I've had this happen about 10 times in the last month: https://malwaretips.com/blogs/remove-microsoft-warning-alert-scam/#uninstall Installed Malware adw and Zemana, both of which removed PUP Optional Legacy files. Most recently, however (tonight) the "alert" reappeared, but Zemana detected nothing, while adw detected and removed 1 PUP Optional Legacy file.
Following your instructions, here are the aswMBR log and the 2 Farbar logs. Thanks very much!
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2019-04-22 18:30:46
—————————–
18:30:46.298 OS Version: Windows x64 6.2.9200
18:30:46.298 Number of processors: 8 586 0x3C03
18:30:46.298 ComputerName: JINGRAMPC UserName: John
18:30:47.110 Initialize success
18:30:47.220 VM: initialized successfully
18:30:47.220 VM: Intel CPU BiosDisabled
18:32:35.292 AVAST engine defs: 17030301
18:32:49.106 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000039
18:32:49.106 Disk 0 Vendor: ST1000LM024_HN-M101MBB 2AR20002 Size: 953869MB BusType: 11
18:32:49.263 Disk 0 MBR read successfully
18:32:49.263 Disk 0 MBR scan
18:32:49.263 Disk 0 unknown MBR code
18:32:49.263 Disk 0 Partition 1 00 EE GPT 2097151 MB offset 1
18:32:49.294 Disk 0 scanning C:\WINDOWS\system32\drivers
18:33:05.576 Service scanning
18:33:41.313 Modules scanning
18:33:41.313 Disk 0 trace - called modules:
18:33:41.329 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys ACPI.sys storport.sys hal.dll iaStorA.sys
18:33:41.844 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe0002d3d0060]
18:33:41.844 3 CLASSPNP.SYS[fffff80094b80170] -> nt!IofCallDriver -> [0xffffe0002d3d1800]
18:33:41.844 5 hpdskflt.sys[fffff800957e542b] -> nt!IofCallDriver -> [0xffffe0002ce844b0]
18:33:41.844 7 ACPI.sys[fffff8009488dc21] -> nt!IofCallDriver -> \Device\00000039[0xffffe0002ce83060]
18:33:42.798 AVAST engine scan C:\WINDOWS
18:33:45.267 AVAST engine scan C:\WINDOWS\system32
18:37:50.804 AVAST engine scan C:\WINDOWS\system32\drivers
18:38:11.321 AVAST engine scan C:\Users\John
18:51:23.532 AVAST engine scan C:\ProgramData
19:00:49.960 Disk 0 statistics 4479941/0/0 @ 1.88 MB/s
19:00:49.975 Scan finished successfully
19:06:46.277 Disk 0 MBR has been saved successfully to "C:\Users\John\Desktop\MBR.dat"
19:06:46.277 The log file has been saved successfully to "C:\Users\John\Desktop\aswMBR.txt"
Here is the Farbar FRST.txt log:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22.04.2019
Ran by [removed] (administrator) on JINGRAMPC (Hewlett-Packard HP ENVY 17 Notebook PC) (22-04-2019 19:09:55)
Running from C:\Users\[removed]\Downloads
[removed]
Platform: Windows 8.1 (Update) (X64) Language: English (United States)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AuthenTec, Inc. -> HP) C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe
(IDT, Inc.) [File not signed] C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(ArcSoft, Inc. -> ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Apple Inc. -> Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Intel Corporation-Mobile Wireless Group -> Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe
(Intel Corporation-Mobile Wireless Group -> Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(Intel(R) Corporation) [File not signed] C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel(R) Smart Connect software -> ) C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation-Mobile Wireless Group -> Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() [File not signed] C:\Windows\System32\valWBFPolicyService.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Zemana D.O.O. Sarajevo -> Copyright 2018.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(Intel Corporation-Mobile Wireless Group -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Wireless Display -> Intel) C:\Program Files\Intel Corporation\Intel WiDi\BrcmSetSecurity.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\hkcmd.exe
(Motorola Solutions Inc. -> Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions Inc. -> Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Zemana D.O.O. Sarajevo -> Copyright 2018.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(ArcSoft, Inc. -> ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
(Piriform Software Ltd -> Piriform Software Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(WildTangent Inc -> WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(HP Inc. -> HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation - Software and Firmware Products -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(AVAST Software) [File not signed] C:\Users\John\Downloads\aswMBR.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) [File not signed] C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.22013_x64__8wekyb3d8bbwe\livecomm.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [BTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [7763256 2013-03-06] (Motorola Solutions Inc. -> Motorola Solutions, Inc.)
HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-16] (IDT, Inc.) [File not signed]
HKLM\…\Run: [ZAM] => C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [25160568 2019-02-14] (Zemana D.O.O. Sarajevo -> Copyright 2018.)
HKLM-x32\…\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [619008 2010-05-25] (Nikon Corporation) [File not signed]
HKLM-x32\…\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft, Inc. -> ArcSoft Inc.)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc. -> Apple Inc.)
HKLM-x32\…\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-04-10] (CyberLink Corp. -> CyberLink Corp.)
HKLM-x32\…\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [181208 2013-11-04] (CyberLink Corp. -> cyberlink)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard Company -> Hewlett-Packard)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [127528 2015-07-08] (Hewlett-Packard -> Hewlett-Packard Company)
HKLM-x32\…\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [4426560 2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
HKLM-x32\…\Run: [HPMessageService] => C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe [657424 2015-09-03] (Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.)
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\Run: [Google Update] => C:\Users\John\AppData\Local\Google\Update\1.3.34.7\GoogleUpdateCore.exe [752424 2019-03-27] (Google Inc -> Google LLC)
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [46506040 2019-04-09] (Google LLC -> )
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\Run: [Facebook Update] => C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-09-09] (Facebook, Inc. -> Facebook Inc.)
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\Run: [HP ENVY 4500 series (NET)] => C:\Program Files\HP\HP ENVY 4500 series\Bin\ScanToPCActivationApp.exe [3487240 2014-07-21] (Hewlett Packard -> Hewlett-Packard Development Company, LP)
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\Run: [Power2GoExpress8] => C:\Program Files (x86)\CyberLink\Power2Go8\Power2GoExpress8.exe [1728952 2015-06-22] (CyberLink Corp. -> CyberLink Corp.)
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [22515488 2019-04-04] (Piriform Software Ltd -> Piriform Software Ltd)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> "C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{A6EADE66-0000-0000-484E-7E8A45000000}] -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll [2018-09-20] (Adobe Systems, Incorporated -> Adobe Systems, Inc.)
