENTION
Task: {4D07B260-813A-4805-BCA2-911A66DD2741} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-07-24] (Apple Inc.)
Task: {4EB5D3C7-A1EE-434D-B3B2-0BEA3D97B04E} - \IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon -> No File <==== ATTENTION
Task: {4FEC8BD0-B44C-44C8-BA8D-329DC033D6C2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-12-06] (HP Inc.)
Task: {50A3FAD8-034B-4B95-90DA-863424D527F2} - \IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 -> No File <==== ATTENTION
Task: {51B7FB15-4DCB-400E-9A98-10E802F21FB3} - \Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceScreenOnOff -> No File <==== ATTENTION
Task: {5245681C-FA42-443C-9A0D-6A359841A22F} - \AcerCloud -> No File <==== ATTENTION
Task: {5482819A-7043-4E6F-ACBC-8D42034EFFE2} - \Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler -> No File <==== ATTENTION
Task: {57968F05-9358-4353-BB68-B549D8DF331F} - \Quick Access -> No File <==== ATTENTION
Task: {5A3FB241-0B11-4EA5-BC66-0D9F1B406040} - \Microsoft\Windows\Customer Experience Improvement Program\BthSQM -> No File <==== ATTENTION
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - \Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task -> No File <==== ATTENTION
Task: {708458CA-9827-401F-A9CB-E4F153D2B4F5} - \DropboxUpdateTaskMachineUA -> No File <==== ATTENTION
Task: {731A9923-4C7D-45A2-8CA3-A7320216E1A2} - System32\Tasks\Norton Internet Security\Norton Internet Security Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\SymErr.exe [2017-10-04] (Symantec Corporation)
Task: {74776178-B2E3-4DAC-AB18-17B2110EDE51} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {86BB18D0-8E2A-4B8A-94FB-650491D63458} - \Software Update Application -> No File <==== ATTENTION
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - \Microsoft\Windows\SkyDrive\Routine Maintenance Task -> No File <==== ATTENTION
Task: {8CE4271C-F465-42F0-A0EB-B0A72B454265} - \HP AR Program Upload - 319cf843882d49058f06033fceef7c90b45fe5069e4d4e5c8f359f732fef5b10 -> No File <==== ATTENTION
Task: {9B225D04-7D76-435D-8AA5-56B887B0C34C} - \UbtFrameworkService -> No File <==== ATTENTION
Task: {A255D1D8-03AB-4DC0-83E0-73187149A1D8} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {A31B82EF-A069-4CBD-A0E3-0D9210F3BF29} - \Microsoft\Windows\RemovalTools\MRT_HB -> No File <==== ATTENTION
Task: {A42A157B-D8F4-4F7B-A10C-99BF341473BA} - \Microsoft\Windows\WindowsUpdate\Scheduled Start With Network -> No File <==== ATTENTION
Task: {A62F6A29-1F1E-41EF-95FF-E8632C03294C} - \IntelTA-Upgrade-56460984-97c2-4bc7-a632-d776cf817f5d -> No File <==== ATTENTION
Task: {AAA8F286-EAF8-49CE-A5E3-C72BFEF1FD60} - \Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report -> No File <==== ATTENTION
Task: {ABDC80C3-8B2A-43DF-A7A1-29FA67AAA9DF} - \Power Management -> No File <==== ATTENTION
Task: {ABE327E8-4A04-499B-8E0C-9F2E44746A9A} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [2017-09-26] (Acer Incorporated)
Task: {B320E058-C6FA-413F-876B-0C9B4428AE66} - \Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePeriodic6 -> No File <==== ATTENTION
Task: {B3A411F1-AF60-4C4E-86D7-27B07B10C5C6} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {B749277D-EA4A-4FE5-9F6D-33431F03618D} - \IntelTA-Upgrade-56460984-97c2-4bc7-a632-d776cf817f5d-Logon -> No File <==== ATTENTION
Task: {C1266EED-3265-4C4E-9C13-C84E925D009D} - \Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval -> No File <==== ATTENTION
Task: {C1E7EF11-855B-432E-AC76-667261A842E5} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {C26D4AE3-0AC8-4012-9B8E-A63D8D616A4B} - \Optimize Start Menu Cache Files-S-1-5-21-1915654789-2150397783-107691372-1001 -> No File <==== ATTENTION
Task: {C3979B07-1708-4E58-B603-08ECDD6F2F9A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\WSCStub.exe [2017-10-04] (Symantec Corporation)
Task: {C6B2579B-4962-4D12-883D-BBD420573A6C} - \Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePeriodic1 -> No File <==== ATTENTION
Task: {C9ACBFD2-20AA-4A3F-BE1A-A3D5279BB1BB} - \Microsoft\Windows\Plug and Play\Plug and Play Cleanup -> No File <==== ATTENTION
Task: {CA0A2EF5-92F4-4068-85C0-AA026E168746} - \GoogleUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {CB192E9C-DD61-46B2-B810-7DE05C0E783C} - \DropboxUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {CE2DE968-E342-40D7-9566-427D45E4A886} - \Microsoft\Windows\PerfTrack\BackgroundConfigSurveyor -> No File <==== ATTENTION
Task: {D19A2726-897E-4F7D-9CE4-0773B449CE9E} - \Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceConnectedToNetwork -> No File <==== ATTENTION
Task: {D1CDD847-829F-4BC4-9A38-71D5A31C0C9A} - System32\Tasks\abDocsDllLoader => C:\Program Files (x86)\Acer\abDocs\abDocsDllLoaderMonitor.exe [2017-09-28] ()
Task: {D3FCBC92-9CE6-4EB9-9468-B259B4842F35} - \Optimize Start Menu Cache Files-S-1-5-21-1915654789-2150397783-107691372-500 -> No File <==== ATTENTION
Task: {D67278F1-3BAA-48CD-8700-373353C7D003} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {E14AA0AA-2076-4228-A8B1-F268A3B107F9} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {E3383368-92E4-4D89-AD9A-77F47B0A5451} - \Microsoft\Windows\ErrorDetails\EnableErrorDetailsUpdate -> No File <==== ATTENTION
Task: {E3CC383A-EAB6-4D47-8A8E-3E11D9F6FC39} - \Microsoft\Windows\ErrorDetails\ErrorDetailsUpdate -> No File <==== ATTENTION
Task: {E568D2F3-7DAF-48D9-B672-4D2341CFF1C2} - \Quick Access Quick Launcher -> No File <==== ATTENTION
Task: {EA05D8A2-BE4E-40AD-827F-0E503A0175E4} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {F5561FD6-1494-48D6-BF2E-7833E5AE99E0} - \HPCustParticipation HP Deskjet 2540 series -> No File <==== ATTENTION
Task: {F8EC28CB-A5E6-4903-AB53-C7361EDB9E6B} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {FB621626-CBFC-4A30-8481-AC99C7D26BEC} - System32\Tasks\Norton Internet Security\Norton Internet Security Autofix => C:\Program Files (x86)\Norton Internet Security\Engine\22.11.0.41\SymErr.exe [2017-10-04] (Symantec Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
Shortcut: C:\Users\norman\Music\Extras\Adobe Reader Download.lnk -> hxxp://get.adobe.com/reader
Shortcut: C:\Users\norman\Favorites\NCH Software Download Site.lnk -> hxxp://www.nch.com.au/index.htm
ShortcutWithArgument: C:\Users\norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js command prompt.lnk -> C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation) -> /k "C:\Program Files (x86)\nodejs\nodevars.bat"
ShortcutWithArgument: C:\Users\Public\Desktop\Dropbox.lnk -> C:\Program Files\Dropbox\StartURL.exe () -> hxxps://www.dropbox.com/partners/acer2014/download
==================== Loaded Modules (Whitelisted) ==============
2016-09-01 17:12 - 2016-09-01 17:12 - 000092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-09-01 01:49 - 2017-09-01 01:49 - 001356088 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-07-25 09:34 - 2012-04-24 10:43 - 000254512 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2017-09-21 12:48 - 2017-08-24 10:27 - 002264528 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2017-03-18 20:58 - 2017-03-18 20:58 - 000138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-03-18 20:59 - 2017-03-20 03:43 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-09-28 17:21 - 2017-09-28 17:21 - 001769312 _____ () C:\Program Files (x86)\Acer\abDocs\abDocsDllLoaderMonitor.exe
2015-12-05 10:24 - 2015-11-20 19:40 - 000157696 _____ () C:\Windows\ERUNT.exe
2016-09-09 09:51 - 2016-09-09 09:51 - 000202456 _____ () C:\Program Files (x86)\Acer\Acer Portal\curllib.dll
2016-09-09 09:51 - 2016-09-09 09:51 - 000119000 _____ () C:\Program Files (x86)\Acer\Acer Portal\OpenLDAP.dll
2017-09-22 15:14 - 2017-09-22 15:14 - 000202528 _____ () C:\Program Files (x86)\Acer\abPhoto\curllib.dll
2017-09-22 15:17 - 2017-09-22 15:17 - 000641312 _____ () C:\Program Files (x86)\Acer\abPhoto\tag.dll
2017-09-22 15:17 - 2017-09-22 15:17 - 000654072 _____ () C:\Program Files (x86)\Acer\abPhoto\sqlite3.dll
2017-09-22 15:16 - 2017-09-22 15:16 - 000119072 _____ () C:\Program Files (x86)\Acer\abPhoto\OpenLDAP.dll
2017-11-14 11:22 - 2017-11-14 11:22 - 000015136 _____ () C:\WINDOWS\assembly\GAC_MSIL\MyService\1.0.0.1__2dfa3f50f0bed57d\MyService.dll
2017-09-26 12:35 - 2017-09-26 12:35 - 000013088 _____ () C:\Program Files (x86)\Acer\AOP Framework\ServiceInterface.dll
2017-09-26 12:34 - 2017-09-26 12:34 - 000277856 _____ () C:\Program Files (x86)\Acer\AOP Framework\libcurl.dll
2017-09-01 01:49 - 2017-09-01 01:49 - 001042232 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2017-09-01 01:49 - 2017-09-01 01:49 - 000189752 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll
2016-09-01 17:13 - 2016-09-01 17:13 - 000080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [125]
AlternateDataStreams: C:\Users\norman\Documents\choirphoto_cr.png:com.dropbox.attributes [412]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iaioi2ce.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
HKLM\…\.scr: CryptoPreventSCR => "C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.CryptoPreventEXEC" "%1" /S %*
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\1001movie.com -> 1001movie.com
There are 6091 more sites.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 13:25 - 2017-11-14 12:48 - 000002131 _____ C:\WINDOWS\system32\Drivers\etc\hosts
0.0.0.1 mssplus.mcafee.com
0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 rp.yefeneri2.com
0.0.0.0 os.yefeneri2.com
0.0.0.0 os2.yefeneri2.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1915654789-2150397783-107691372-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\acer01.jpg