HKLM\Software\…\Authentication\Credential Providers: [{538C240D-3DEE-4032-AB4C-08A3A6EB0861}] -> C:\Program Files (x86)\CyberLink\YouCam\CLCredProv\x64\CLCredProv.dll [2015-02-11] (CyberLink Corp. -> CyberLink)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA CORPORATION -> NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\iSCTsysTray.lnk [2013-12-07]
ShortcutTarget: iSCTsysTray.lnk -> C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe (Intel(R) Smart Connect software -> Intel Corporation)
Startup: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - .lnk [2015-06-04]
ShortcutTarget: Monitor Ink Alerts - .lnk -> C:\Program Files\HP\HP ENVY 4500 series\Bin\HPStatusBL.dll (Hewlett Packard -> Hewlett-Packard Development Company, LP)
Startup: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP ENVY 4500 series (Network Copy 1).lnk [2019-04-22]
ShortcutTarget: Monitor Ink Alerts - HP ENVY 4500 series (Network Copy 1).lnk -> C:\Program Files\HP\HP ENVY 4500 series\Bin\HPStatusBL.dll (Hewlett Packard -> Hewlett-Packard Development Company, LP)
Startup: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2019-04-22]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation -> Microsoft Corporation)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {01BDC731-CE7C-4D81-82E4-D638A3276CBE} - System32\Tasks\HPCustParticipation HP ENVY 4500 series => C:\Program Files\HP\HP ENVY 4500 series\Bin\HPCustPartic.exe [5745672 2014-07-21] (Hewlett Packard -> Hewlett-Packard Development Company, LP)
Task: {0DCFF212-E4A4-4287-897F-E6199F787876} - System32\Tasks\HP AR Program Upload - 4375ef3c63b949998e7eb9dee9f32b0dad1766cf981e413ebcd3b5ed7c9febc6 => C:\Program Files\HP\HP ENVY 4500 series\bin\HPRewards.exe [3495944 2014-07-21] (Hewlett Packard -> TODO: )
Task: {0F0765E4-401F-490D-A280-14ECA39F6E46} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [198696 2017-09-27] (HP Inc. -> HP Inc.)
Task: {1066F0B0-9E37-4F1B-8F04-79F3BBF3D579} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3050562961-2452711305-273969980-1002Core => C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-09-09] (Facebook, Inc. -> Facebook Inc.)
Task: {1F99C0FE-443E-4609-8B46-5965CEAFCA44} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-12-02] (Synaptics Incorporated -> Synaptics Incorporated)
Task: {2378362A-86B9-453C-A841-C3BC8C257C35} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [219512 2018-12-24] (HP Inc. -> HP Inc.)
Task: {239D847C-CE30-4FAF-A487-0DDE2E6F5EDB} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3050562961-2452711305-273969980-1002UA => C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-09-09] (Facebook, Inc. -> Facebook Inc.)
Task: {25C61CEF-73A1-452E-87A8-E470053270E8} - System32\Tasks\{30ECCB28-5DC3-4A34-AD05-8A8DF81380E8} => C:\WINDOWS\system32\pcalua.exe -a F:\HeptaSoft\Setup.Exe -d F:\HeptaSoft
Task: {27484BE4-48C5-44C7-8703-98740BC07A99} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1344312 2013-09-10] (Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.)
Task: {27D7A177-7210-4247-864C-F1860FB648B5} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc -> Dropbox, Inc.)
Task: {2CB94B8E-2E60-4813-9046-8C8FFCE29B3B} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1487568 2014-03-19] (Microsoft Corporation -> Microsoft Corporation)
Task: {2E8CEF46-D00F-4886-BBC5-B27D96955113} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2211024 2014-03-19] (Microsoft Corporation -> Microsoft)
Task: {3BA12873-A03E-4A5F-A90D-E8A22351B07B} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2015-02-11] (CyberLink Corp. -> CyberLink Corp.)
Task: {47A99610-3EDC-4112-B63A-5BF2BC8C4551} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [144200 2015-08-28] (Google Inc -> Google Inc.)
Task: {4CCC837B-40F2-4A25-8486-534870072FDB} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2118352 2014-03-19] (Microsoft Corporation -> Microsoft Corporation)
Task: {4DAC969B-ACCD-4ED1-83A8-406832388E84} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - Resources => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [652664 2019-01-31] (HP Inc. -> HP Inc.)
Task: {51B74893-DCD0-44E7-AE54-E5C104584A79} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [136056 2019-01-02] (HP Inc. -> HP Inc.)
Task: {556CC4C0-8BAF-4EFC-8819-2659BFBC64D5} - System32\Tasks\HPCeeScheduleForJohn => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [99208 2016-06-24] (Hewlett-Packard Company -> HP Inc.)
Task: {5819731F-40A6-461F-B730-F6593EACCBDD} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1487568 2014-03-19] (Microsoft Corporation -> Microsoft Corporation)
Task: {5A4D5B84-1188-4F26-A262-656529A31756} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => Command(3): %windir%\system32\rundll32.exe -> appraiser.dll,DailyGatedCheck
Task: {5A4D5B84-1188-4F26-A262-656529A31756} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => Command(4): %windir%\system32\rundll32.exe -> aepdu.dll,AePduRunUpdate -nolegacy
Task: {5FB44BAD-D8B0-49EB-97F3-19A60EFCF81B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3050562961-2452711305-273969980-1002Core => C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-28] (Google Inc -> Google Inc.)
Task: {6B729129-611B-4589-B24F-B4C1D81B370A} - System32\Tasks\HP AR Program Upload - bcf09fe275f04d2e83a27ab60b44a50ca7ab1a0af8644a9c879c358f844fd85b => C:\Program Files\HP\HP ENVY 4500 series\bin\HPRewards.exe [3495944 2014-07-21] (Hewlett Packard -> TODO: )
Task: {6D9EEAA3-E71F-4BEA-9789-E095D2A81FE1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1073528 2019-04-02] (HP Inc. -> HP Inc.)
Task: {7C554ED0-A457-4F6D-9BA0-AA5D64265A8C} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [979024 2019-02-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {7D9643A7-7DBA-4AB4-BF46-D214D7193F4F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [16509040 2019-04-04] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {879F9FDF-008E-42CA-B4E8-0E7930D4AB9D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [144200 2015-08-28] (Google Inc -> Google Inc.)
Task: {8A623E26-400C-4494-AC8F-2850CB058A36} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [1488248 2018-12-10] (HP Inc. -> HP Inc.)
Task: {9430349C-8B9D-4F09-874B-F912E7B8153D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1195544 2018-12-16] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Task: {9B72209C-4C05-4FDF-B427-577E67D99530} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_171_Plugin.exe [1456696 2019-04-10] (Adobe Inc. -> Adobe)
Task: {A0A01EF0-813F-4C92-BA27-8802358A0579} - System32\Tasks\HP AR Program Upload - 63d0e7ca1af445f1a70aa0fde128226e0e73c285c6354d41b2897768e440dd03 => C:\Program Files\HP\HP ENVY 4500 series\bin\HPRewards.exe [3495944 2014-07-21] (Hewlett Packard -> TODO: )
Task: {A5CDA38E-822C-4787-91A1-EC96EB61B5FD} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2118352 2014-03-19] (Microsoft Corporation -> Microsoft Corporation)
Task: {A79E312B-56AF-44EE-B974-B92ABA08378B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1073528 2019-04-02] (HP Inc. -> HP Inc.)
Task: {B3DBFC25-B955-4EAF-A676-37EEE0EC2DB9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-04-10] (Adobe Inc. -> Adobe)
Task: {B896D62B-FC8F-4BE1-8864-63C6B6C3D27D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3050562961-2452711305-273969980-1002UA => C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-28] (Google Inc -> Google Inc.)
Task: {BB3AC742-AEC6-44C4-94F8-152B3208422E} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [177376 2016-08-12] (Intel(R) Update Manager -> Intel Corporation)
Task: {BCD4C1C0-3180-45DA-A756-AD0984A499A9} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [619416 2019-04-04] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {C39FB802-EC77-4141-BCA7-14F3E6C19A16} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [1488248 2018-12-10] (HP Inc. -> HP Inc.)
Task: {CF87A516-48F0-4D11-8F51-39FC7A97E88A} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [979024 2019-02-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {D1D4F690-E4F1-413D-98C2-6B4C3710A5AB} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Command(1): %windir%\system32\rundll32.exe -> aepdu.dll,AePduRunUpdate
Task: {D1D4F690-E4F1-413D-98C2-6B4C3710A5AB} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Command(2): %windir%\system32\rundll32.exe -> invagent.dll,RunUpdate -noappraiser
Task: {D43DD8D3-7604-4CD8-9E5D-9D65839EA9BE} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc -> Dropbox, Inc.)
Task: {D999C102-9E12-4AA6-9D35-5DC5704AB625} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [652664 2019-01-31] (HP Inc. -> HP Inc.)
Task: {DEC18C64-E8D1-4A48-B102-5BDCB9EBDCF7} - System32\Tasks\G2MUpdateTask-S-1-5-21-3050562961-2452711305-273969980-1002 => C:\Users\John\AppData\Local\GoToMeeting\12771\g2mupdate.exe [29768 2019-04-22] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {DF15318C-F49F-4C24-8FA4-8C697FDDB3DC} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [177376 2016-08-12] (Intel(R) Update Manager -> Intel Corporation)
Task: {F685C462-3030-461D-9E78-F4DC333127B3} - System32\Tasks\G2MUploadTask-S-1-5-21-3050562961-2452711305-273969980-1002 => C:\Users\John\AppData\Local\GoToMeeting\12771\g2mupload.exe [29768 2019-04-22] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {FE1535F8-3077-4C99-BD01-893044408BE1} - System32\Tasks\HP AR Program Upload - 3a59f984df464bde82e9f347e83ea3f019187722e34a4793b2343508cac3b480 => C:\Program Files\HP\HP ENVY 4500 series\bin\HPRewards.exe [3495944 2014-07-21] (Hewlett Packard -> TODO: )
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-3050562961-2452711305-273969980-1002Core.job => C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-3050562961-2452711305-273969980-1002UA.job => C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-3050562961-2452711305-273969980-1002.job => C:\Users\John\AppData\Local\GoToMeeting\12771\g2mupdate.exe
Task: C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-3050562961-2452711305-273969980-1002.job => C:\Users\John\AppData\Local\GoToMeeting\12771\g2mupload.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForJohn.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{085CF47E-55E5-4FAD-B8A1-ABB6D486FDCA}: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{E4B97B5E-07B8-4648-AAE5-890D64A22573}: [DhcpNameServer] 192.168.1.20 10.1.1.3
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT13/1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT13/1
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT13/1
SearchScopes: HKLM -> {25D86A4A-8ADE-4F69-96F3-8F122CBA0F45} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us2-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\S-1-5-21-3050562961-2452711305-273969980-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2019-02-13] (Microsoft Corporation -> Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2019-03-24] (Microsoft Corporation -> Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2017-09-27] (HP Inc. -> HP Inc.)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2017-09-27] (HP Inc. -> HP Inc.)
Toolbar: HKU\S-1-5-21-3050562961-2452711305-273969980-1002 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2017-07-18] (Microsoft Corporation -> Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\zyyh5t3w.default [2019-04-22]
FF Extension: (F.B Purity - Cleans up Facebook (WX)) - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\zyyh5t3w.default\Extensions\[removed] [2019-04-15] [UpdateUrl:hxxps://www.fbpurity.com/FF-FBP-Ext-Updates.json]
FF Extension: (HTTPS Everywhere) - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\zyyh5t3w.default\Extensions\[removed] [2019-02-12] [UpdateUrl:hxxps://www.eff.org/files/https-everywhere-updates.json]
FF Extension: (Dissenter Extension) - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\zyyh5t3w.default\Extensions\{20dd52e5-90c0-4a51-8b31-e70419c5b126}.xpi [2019-03-26]
FF Extension: (Online PDF Editor (pdf2go.com)) - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\zyyh5t3w.default\Extensions\{5fe0e3b1-ef04-41af-aae8-4653d2dbd0eb}.xpi [2019-03-31]
FF Extension: (Popup blocker for FF: Poper Blocker) - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\zyyh5t3w.default\Extensions\{bee8b1f2-823a-424c-959c-f8f76c8b2306}.xpi [2019-03-31]
FF Extension: (Adblock Plus - free ad blocker) - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\zyyh5t3w.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2019-04-19]
FF SearchPlugin: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\zyyh5t3w.default\searchplugins\ixquick-https.xml [2016-03-08]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_171.dll [2019-04-10] (Adobe Inc. -> )
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_171.dll [2019-04-10] (Adobe Inc. -> )
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1218158.dll [2015-04-27] (Adobe Systems, Inc.) [File not signed]
FF Plugin-x32: @authentec.com/ffwloplugin -> C:\Program Files (x86)\HP SimplePass\npffwloplugin.dll [2013-06-07] (AuthenTec, Inc. -> HP)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google Inc -> Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-08-10] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-08-10] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-10-07] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.7\npGoogleUpdate3.dll [2019-03-28] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.7\npGoogleUpdate3.dll [2019-03-28] (Google Inc -> Google LLC)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll [2013-10-08] (WildTangent Inc -> )
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-03-25] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3050562961-2452711305-273969980-1002: @citrixonline.com/appdetectorplugin -> C:\Users\John\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2016-07-28] (Citrix Online -> Citrix Online)
FF Plugin HKU\S-1-5-21-3050562961-2452711305-273969980-1002: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\John\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Software Sarl -> Skype Limited)
FF Plugin HKU\S-1-5-21-3050562961-2452711305-273969980-1002: @talk.google.com/GoogleTalkPlugin -> C:\Users\John\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google Inc -> Google)
FF Plugin HKU\S-1-5-21-3050562961-2452711305-273969980-1002: @talk.google.com/O1DPlugin -> C:\Users\John\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google Inc -> Google)
FF Plugin HKU\S-1-5-21-3050562961-2452711305-273969980-1002: @tools.google.com/Google Update;version=3 -> C:\Users\John\AppData\Local\Google\Update\1.3.34.7\npGoogleUpdate3.dll [2019-03-27] (Google Inc -> Google LLC)
FF Plugin HKU\S-1-5-21-3050562961-2452711305-273969980-1002: @tools.google.com/Google Update;version=9 -> C:\Users\John\AppData\Local\Google\Update\1.3.34.7\npGoogleUpdate3.dll [2019-03-27] (Google Inc -> Google LLC)
FF Plugin ProgramFiles/Appdata: C:\Users\John\AppData\Roaming\mozilla\plugins\npatgpc.dll [2015-12-15]
FF Plugin ProgramFiles/Appdata: C:\Users\John\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-15]
FF Plugin ProgramFiles/Appdata: C:\Users\John\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-15]
Chrome:
=======
CHR Profile: C:\Users\John\AppData\Local\Google\Chrome\User Data\Default [2019-04-22]
CHR Extension: (Google Slides) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-04-18]
CHR Extension: (Google Docs) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-04-18]
CHR Extension: (Google Drive) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-04-18]
CHR Extension: (YouTube) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-04-18]
CHR Extension: (Google Sheets) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-04-18]
CHR Extension: (Google Docs Offline) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-04-18]
CHR Extension: (Website Logon) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\kanflfepiobnpjbljmngfgegijhdpljm [2017-04-18]
CHR Extension: (Chrome Web Store Payments) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-04-18]
CHR Extension: (Gmail) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-04-18]
CHR Extension: (Chrome Media Router) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-18]
CHR HKLM-x32\…\Chrome\Extension: [kanflfepiobnpjbljmngfgegijhdpljm] - C:\Program Files (x86)\HP SimplePass\tschrome.crx [2013-04-01]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft, Inc. -> ArcSoft Inc.)