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
HKLM\…\StartupApproved\Run: => "iTunesHelper"
HKLM\…\StartupApproved\Run32: => "abDocsDllLoader"
HKLM\…\StartupApproved\Run32: => "Dropbox"
HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\StartupApproved\Run: => "AcerPortal"
HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-1915654789-2150397783-107691372-1001\…\StartupApproved\Run: => "Spotify Web Helper"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{41D64A43-631A-42F6-9D09-81DA960F749E}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS7E00\HPDiagnosticCoreUI.exe
FirewallRules: [{11FC3415-2167-45BE-8FB9-C2F4690257FF}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS7E00\HPDiagnosticCoreUI.exe
FirewallRules: [{CC48ACE3-F41C-4B83-AD04-1CE4FC315E69}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS716C\HPDiagnosticCoreUI.exe
FirewallRules: [{89167C8E-E9E9-4B35-B77F-A2B4E7A6CED6}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS716C\HPDiagnosticCoreUI.exe
FirewallRules: [{4CCA212C-E669-474D-B7C2-0A77BE4C2150}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS6E56\HPDiagnosticCoreUI.exe
FirewallRules: [{1F262C3E-10CF-47F7-940B-5914BB090961}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS6E56\HPDiagnosticCoreUI.exe
FirewallRules: [{B7CBBBAB-1698-4E40-8429-C97105E0CA94}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS65F8\HPDiagnosticCoreUI.exe
FirewallRules: [{21B5AB7D-DC11-4924-A455-7D13A66089FC}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS65F8\HPDiagnosticCoreUI.exe
FirewallRules: [{D416B230-163A-4C87-9462-CA955042407C}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS1A70\HPDiagnosticCoreUI.exe
FirewallRules: [{E9BA39A1-A3DB-4B99-BCC1-20DBA69C51C4}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS1A70\HPDiagnosticCoreUI.exe
FirewallRules: [{20949271-08D4-44A9-9E28-2766C4115631}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS17E7\HPDiagnosticCoreUI.exe
FirewallRules: [{683A0B96-DE3B-4027-9C28-046B7E5D80E1}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS17E7\HPDiagnosticCoreUI.exe
FirewallRules: [{C7629819-C316-47B7-9DCD-8B509264D4D8}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0B7D\HPDiagnosticCoreUI.exe
FirewallRules: [{BA40B649-5B49-49A1-BD81-1F78CB721DAA}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0B7D\HPDiagnosticCoreUI.exe
FirewallRules: [{BE97673B-87AA-40E5-8094-CB2980BA33BA}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS05A2\HPDiagnosticCoreUI.exe
FirewallRules: [{E82D2C3B-DF53-457F-9DAE-02745972F000}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS05A2\HPDiagnosticCoreUI.exe
FirewallRules: [{ED989C5E-BCA9-4944-AB89-F6245C75379B}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS03A8\HPDiagnosticCoreUI.exe
FirewallRules: [{A9762289-A76E-4DC9-A967-937ECB48D57C}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS03A8\HPDiagnosticCoreUI.exe
FirewallRules: [{6982BAFC-E9A8-42BC-AA7E-F577E04F9A5A}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0C4D\HPDiagnosticCoreUI.exe
FirewallRules: [{999E45F2-7D0A-4FFA-B184-DD167AFA53BA}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0C4D\HPDiagnosticCoreUI.exe
FirewallRules: [{9810D61E-2263-4CB5-B208-0E60E43397A0}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS197D\HPDiagnosticCoreUI.exe
FirewallRules: [{C3C71C76-150F-458D-AE17-A5A168B91AAC}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS197D\HPDiagnosticCoreUI.exe
FirewallRules: [{B5ADF4C0-7120-4B79-A8B5-D023F1724A22}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS6AA5\HPDiagnosticCoreUI.exe
FirewallRules: [{6FD2B893-CB65-41BA-9990-AF665B99DF17}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS6AA5\HPDiagnosticCoreUI.exe
FirewallRules: [{EC9B692F-33DD-4731-9807-6C14DEEE1557}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS6391\HPDiagnosticCoreUI.exe
FirewallRules: [{2F211197-BC6F-48F0-AF6F-CF9D104D2A6E}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS6391\HPDiagnosticCoreUI.exe
FirewallRules: [{2CFD150C-9EA7-4DFA-96FE-2AAA1C4E5998}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS5F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{8EAE4343-4D6C-4EB2-9457-73D422310A93}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS5F8C\HPDiagnosticCoreUI.exe
FirewallRules: [{AB84EBE7-136F-49BF-A506-C76E750E5ACD}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0DA9\HPDiagnosticCoreUI.exe
FirewallRules: [{A790D630-2EA2-4C5D-90A3-EBC529203F7A}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0DA9\HPDiagnosticCoreUI.exe
FirewallRules: [{1A408225-6E6E-4DFA-ACC8-AA7F4B7ED217}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0871\HPDiagnosticCoreUI.exe
FirewallRules: [{01763F6B-4CD3-4F53-8C60-E7797B347AB6}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0871\HPDiagnosticCoreUI.exe