R2 BrcmSetSecurity; C:\Program Files\Intel Corporation\Intel WiDi\BrcmSetSecurity.exe [101536 2013-04-16] (Intel Wireless Display -> Intel)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3058256 2019-02-13] (Microsoft Corporation -> Microsoft Corporation)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241776 2013-01-28] (CyberLink Corp. -> CyberLink)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc -> Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc -> Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [51024 2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
R2 FPLService; C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe [1641768 2013-06-07] (AuthenTec, Inc. -> HP)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [240736 2013-10-07] (WildTangent Inc -> WildTangent)
S3 hpqcaslwmiex; C:\Program Files (x86)\HP\Shared\hpqwmiex.exe [1031704 2016-06-03] (Hewlett-Packard Company -> HP)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [347512 2018-12-06] (HP Inc. -> HP Inc.)
R2 HPWMISVC; C:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe [606224 2015-09-03] (Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-30] (Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 Intel(R) Bluetooth Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [160712 2013-03-11] (Intel Corporation-Mobile Wireless Group -> Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel® Trusted Connect Service -> Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2015-08-10] (Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [180200 2013-02-13] (Intel(R) Smart Connect software -> )
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [177376 2016-08-12] (Intel(R) Update Manager -> Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2015-08-10] (Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation)
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6562472 2019-02-01] (Malwarebytes Corporation -> Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-01-08] (Intel Corporation-Mobile Wireless Group -> )
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [339456 2013-08-16] (IDT, Inc.) [File not signed]
S3 TrueService; C:\Program Files\Common Files\AuthenTec\TrueService.exe [401856 2013-01-08] (AuthenTec, Inc. -> AuthenTec, Inc.)
R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [28160 2013-03-19] () [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation -> Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation -> Microsoft Corporation)
R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [25160568 2019-02-14] (Zemana D.O.O. Sarajevo -> Copyright 2018.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3674864 2014-01-08] (Intel Corporation-Mobile Wireless Group -> Intel® Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 Accelerometer; C:\WINDOWS\system32\DRIVERS\Accelerometer.sys [53424 2015-06-29] (Hewlett-Packard Company -> Hewlett-Packard)
R3 btmhsf; C:\WINDOWS\system32\DRIVERS\btmhsf.sys [1362232 2013-02-14] (Motorola Solutions Inc. -> Motorola Solutions, Inc.)
R0 hpdskflt; C:\WINDOWS\System32\DRIVERS\hpdskflt.sys [40624 2015-06-29] (Hewlett-Packard Company -> Hewlett-Packard)
R3 igfx; C:\WINDOWS\system32\DRIVERS\igdkmd64.sys [4185600 2013-10-04] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
R3 ikbevent; C:\WINDOWS\system32\DRIVERS\ikbevent.sys [21048 2013-02-13] (Intel(R) Smart Connect software -> )
R3 imsevent; C:\WINDOWS\system32\DRIVERS\imsevent.sys [21048 2013-02-13] (Intel(R) Smart Connect software -> )
S3 IntcDAud; C:\WINDOWS\system32\DRIVERS\IntcDAud.sys [442368 2013-03-20] (Intel(R) Corporation) [File not signed]
R3 ISCT; C:\WINDOWS\System32\drivers\ISCTD64.sys [46568 2013-02-13] (Intel(R) Smart Connect software -> )
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [198512 2019-04-12] (Malwarebytes Corporation -> Malwarebytes)
R3 MEIx64; C:\WINDOWS\system32\DRIVERS\TeeDriverx64.sys [99288 2015-08-10] (Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation)
R1 MpKsl08fc6f07; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{382058EA-BC27-4AD3-AD77-050D483B0629}\MpKsl08fc6f07.sys [44928 2019-04-22] (Microsoft Windows Hardware Compatibility Publisher -> Microsoft Corporation)
R3 NETwNe64; C:\WINDOWS\system32\DRIVERS\Netwew00.sys [3349984 2014-04-18] (Intel Corporation-Mobile Wireless Group -> Intel Corporation)
R3 RTSPER; C:\WINDOWS\system32\DRIVERS\RtsPer.sys [429272 2014-02-10] (Realtek Semiconductor Corp -> Realsil Semiconductor Corporation)
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-12-02] (Synaptics Incorporated -> Synaptics Incorporated)
R3 STHDA; C:\WINDOWS\system32\DRIVERS\stwrt64.sys [551936 2013-08-16] (Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.)
R3 usb3Hub; C:\WINDOWS\System32\drivers\usb3Hub.sys [207768 2013-04-16] (Intel Wireless Display -> Windows (R) Win 7 DDK provider)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Windows -> Microsoft Corporation)
R2 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Windows -> Microsoft Corporation)
R3 WirelessButtonDriver; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [30384 2015-06-23] (Hewlett-Packard Company -> HP Inc.)
R3 WPRO_41_2001; C:\WINDOWS\System32\drivers\WPRO_41_2001.sys [34752 2019-04-22] (Intel(R) Smart Connect software -> )
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2019-04-18] (Zemana Ltd. -> Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2019-04-18] (Zemana Ltd. -> Zemana Ltd.)