FirewallRules: [{B230A298-AEAC-4D46-9F1B-7F51F412EE0A}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0460\HPDiagnosticCoreUI.exe
FirewallRules: [{B04EEDE7-3E74-4A73-90C2-C86F45AF1171}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0460\HPDiagnosticCoreUI.exe
FirewallRules: [{7431D5E9-4CD9-4F7C-8070-EE260A6B027B}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS003A\HPDiagnosticCoreUI.exe
FirewallRules: [{29B94627-A2AE-498A-99EB-EE07DCE7E13D}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS003A\HPDiagnosticCoreUI.exe
FirewallRules: [{5F35AFB3-59E4-4CD3-92A5-B63D9183EFF6}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS7FC5\HPDiagnosticCoreUI.exe
FirewallRules: [{5B397546-0DCC-493B-9A66-BBF47A54419B}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS7FC5\HPDiagnosticCoreUI.exe
FirewallRules: [{E8861D4C-4A3A-41D3-98FA-48C37298768A}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS210C\HPDiagnosticCoreUI.exe
FirewallRules: [{318AE1B0-C25E-4FED-88E6-4E3CB0D1BB8B}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS210C\HPDiagnosticCoreUI.exe
FirewallRules: [{6F1D7548-7DA5-426C-A9AF-65C64E7AC802}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS1F7A\HPDiagnosticCoreUI.exe
FirewallRules: [{2690C97D-AAC3-4847-994A-91B8D9ECCBB6}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS1F7A\HPDiagnosticCoreUI.exe
FirewallRules: [{16F3011F-406F-4D08-B9AE-973157D4803F}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS3689\HPDiagnosticCoreUI.exe
FirewallRules: [{00163FBC-7B74-4BBE-ABFF-421110B4FE8A}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS3689\HPDiagnosticCoreUI.exe
FirewallRules: [{0191B109-27A6-45E5-B53E-B588D190035B}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS29B0\HPDiagnosticCoreUI.exe
FirewallRules: [{7DFBBADB-38B5-4865-A263-95AC505DAD25}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS29B0\HPDiagnosticCoreUI.exe
FirewallRules: [{908A2E24-FEFE-4B92-AF70-250506F278C8}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS26B1\HPDiagnosticCoreUI.exe
FirewallRules: [{14743E54-A718-460D-AC35-B531B3C80996}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS26B1\HPDiagnosticCoreUI.exe
FirewallRules: [{2C7EDABA-550F-4EFC-922A-78845A7BB1B6}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS64EA\HPDiagnosticCoreUI.exe
FirewallRules: [{63A19F26-5D40-4E3C-B5FB-7ADFE7A34559}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS64EA\HPDiagnosticCoreUI.exe
FirewallRules: [{D258C030-14F4-460A-96A2-BF2F37DD73F0}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS5465\HPDiagnosticCoreUI.exe
FirewallRules: [{20222F53-ADAA-429C-9438-C8B4BC8C8C71}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS5465\HPDiagnosticCoreUI.exe
FirewallRules: [{EC2C7F37-FEBB-4B4E-B950-DA506824CC81}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS4E1B\HPDiagnosticCoreUI.exe
FirewallRules: [{8002D2D4-82A2-4EB1-8B51-D6875185B96B}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS4E1B\HPDiagnosticCoreUI.exe
FirewallRules: [{AC5CEB3B-D864-4E36-9F65-6450A14D04B9}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS3191\HPDiagnosticCoreUI.exe
FirewallRules: [{2894E249-9944-48CE-90F0-F2DF16C7A9C9}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS3191\HPDiagnosticCoreUI.exe
FirewallRules: [{2C6F412F-1823-4E9A-8604-DEAA2CABC1EC}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS3129\HPDiagnosticCoreUI.exe
FirewallRules: [{9B51B56F-7B25-4CC3-A6AA-591174D5B3EF}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS3129\HPDiagnosticCoreUI.exe
FirewallRules: [{ED47DFE9-A40B-48F4-9C3E-3686B784893F}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{A4807927-9616-4382-877B-9A3AED46D30F}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{B73C11F6-0AA9-4143-81E2-D57F0932F183}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{248DCF0F-1860-4A3C-9B7D-ABA7182265BF}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{EE7B7AEC-1F62-4C24-A028-EB8909C3379B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{18B6D780-A891-4DD0-A6EA-52670895E857}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4A346D23-165E-4B3B-8BBB-133BDED0DB74}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{BCD3DC30-AF46-4022-A367-6705B1C2DCAD}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{8D5A07B4-E04F-4AD5-B3CF-033A50BE6DF9}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{2BE887BD-FDF5-4D43-9812-AAAF08B9701A}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{D026E200-7AE7-4D00-B4E7-168FF7B43A62}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS2AD4\HPDiagnosticCoreUI.exe
FirewallRules: [{E9EC786F-4710-4829-A410-568F77254F02}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS2AD4\HPDiagnosticCoreUI.exe
FirewallRules: [{3906562C-C414-4385-822D-C261E77900A6}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS05F0\HPDiagnosticCoreUI.exe