S3 dbx; system32\DRIVERS\dbx.sys [X]
S3 SmbDrv; \SystemRoot\System32\drivers\Smb_driver_AMDASF.sys [X]
U3 aswMBR; \??\C:\Users\John\AppData\Local\Temp\aswMBR.sys [X] <==== ATTENTION
U3 aswVmm; \??\C:\Users\John\AppData\Local\Temp\aswVmm.sys [X] <==== ATTENTION
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2019-04-22 19:09 - 2019-04-22 19:10 - 000041996 _____ C:\Users\John\Downloads\FRST.txt
2019-04-22 19:08 - 2019-04-22 19:09 - 000000000 ____D C:\FRST
2019-04-22 19:08 - 2019-04-22 19:08 - 002436096 _____ (Farbar) C:\Users\John\Downloads\FRST64.exe
2019-04-22 19:06 - 2019-04-22 19:06 - 000002043 _____ C:\Users\John\Desktop\aswMBR.txt
2019-04-22 19:06 - 2019-04-22 19:06 - 000000512 _____ C:\Users\John\Desktop\MBR.dat
2019-04-22 18:30 - 2019-04-22 18:30 - 005198336 _____ (AVAST Software) C:\Users\John\Downloads\aswMBR.exe
2019-04-22 18:12 - 2019-04-22 18:12 - 000000673 _____ C:\Users\John\Desktop\JRT.txt
2019-04-22 17:56 - 2019-04-22 17:56 - 000094656 _____ (CACE Technologies) C:\WINDOWS\system32\WPRO_41_2001woem.tmp
2019-04-18 13:04 - 2019-04-22 19:10 - 004453196 _____ C:\WINDOWS\ZAM.krnl.trace
2019-04-18 13:04 - 2019-04-22 19:10 - 000601584 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2019-04-18 13:04 - 2019-04-18 13:04 - 000203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zamguard64.sys
2019-04-18 13:04 - 2019-04-18 13:04 - 000203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zam64.sys
2019-04-18 13:04 - 2019-04-18 13:04 - 000000000 ____D C:\Users\John\AppData\Local\Zemana
2019-04-18 13:04 - 2019-04-18 13:04 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zemana AntiMalware
2019-04-18 13:04 - 2019-04-18 13:04 - 000000000 ____D C:\Program Files (x86)\Zemana AntiMalware
2019-04-18 13:03 - 2019-04-18 13:03 - 012946608 _____ (Zemana Ltd. ) C:\Users\John\Downloads\Zemana.AntiMalware.Setup.exe
2019-04-12 15:58 - 2019-04-12 15:58 - 000198512 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2019-04-12 15:54 - 2019-04-12 15:58 - 000153328 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2019-04-12 15:54 - 2019-04-12 15:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2019-04-10 13:09 - 2019-04-12 10:48 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2019-04-10 11:24 - 2019-04-10 11:24 - 021254208 _____ (Piriform Software Ltd) C:\Users\John\Downloads\ccsetup556.exe
2019-04-07 21:02 - 2019-04-18 10:32 - 000000000 ____D C:\Program Files (x86)\VideoLAN
2019-04-05 17:21 - 2019-04-05 17:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2019-04-03 16:59 - 2019-04-03 16:59 - 000051024 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2019-04-03 16:59 - 2019-04-03 16:59 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2019-04-03 16:59 - 2019-04-03 16:59 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2019-04-03 16:59 - 2019-04-03 16:59 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
==================== One month (modified) ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2019-04-22 19:07 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\system32\NDF
2019-04-22 19:06 - 2016-07-28 12:56 - 000000552 _____ C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-3050562961-2452711305-273969980-1002.job
2019-04-22 18:21 - 2016-11-18 21:24 - 000000000 ____D C:\Users\John\AppData\LocalLow\Mozilla
2019-04-22 18:21 - 2013-10-06 05:14 - 000000000 ____D C:\Users\John\Desktop\Antivirus
2019-04-22 18:20 - 2015-08-17 18:04 - 000000924 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2019-04-22 18:18 - 2013-12-02 10:42 - 000000000 __RDO C:\Users\John\SkyDrive
2019-04-22 18:01 - 2014-07-27 17:23 - 000000000 ___RD C:\Users\John\Google Drive
2019-04-22 17:57 - 2013-12-02 10:19 - 000000000 ____D C:\Users\John
2019-04-22 17:56 - 2018-03-15 21:23 - 000000348 _____ C:\WINDOWS\Tasks\HPCeeScheduleForJohn.job
2019-04-22 17:56 - 2015-08-17 18:04 - 000000920 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2019-04-22 17:56 - 2013-12-07 17:26 - 000034752 _____ C:\WINDOWS\system32\Drivers\WPRO_41_2001.sys
2019-04-22 17:56 - 2013-08-22 10:45 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-04-22 17:55 - 2013-08-22 09:25 - 000262144 ___SH C:\WINDOWS\system32\config\BBI
2019-04-22 17:37 - 2016-07-28 12:56 - 000000648 _____ C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-3050562961-2452711305-273969980-1002.job
2019-04-22 17:34 - 2013-08-22 09:36 - 000000000 ____D C:\WINDOWS\Inf
2019-04-22 17:15 - 2017-07-08 06:32 - 000000000 ____D C:\Users\John\AppData\Local\GoToMeeting
2019-04-22 17:15 - 2016-07-28 12:56 - 000003648 _____ C:\WINDOWS\System32\Tasks\G2MUploadTask-S-1-5-21-3050562961-2452711305-273969980-1002
2019-04-22 17:15 - 2016-07-28 12:56 - 000003552 _____ C:\WINDOWS\System32\Tasks\G2MUpdateTask-S-1-5-21-3050562961-2452711305-273969980-1002
2019-04-22 17:00 - 2018-03-15 21:23 - 000003160 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForJohn
2019-04-22 09:27 - 2013-10-06 21:30 - 000000000 ____D C:\Users\John\Documents\Youcam
2019-04-21 13:36 - 2014-09-09 19:30 - 000000944 _____ C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-3050562961-2452711305-273969980-1002UA.job
2019-04-20 11:42 - 2013-10-08 20:07 - 000000000 ____D C:\ProgramData\Apple Computer
2019-04-20 11:22 - 2013-10-07 16:58 - 000000000 ____D C:\Users\John\AppData\Local\HPConnectedMusic
2019-04-19 10:41 - 2013-10-06 03:30 - 000003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3050562961-2452711305-273969980-1002
2019-04-18 10:37 - 2017-09-20 18:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Backup and Sync from Google
2019-04-18 10:37 - 2014-07-27 17:15 - 000002023 _____ C:\Users\Public\Desktop\Google Slides.lnk
2019-04-18 10:37 - 2014-07-27 17:15 - 000002021 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2019-04-18 10:37 - 2014-07-27 17:15 - 000002011 _____ C:\Users\Public\Desktop\Google Docs.lnk
2019-04-17 14:06 - 2013-09-30 00:04 - 000970908 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-04-15 21:56 - 2013-10-06 21:46 - 002488320 ___SH C:\Users\John\Desktop\Thumbs.db
2019-04-14 19:53 - 2017-08-24 10:43 - 000000000 ____D C:\AdwCleaner
2019-04-14 19:36 - 2014-09-09 19:30 - 000000922 _____ C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-3050562961-2452711305-273969980-1002Core.job
2019-04-12 15:55 - 2014-04-11 10:38 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-04-12 10:48 - 2013-10-06 03:53 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2019-04-11 17:21 - 2017-01-20 13:43 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2019-04-10 18:53 - 2018-03-13 17:40 - 000004462 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2019-04-10 18:53 - 2013-10-06 05:48 - 000004288 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2019-04-10 18:53 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2019-04-10 18:53 - 2013-08-22 11:36 - 000000000 ____D C:\WINDOWS\system32\Macromed