FirewallRules: [{98CF026F-51EF-4DB7-B766-26ABAF252FB5}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS05F0\HPDiagnosticCoreUI.exe
FirewallRules: [{927D350C-9333-454F-8F14-3A511B392FE4}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS05A4\HPDiagnosticCoreUI.exe
FirewallRules: [{726CF334-C7AE-43EE-AF5F-972D6B31C96F}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS05A4\HPDiagnosticCoreUI.exe
FirewallRules: [{1077BFB3-6DEB-4487-84F7-87DDD818A5B0}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{1414C8AC-D04A-428C-8526-E809CA219532}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{693F7DA1-D651-42E5-97EE-8E63195D98F2}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{32364E85-BC96-4E5F-B66E-C42B64913155}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{BB065535-F3C5-4A3C-9FB0-90E9F8496509}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{A634A7B9-DC92-4733-91A5-62440209799E}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{A02A79CD-3AF3-4727-B3C6-12435CE66D7C}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{A4EC6FD9-64A9-43A5-988C-A12CA13A67ED}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{5B0A8986-CF0E-444E-9980-89AA689A5F63}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{0BF25D37-7A6B-4E41-A12B-62590D2F2C8F}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{0613C2C0-5310-49EE-B9B6-BB29092BBC40}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{1E465FF8-A452-4EE4-A812-F499CE68404F}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{A5718141-E88F-41A8-AB78-BF8A1CDB6A45}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{F157A56E-6E57-416F-9BAD-111AC6B4F512}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{9DC2450C-56B9-4ABC-A1F5-AC0240FC6F49}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{983E2B1F-0EE8-4B39-A33B-B91657E8C5D3}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{8FA09CE2-6E3A-4BE5-9736-082E7F5DAB2E}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{906E954D-EB64-4EF4-80E9-149D22C95C6D}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{B2B6CDD9-45F2-469C-8BE4-7F11713E83AD}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{022D311A-55C8-432F-BE0E-D6BAACEE00EA}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{DC849114-A448-4F77-9BD6-5A04E621C5A5}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{EA8F7714-78A4-41E8-83B4-A8301E233806}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{E12A5F2B-B127-4909-B586-A72D9DF398B3}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Play.exe
FirewallRules: [{93B0A1ED-4BE3-444F-AAB3-8FDDE003BC1A}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
FirewallRules: [{83D0C7BD-40B4-4013-9DCA-9DBE9C21E82A}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{FE855344-6432-411A-8FF9-4E00F78A4B82}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
FirewallRules: [{71DA80BD-BB75-4319-A45A-16AC960E576A}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{9F9DACF1-643A-4121-8F83-A749619AB7AC}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{033BFE80-D6C3-4532-B7D9-3BA2EA1CDB68}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{CFCEA625-E8BD-4E49-86AE-E03F1AF3D8E6}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{5922A7E2-9A00-4DF7-BE1B-18ED583DDAB5}] => (Allow) C:\Program Files (x86)\Acer\abMedia_\DMCDaemon.exe
FirewallRules: [{9270E143-4E4C-4967-8643-74EE2B91F485}] => (Allow) C:\Program Files (x86)\Acer\abMedia_\DMCDaemon.exe
FirewallRules: [{20260F88-9074-4C9C-B319-A5457688C419}] => (Allow) C:\Program Files (x86)\Acer\abMedia_\WindowsUpnpMV.exe
FirewallRules: [{370BAF3F-4B3B-4C5B-9C59-B345B430D9B8}] => (Allow) C:\Program Files (x86)\Acer\abMedia_\WindowsUpnpMV.exe
FirewallRules: [{2D337AEB-A759-4817-BEF2-D3E0BFA049A4}] => (Allow) C:\Program Files (x86)\Acer\abMedia_\DMCDaemon.exe
FirewallRules: [{48377021-0944-4BEA-9809-B2318816D69F}] => (Allow) C:\Program Files (x86)\Acer\abMedia_\DMCDaemon.exe
FirewallRules: [{BE412445-577E-45FA-A36E-63A689DBDC55}] => (Allow) C:\Program Files (x86)\Acer\abMedia_\WindowsUpnpMV.exe
FirewallRules: [{19B8C658-7E58-4CE6-87E5-4A37A5F8FE51}] => (Allow) C:\Program Files (x86)\Acer\abMedia_\WindowsUpnpMV.exe
FirewallRules: [{AAD8EA8A-F387-4160-AFC8-5B9AB730D93F}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{58F50BED-4FB7-43C8-9221-26B9A93E590D}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{8EB44ECF-C68A-4242-8B5B-4F1674C76FB9}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{1EBFF045-E141-4679-A10E-8CB5856D4F66}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{DB0CD5E3-F855-492E-B9D0-A83EA69381A7}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{C9663B51-20EE-4C5C-89AE-2B8707392FD6}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{D016475F-9D86-4D74-B77D-F8B52A51FC04}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{8B1EE55D-F31D-42DD-BDF7-222A4069A427}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{66435E74-6403-4632-B92C-2AEC8F20E235}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{B2E57552-AF6B-4F8B-9B96-3F5D952B875A}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{3AFD0759-1462-4A8F-8CF8-A81F882EA886}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{3D7E53AE-162D-4720-B1F7-88B1E4ECBD4A}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{F3BF64EB-2474-4896-B25C-9A776E9A2DE6}] => (Allow) C:\Program Files (x86)\Acer\abPhoto_\DMCDaemon.exe
FirewallRules: [{EC5DBBE6-A887-43EF-862B-B03CF37210C6}] => (Allow) C:\Program Files (x86)\Acer\abPhoto_\DMCDaemon.exe
FirewallRules: [{40D4EE0C-C438-4E68-8470-B2FF7CBA6945}] => (Allow) C:\Program Files (x86)\Acer\abPhoto_\WindowsUpnp.exe
FirewallRules: [{6A77CEC4-6A66-4274-9EC6-33F17C8F8CBF}] => (Allow) C:\Program Files (x86)\Acer\abPhoto_\WindowsUpnp.exe
FirewallRules: [{313E3F92-D39B-4D45-A6B0-564E1815F90D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{01F9C9F9-E26F-468B-9909-180B24C04379}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{09AD0A59-85B8-4DBE-B90D-1A5DA9436493}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{6705DA63-A884-41FC-A319-F0D570C34FF6}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{671877BD-D506-4E1A-9BDD-A30E3F0F9E31}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{1685DA4B-D541-4B24-AA63-F9BB9181B9CD}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{929FDD1B-DD06-4563-8AE4-314C1E8F5E55}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{1F3393DA-3558-4EEA-9B98-FE17DC7DC56A}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{C1D146E1-C0D4-4E96-A68D-C23ACE417791}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{E9BBE760-D92C-4A9A-A0D4-46618969D320}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{0A3826A1-8947-42A0-AB7E-215064906271}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{1548960D-A43C-480C-8DA9-434241CC3B11}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{EA76919C-09D9-459C-B8A7-9272E0C4FC89}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
FirewallRules: [{6E2B41D1-FA0A-4C07-9A3E-9FCA96FFCB40}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
FirewallRules: [{0D121B6E-82AB-4A1F-9E04-B1C567D11382}] => (Allow) C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
FirewallRules: [{8FA16D43-A3F5-4E3C-9897-68B3EA778D4A}] => (Allow) C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
FirewallRules: [{9BC60F8E-2675-4631-BDD1-6010E222578E}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\bin\node.exe
FirewallRules: [{4B791A16-4F5F-496B-B4A8-B24D81C8F7C7}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\bin\node.exe
FirewallRules: [TCP Query User{62253AB1-2BA2-4A20-B2DF-E78CB02FF0B5}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{53574787-829A-4B66-B776-83D204ECD913}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{D27B8C8F-4612-483C-9184-D3F0D2BA1808}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS7304\hppiw.exe
FirewallRules: [{712AA6FB-6ADB-4AA8-ABAE-5217B908957A}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS7304\hppiw.exe
FirewallRules: [TCP Query User{8517CCF3-8022-477D-A2A4-A77B89BD2F19}C:\users\norman\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\norman\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{8C390F70-7795-424C-9AB1-27E868A5129C}C:\users\norman\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\norman\appdata\roaming\spotify\spotify.exe
FirewallRules: [{A48326AA-FDC6-4A6F-9B7B-1C6235B90321}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{15F5B948-05E7-40D2-9998-11B4D72E2D05}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{0863AD3F-557B-4350-8166-6029F987F098}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{A18B2D27-FC95-4875-84FF-F3BD3534D000}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [TCP Query User{7D714063-47E1-4FAD-9DBC-9429B4258D24}C:\program files (x86)\bt broadband desktop help\btbb\ma\8.4.0.53.bt.10\ma\bin\node.exe] => (Block) C:\program files (x86)\bt broadband desktop help\btbb\ma\8.4.0.53.bt.10\ma\bin\node.exe
FirewallRules: [UDP Query User{CDE7F158-D42F-4D23-9AC5-149840D2593F}C:\program files (x86)\bt broadband desktop help\btbb\ma\8.4.0.53.bt.10\ma\bin\node.exe] => (Block) C:\program files (x86)\bt broadband desktop help\btbb\ma\8.4.0.53.bt.10\ma\bin\node.exe
FirewallRules: [{787D5FF3-D6FD-44C5-BA76-906423BE5C6D}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS48D3\HPDiagnosticCoreUI.exe
FirewallRules: [{D2D33F1A-C762-4065-92D8-5AA0A24A72A3}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS48D3\HPDiagnosticCoreUI.exe
FirewallRules: [{A3A6C463-90B6-4087-B396-B5093138C044}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS5322\HPDiagnosticCoreUI.exe