2019-04-10 17:27 - 2013-10-06 03:53 - 000001166 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-04-10 11:25 - 2018-01-03 14:32 - 000003870 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
2019-04-07 19:53 - 2013-10-22 13:36 - 000000000 ____D C:\Users\John\AppData\Local\CrashDumps
2019-04-05 17:22 - 2015-08-17 18:04 - 000000000 ____D C:\Program Files (x86)\Dropbox
2019-03-30 19:16 - 2013-10-08 20:08 - 000000020 ____H C:\ProgramData\PKP_DLet.DAT
2019-03-28 09:41 - 2013-11-13 16:48 - 000003330 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2019-03-28 09:41 - 2013-11-13 16:48 - 000003202 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2019-03-27 17:54 - 2014-06-05 21:32 - 000003504 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3050562961-2452711305-273969980-1002UA
2019-03-27 17:54 - 2014-06-05 21:32 - 000003232 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3050562961-2452711305-273969980-1002Core
2019-03-24 07:40 - 2013-08-22 11:36 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-03-24 07:39 - 2013-10-06 03:29 - 000000000 ____D C:\Program Files\Microsoft Office 15
==================== Files in the root of some directories =======
2013-10-08 20:08 - 2013-10-08 20:08 - 000000268 ___RH () C:\Users\John\AppData\Roaming\Desktop Pictures
2013-10-08 20:08 - 2013-10-08 20:08 - 000000268 ___RH () C:\Users\John\AppData\Roaming\Developer Tools
2013-10-08 20:08 - 2013-10-08 20:08 - 000000268 ___RH () C:\Users\John\AppData\Roaming\Devices
2014-02-13 15:05 - 2014-02-13 15:05 - 000000092 _____ () C:\Users\John\AppData\Local\fusioncache.dat
2015-06-09 18:49 - 2015-06-09 18:49 - 000000017 _____ () C:\Users\John\AppData\Local\resmon.resmoncfg
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
LastRegBack: 2019-04-22 18:18
==================== End of FRST.txt ============================
Here is the Farbar Addition.txt log:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22.04.2019
Ran by [removed] (22-04-2019 19:10:26)
Running from C:\Users\[removed]\Downloads
Windows 8.1 (Update) (X64) (2013-12-02 14:38:42)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3050562961-2452711305-273969980-500 - Administrator - Disabled)
ASPNET (S-1-5-21-3050562961-2452711305-273969980-1007 - Limited - Enabled)
Guest (S-1-5-21-3050562961-2452711305-273969980-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3050562961-2452711305-273969980-1006 - Limited - Enabled)
John (S-1-5-21-3050562961-2452711305-273969980-1002 - Administrator - Enabled) => C:\Users\John
UpdatusUser (S-1-5-21-3050562961-2452711305-273969980-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
4 Elements II (HKLM-x32\…\WTA-56b50aad-5b71-433b-9809-c1eefee5f260) (Version: 2.2.0.98 - WildTangent) Hidden
7-Zip 9.20 (x64 edition) (HKLM\…\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 19.010.20099 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 32.0.0.171 - Adobe)
Adobe Shockwave Player 12.1 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.1.8.158 - Adobe Systems, Inc.)
Airport Mania (HKLM-x32\…\WTA-37dc4118-2b01-42c7-ae66-3c40ec3e7d68) (Version: 2.2.0.95 - WildTangent) Hidden
Apple Application Support (HKLM-x32\…\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
ArcSoft Panorama Maker 5 (HKLM-x32\…\{F18046C5-1C4E-4BE1-A3D6-A6F970E2E8E8}) (Version: 5.0.1.25 - ArcSoft)
AuthenTec TrueAPI 64-bit (HKLM\…\{EBC0CC3F-B7A1-4FC8-8014-4C7BFD3925E8}) (Version: 1.6.0.87 - AuthenTec, Inc.) Hidden
Azteca (HKLM-x32\…\WTA-b61a670c-a890-4e01-9f7f-d0d5188ee35c) (Version: 2.2.0.97 - WildTangent) Hidden
Backup and Sync from Google (HKLM\…\{F9EEDE46-6409-4ECC-8AB6-7062464987A4}) (Version: 3.43.4275.9540 - Google, Inc.)
Bejeweled 3 (HKLM-x32\…\WTA-e454933c-d16a-49d0-9756-1ac9aa623e67) (Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (HKLM-x32\…\WTA-e1ec3cd1-9d50-4be1-a38e-cab24dedc1f1) (Version: 2.2.0.97 - WildTangent) Hidden
Build-a-lot (HKLM-x32\…\WTA-2978d1ca-808b-455e-b745-97509f67f38a) (Version: 2.2.0.98 - WildTangent) Hidden
CCleaner (HKLM\…\CCleaner) (Version: 5.56 - Piriform)
Citrix Online Launcher (HKLM-x32\…\{09DA5EE2-7E46-4DC4-96F9-BFEE50D40659}) (Version: 1.0.408 - Citrix)
Cradle Of Egypt Collector's Edition (HKLM-x32\…\WTA-df787588-5bff-4475-a02e-7ba13b3af292) (Version: 2.2.0.110 - WildTangent) Hidden
Cradle of Rome 2 (HKLM-x32\…\WTA-601183ed-dc4b-4aa1-9eeb-74c4506da614) (Version: 2.2.0.98 - WildTangent) Hidden
Curse at Twilight (HKLM-x32\…\WTA-2a6a2b96-7f9a-46fd-9eb5-b1a8c6c3bc00) (Version: 3.0.2.32 - WildTangent) Hidden
CyberLink LabelPrint (HKLM-x32\…\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6902 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\…\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.9.4928 - CyberLink Corp.)
Cyberlink PhotoDirector (HKLM-x32\…\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.4.4824 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\…\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.10.5422 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\…\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.5.3304 - CyberLink Corp.)
CyberLink PowerDVD (HKLM-x32\…\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.7316.52 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\…\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.6.5011 - CyberLink Corp.)
D3DX10 (HKLM-x32\…\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Delicious: Emily's Childhood Memories Premium Edition (HKLM-x32\…\WTA-4e5252d3-2a67-433a-83f2-521d6477680f) (Version: 3.0.2.32 - WildTangent) Hidden
Dropbox (HKLM-x32\…\Dropbox) (Version: 70.4.93 - Dropbox, Inc.)
Dropbox Update Helper (HKLM-x32\…\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.189.1 - Dropbox, Inc.) Hidden
Energy Star (HKLM-x32\…\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Facebook Video Calling 3.1.0.521 (HKLM-x32\…\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Farm Frenzy (HKLM-x32\…\WTA-48638409-5c04-449a-ba76-8662b16db1b7) (Version: 2.2.0.98 - WildTangent) Hidden
Google Earth Plug-in (HKLM-x32\…\{57BB4801-61C8-4E74-9672-2160728A461E}) (Version: 7.1.5.1557 - Google)
Google Talk Plugin (HKLM-x32\…\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.7 - Google LLC) Hidden
Google Update Helper (HKLM-x32\…\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
GoToMeeting 8.43.1.12771 (HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\GoToMeeting) (Version: 8.43.1.12771 - LogMeIn, Inc.)