FirewallRules: [{2B268E8B-060B-422F-9A65-E14F203EFC7C}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS5322\HPDiagnosticCoreUI.exe
FirewallRules: [{5F7B7F86-9E93-4F17-B6FA-A55721FD1621}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS633C\HPDiagnosticCoreUI.exe
FirewallRules: [{3B5CCBDE-527A-45FD-91AB-A76154BD3E12}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS633C\HPDiagnosticCoreUI.exe
FirewallRules: [{A2AAD339-ECAE-4020-BFFF-2ADA047B9443}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{1DAB168B-1DF6-460A-A20D-5E3623CF6C5A}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{FF702D5B-318C-429F-AC10-58DEB5FF8119}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{293091F9-B23E-4B8C-85F9-D1026AD6FFDD}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{54204D99-962A-4B05-80A6-EC4ED20CCF7B}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{730D4A06-BEF9-4C2E-BAE1-4D9648182C9E}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{F030906D-54CF-48E9-9A88-2A2238B588A1}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{17BAEA5A-FA20-43FF-8477-A845E9858E82}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{99681E10-38E1-4D03-8F04-2ADFBE16FC8C}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS3EF6\HPDiagnosticCoreUI.exe
FirewallRules: [{EA5A7B4A-42D9-4556-801D-95CFE3BBB017}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS3EF6\HPDiagnosticCoreUI.exe
FirewallRules: [{59649935-9945-4DCF-8E53-9BB56F5E3F0A}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{D1F2F52D-2BD2-4538-B91E-05F529CFE028}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{9BB86577-55DB-42E5-BA0D-AACC99A70FED}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{4663E8DA-D78F-4CE5-AE2D-5F3208991E84}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{C8657169-D696-4FC5-AE59-A15A277A8A0C}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS61F7\HPDiagnosticCoreUI.exe
FirewallRules: [{ED90730A-DD1E-41ED-8DE4-244B87C4EEC6}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS61F7\HPDiagnosticCoreUI.exe
FirewallRules: [{A3522436-9A00-45C5-9A8E-222516B23D6E}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS71DC\HPDiagnosticCoreUI.exe
FirewallRules: [{DB66CC6D-BC2B-44B5-9848-83E16889956C}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS71DC\HPDiagnosticCoreUI.exe
FirewallRules: [{029736A6-EB84-4DBE-8C33-2ED9DA1F6368}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{389838DA-D330-4E1E-80E4-0415EB93EB7F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9FC41060-2D0E-4E55-8BB9-F26C9248D338}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6216610E-E3DE-4A67-8BD3-D6A9B4885104}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{71ADBBAF-5286-4920-8858-5C0156143333}] => (Allow) C:\Program Files (x86)\Acer\abMusic\DMCDaemon.exe
FirewallRules: [{C5782209-41DC-405F-8598-01AD2F2CAAD1}] => (Allow) C:\Program Files (x86)\Acer\abMusic\DMCDaemon.exe
FirewallRules: [{B7D05F8F-C5CF-4C8D-8724-DC3D8A70B05C}] => (Allow) C:\Program Files (x86)\Acer\abMusic\WindowsUpnpMV.exe
FirewallRules: [{01453C73-3366-4437-BFBC-EF0584C08F91}] => (Allow) C:\Program Files (x86)\Acer\abMusic\WindowsUpnpMV.exe
FirewallRules: [{ADAE4783-1B54-4304-949B-ED8A95FF7451}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS646B\HPDiagnosticCoreUI.exe
FirewallRules: [{19A87C99-E5E7-4E92-AA8A-EE58D56DCFED}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS646B\HPDiagnosticCoreUI.exe
FirewallRules: [{37B64208-7217-4EDC-AE65-6EB4F1F6C8CB}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS2AA6\HPDiagnosticCoreUI.exe
FirewallRules: [{16E62459-85E8-4B65-AB74-DA3C7F220B37}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS2AA6\HPDiagnosticCoreUI.exe
FirewallRules: [{137DFA8A-4941-4E85-BB09-74EBEB40FA76}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS48D8\HPDiagnosticCoreUI.exe
FirewallRules: [{5CDEC49B-93F5-43D4-A30C-E8A81200A08F}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS48D8\HPDiagnosticCoreUI.exe
FirewallRules: [{1DB65BA1-C900-4B37-BC45-C0573D32A83F}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS66A7\hppiw.exe
FirewallRules: [{A0C92437-ECEA-4B45-9351-D9DE12059860}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS66A7\hppiw.exe
FirewallRules: [{015D2E74-5B51-4E57-8645-6829D9CD9434}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS7825\hppiw.exe
FirewallRules: [{F60F2518-7036-401A-94D5-C4AFFC708E52}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS7825\hppiw.exe
FirewallRules: [{BC87AF03-841C-411E-91E9-1512617ED1BB}] => (Allow) C:\Program Files\HP\HP Deskjet 2540 series\Bin\DeviceSetup.exe
FirewallRules: [{0B49F96D-8347-4CBA-9DA5-05B6C45571CC}] => (Allow) LPort=5357