Governor of Poker 2 Premium Edition (HKLM-x32\…\WTA-da837508-246c-4692-8782-e0838e3271a3) (Version: 2.2.0.110 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (HKLM-x32\…\{6F340107-F9AA-47C6-B54C-C3A19F11553F}) (Version: 1.00.0000 - Hewlett-Packard Company) Hidden
House of 1000 Doors: Family Secrets (HKLM-x32\…\WTA-14effd6b-c20b-419e-b91e-2194ac550dd2) (Version: 2.2.0.98 - WildTangent) Hidden
HP 3D DriveGuard (HKLM-x32\…\{E8D0E2B8-B64B-44BC-8E01-00DDACBDF78A}) (Version: 6.0.28.1 - Hewlett-Packard Company)
HP Connected Music (Meridian - installer) (HKLM-x32\…\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\HPConnectedMusic) (Version: 1.1 (build 112) hp - Meridian Audio Ltd)
HP CoolSense (HKLM-x32\…\{394B14EA-B072-4440-9510-87797CB12371}) (Version: 2.20.21 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\…\{7F265322-43A2-4C06-925B-F32F938B102C}) (Version: 1.3.0.0 - Hewlett-Packard)
HP ENVY 4500 series Basic Device Software (HKLM\…\{6915424E-704F-4F5D-9057-9C7B406B36DB}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
HP ENVY 4500 series Help (HKLM-x32\…\{95BECC50-22B4-4FCA-8A2E-BF77713E6D3A}) (Version: 30.0.0 - Hewlett Packard)
HP FWUpdateEDO2 (HKLM-x32\…\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP MyRoom (HKLM-x32\…\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)
HP Photo Creations (HKLM-x32\…\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Quick Start (HKLM-x32\…\{574F0207-8E98-46CD-8F79-318348C98C46}) (Version: 1.0.4660.30220 - Hewlett-Packard)
HP Registration Service (HKLM\…\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.6317.4309 - Hewlett-Packard)
HP SimplePass (HKLM-x32\…\{4BACA3B8-F63A-44ED-9A8D-48B4D02AD268}) (Version: 6.0.100.276 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{4AAC4B07-77EF-4BCF-88DC-D24E4DE683E8}) (Version: 8.7.50.3 - HP Inc.)
HP Support Solutions Framework (HKLM-x32\…\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.10.49.21 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\…\{6B1ECC61-B581-400D-BFAF-101B1AAEA5AB}) (Version: 1.4.7 - Hewlett-Packard Company)
HP Update (HKLM-x32\…\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HP Utility Center (HKLM\…\{73237EBB-B26F-4628-8754-4EFE563D72E9}) (Version: 2.1.5 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\…\{EFA01423-3857-468C-B7B6-F30AA08E50BC}) (Version: 1.1.5.1 - Hewlett-Packard)
HPDiagnosticAlert (HKLM-x32\…\{B6465A32-8BE9-4B38-ADC5-4B4BDDC10B0D}) (Version: 1.00.0001 - Microsoft) Hidden
HPDiagnosticCoreDll (HKLM-x32\…\{9262B08F-E183-4FED-A2BD-23FF1A84EB79}) (Version: 1.0.15.0 - Hewlett Packard)
IDT Audio (HKLM-x32\…\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6491.0 - IDT)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.13.1706 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\…\{302600C1-6BDF-4FD1-1303-148929CC1385}) (Version: 3.0.1303.0326 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.2.1000 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\…\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.63463 - Intel Corporation)
Intel(R) Smart Connect Technology 4.0 x64 (HKLM\…\{5D1D65C3-E6D3-4751-AEFD-CAB4E3EB85F2}) (Version: 4.0.41.2072 - Intel)
Intel(R) Update Manager (HKLM-x32\…\{7224B7CE-196C-4E2A-A1AE-1D7BF259FD36}) (Version: 3.4.1942 - Intel Corporation)
Intel(R) WiDi (HKLM\…\{C605440F-2748-435F-9F29-EB1C8134856F}) (Version: 4.1.17.0 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\…\{8e41467d-297e-496d-8b0f-e771b6c87c06}) (Version: 16.11.0 - Intel Corporation)
iSEEK AnswerWorks English Runtime (HKLM-x32\…\{18A8E78B-9EF2-496E-B310-BCD8E4C1DAB3}) (Version: [removed] - Vantage Linguistics)
Jewel Match 3 (HKLM-x32\…\WTA-be2405f1-c299-4f13-8663-9f201b4dfca5) (Version: 2.2.0.98 - WildTangent) Hidden
Luxor Evolved (HKLM-x32\…\WTA-37141a1a-b958-436f-8f2b-10351e715c91) (Version: 2.2.0.98 - WildTangent) Hidden
Mah Jong Medley (HKLM-x32\…\WTA-c5e3e4ff-ec1f-464d-a52a-2388ce8701d2) (Version: 2.2.0.95 - WildTangent) Hidden
Mahjongg Dimensions Deluxe: Tiles in Time (HKLM-x32\…\WTA-799bb3d4-adb0-4bda-adef-dd4b9f0cf531) (Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes version 3.7.1.2839 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.7.1.2839 - Malwarebytes)
Microsoft .NET Framework 1.1 (HKLM-x32\…\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)
Microsoft Mouse and Keyboard Center (HKLM\…\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft Office Professional 2013 - en-us (HKLM\…\ProfessionalRetail - en-us) (Version: 15.0.5119.1000 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 ENU (HKLM\…\{78909610-D229-459C-A936-25D92283D3FD}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\…\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\…\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\…\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\…\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (HKLM-x32\…\{5BABDA39-61CF-41EE-992D-4054B6649A9B}) (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\…\{ED6C77F9-4D7E-447C-9EC0-9A212D075535}) (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 66.0.3 (x64 en-US) (HKLM\…\Mozilla Firefox 66.0.3 (x64 en-US)) (Version: 66.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 66.0.3.7038 - Mozilla)
MuseScore 2 (HKLM-x32\…\{DC8A2B29-D9A7-4D67-A049-BC0A659A2B57}) (Version: 2.1.0 - Werner Schweer and Others)
MuseScore 3 (HKLM\…\{FFF4F949-205B-47D0-B1FC-6F47994A208C}) (Version: 3.0.2.5315 - Werner Schweer and Others)
Mystery P.I. - Curious Case of Counterfeit Cove (HKLM-x32\…\WTA-7f5a4fe2-6278-4865-9f90-8c78b9de3238) (Version: 2.2.0.98 - WildTangent) Hidden
Nikon Message Center 2 (HKLM-x32\…\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.0.1 - Nikon)
NVIDIA Graphics Driver 327.02 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.02 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.12.1031 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (HKLM-x32\…\{90150000-008C-0000-0000-0000000FF1CE}) (Version: 15.0.5119.1000 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (HKLM\…\{90150000-008F-0000-1000-0000000FF1CE}) (Version: 15.0.5119.1000 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (HKLM-x32\…\{90150000-008C-0409-0000-0000000FF1CE}) (Version: 15.0.5119.1000 - Microsoft Corporation) Hidden
Peggle Nights (HKLM-x32\…\WTA-58e6f890-8025-4b4e-ba61-9dce974c6152) (Version: 2.2.0.98 - WildTangent) Hidden