FirewallRules: [{B418F815-3B60-4192-B34A-F8127A89C246}] => (Allow) C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{3D23DB7F-2946-4454-8044-D25848C0036A}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0FBD\HPDiagnosticCoreUI.exe
FirewallRules: [{89DE5DE1-DA0A-40F2-9EAA-E89064901382}] => (Allow) C:\Users\norman\AppData\Local\Temp\7zS0FBD\HPDiagnosticCoreUI.exe
FirewallRules: [{0B8CE9CC-912D-461E-9375-6D9F9F6AF6DE}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{58BC9C7A-67DD-47C1-B96D-950D7B0F9B1E}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{176F376B-2112-4339-83C0-E2A6366FB51F}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
==================== Restore Points =========================
11-10-2017 19:18:55 Windows Update
17-10-2017 22:10:06 Windows Update
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/14/2017 12:34:07 PM) (Source: MsiInstaller) (EventID: 10005) (User: NT AUTHORITY)
Description: Product: Bonjour – A later version of Bonjour is already installed on this computer.
Error: (11/14/2017 12:26:48 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: BYROM)
Description: Activation of application Microsoft.XboxIdentityProvider_8wekyb3d8bbwe!Microsoft.XboxIdentityProvider failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (11/14/2017 11:53:47 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: BYROM)
Description: Activation of application Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy!App failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (11/14/2017 11:33:03 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Norton Internet Security status to SECURITY_PRODUCT_STATE_ON.
Error: (11/14/2017 11:32:49 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Norton Internet Security status to SECURITY_PRODUCT_STATE_ON.
Error: (11/14/2017 11:32:44 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Norton Internet Security status to SECURITY_PRODUCT_STATE_ON.
Error: (11/14/2017 11:32:26 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Norton Internet Security status to SECURITY_PRODUCT_STATE_ON.
Error: (11/14/2017 11:31:43 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Norton Internet Security status to SECURITY_PRODUCT_STATE_ON.
Error: (11/14/2017 11:31:25 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Norton Internet Security status to SECURITY_PRODUCT_STATE_ON.
Error: (11/14/2017 11:31:19 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Error while updating Norton Internet Security status to SECURITY_PRODUCT_STATE_ON.
System errors:
=============
Error: (11/14/2017 12:53:40 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The HP Network Devices Support service did not respond on starting.
Error: (11/14/2017 12:50:54 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (11/14/2017 12:50:54 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Presentation Foundation Font Cache 3.0.0.0 service to connect.
Error: (11/14/2017 12:50:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (11/14/2017 12:50:23 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Presentation Foundation Font Cache 3.0.0.0 service to connect.
Error: (11/14/2017 12:50:21 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Unchecky service.
Error: (11/14/2017 12:50:04 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (11/14/2017 12:50:03 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (11/14/2017 12:49:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The BT Help Wizard service terminated unexpectedly. It has done this 3 time(s).
Error: (11/14/2017 12:49:12 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The BT Help Wizard service terminated with the following error:
%%4294967295
CodeIntegrity:
===================================
Date: 2017-11-14 11:12:13.527
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-11-14 11:12:13.520
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-25 23:36:38.668
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-25 23:36:38.662
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-19 11:47:58.595
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-19 11:47:58.582
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-19 11:34:47.409
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-19 11:34:47.403
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-19 10:14:04.680
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2017-07-19 10:14:04.674
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Celeron(R) CPU N2840 @ 2.16GHz
Percentage of memory in use: 67%
Total physical RAM: 3977.98 MB
Available physical RAM: 1297.12 MB
Total Virtual: 5705.98 MB
Available Virtual: 2924.4 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:450.6 GB) (Free:245.4 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 78B74B26)
Partition: GPT.
==================== End of Addition.txt ============================