Picture Control Utility (HKLM-x32\…\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.2 - Nikon)
Plants vs. Zombies - Game of the Year (HKLM-x32\…\WTA-c479edd8-84b5-4e8f-9a6b-dc45e2bb7cc5) (Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (HKLM-x32\…\WTA-29f9275e-3d65-406a-b57e-9db870449810) (Version: 2.2.0.97 - WildTangent) Hidden
Product Improvement Study for HP ENVY 4500 series (HKLM\…\{58139103-BACF-4BDC-B71C-955F9164ADA6}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
Quicken 2005 (HKLM-x32\…\{2DBE41DD-2129-4C65-A3D3-5647236A60F3}) (Version: 14.00.0000 - Intuit) Hidden
Quicken 2005 (HKLM-x32\…\InstallShield_{2DBE41DD-2129-4C65-A3D3-5647236A60F3}) (Version: 14.00.0000 - Intuit)
Quicken 2013 (HKLM-x32\…\{034DD4BB-F0D6-4ECF-B064-8E39E3EF7076}) (Version: 22.1.12.7 - Intuit)
QuickTime 7 (HKLM-x32\…\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.21239 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.19.726.2013 - Realtek)
Roads of Rome 3 (HKLM-x32\…\WTA-185e1dc7-9e72-41b6-8432-418d9a43cfa1) (Version: 2.2.0.98 - WildTangent) Hidden
Royal Envoy 2 Collector's Edition (HKLM-x32\…\WTA-5a60b3c3-d9d0-4fae-a47a-64447a38eb35) (Version: 3.0.2.32 - WildTangent) Hidden
swMSM (HKLM-x32\…\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics ClickPad Driver (HKLM\…\SynTPDeinstKey) (Version: 17.0.8.0 - Synaptics Incorporated)
System Requirements Lab for Intel (HKLM-x32\…\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)
Tales of Lagoona (HKLM-x32\…\WTA-ef808e9a-7a05-48da-8102-1e04cf911e1f) (Version: 2.2.0.110 - WildTangent) Hidden
Update Installer for WildTangent Games App (HKLM-x32\…\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version: - WildTangent) Hidden
Vacation Quest™ - Australia (HKLM-x32\…\WTA-c4a5d2af-889b-4165-9fc6-48d08c53efac) (Version: 3.0.2.32 - WildTangent) Hidden
Validity WBF DDK (HKLM\…\{B80C52A3-7666-4068-A371-7867F51E68EB}) (Version: 4.5.122.0 - Validity Sensors, Inc.)
ViewNX 2 (HKLM-x32\…\{DDD62492-32A7-412B-8AF1-2CF032AD42E3}) (Version: 2.1.2 - Nikon)
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HP Games) (HKLM-x32\…\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp) (Version: 4.0.10.5 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Youda Jewel Shop (HKLM-x32\…\WTA-b931662c-9365-4ce3-aaa6-f70196c7de67) (Version: 3.0.2.32 - WildTangent) Hidden
Zemana AntiMalware (HKLM-x32\…\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.74.0.664 - Zemana Ltd.)
Zuma's Revenge (HKLM-x32\…\WTA-3bafd932-77c5-47ca-89c8-03ffac980b51) (Version: 2.2.0.98 - WildTangent) Hidden
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-3050562961-2452711305-273969980-1002_Classes\CLSID\{62634D95-960B-4834-8E71-A70408AD8FD9}\InprocServer32 -> C:\Users\John\AppData\Local\Google\Update\1.3.34.7\psuser_64.dll (Google Inc -> Google LLC)
CustomCLSID: HKU\S-1-5-21-3050562961-2452711305-273969980-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\John\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3050562961-2452711305-273969980-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\John\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3050562961-2452711305-273969980-1002_Classes\CLSID\{C591CFEA-E432-495d-A0BE-58E4CCD87B17}\Shell\Open\Command -> C:\Program Files\Synaptics\SynTP\SynTPCpl.dll (Synaptics Incorporated -> Synaptics Incorporated)
CustomCLSID: HKU\S-1-5-21-3050562961-2452711305-273969980-1002_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\John\AppData\Local\Google\Update\1.3.34.7\psuser_64.dll (Google Inc -> Google LLC)
CustomCLSID: HKU\S-1-5-21-3050562961-2452711305-273969980-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\John\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3050562961-2452711305-273969980-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\John\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync64.dll [2019-04-09] (Google LLC -> Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync64.dll [2019-04-09] (Google LLC -> Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync64.dll [2019-04-09] (Google LLC -> Google)
ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers1: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll [2019-04-18] (Zemana D.O.O. Sarajevo -> )
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-19] (Igor Pavlov) [File not signed]
ContextMenuHandlers1: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt_20151012_15_06_38.dll [2015-10-12] (CyberLink Corp. -> Cyberlink)
ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2019-04-09] (Google LLC -> Google)
ContextMenuHandlers2: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt_20151012_15_06_38.dll [2015-10-12] (CyberLink Corp. -> Cyberlink)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-19] (Igor Pavlov) [File not signed]
ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2019-04-09] (Google LLC -> Google)
ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-04-03] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\WINDOWS\system32\igfxpph.dll [2013-10-04] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2013-08-29] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll [2019-04-18] (Zemana D.O.O. Sarajevo -> )
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2013-12-21 21:45 - 2013-08-16 06:21 - 000339456 ____N (IDT, Inc.) [File not signed] C:\Program Files\IDT\WDM\STacSV64.exe
2013-05-11 17:45 - 2013-05-11 17:45 - 000733696 _____ (Intel(R) Corporation) [File not signed] C:\Program Files\Intel\iCLS Client\HeciServer.exe
2013-03-19 17:21 - 2013-03-19 17:21 - 000028160 _____ () [File not signed] C:\Windows\system32\valWBFPolicyService.exe
2019-04-22 18:30 - 2019-04-22 18:30 - 005198336 _____ (AVAST Software) [File not signed] C:\Users\John\Downloads\aswMBR.exe
2013-10-08 20:11 - 2004-08-17 12:00 - 000413696 _____ (Microsoft Corporation) [File not signed] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\MSVCP60.dll
2013-08-30 22:18 - 2013-08-30 22:18 - 000286720 _____ (Intel Corporation) [File not signed] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\PsiData.dll
2013-08-30 22:18 - 2013-08-30 22:18 - 000517120 _____ (Intel Corporation) [File not signed] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\ISDI2.dll
2019-04-22 18:30 - 2019-04-22 18:30 - 001228800 _____ (ALWIL Software) [File not signed] C:\Users\John\AppData\Local\Temp\_av4_\aswEngin.dll
2019-04-22 18:30 - 2019-04-22 18:30 - 000086016 _____ (ALWIL Software) [File not signed] C:\Users\John\AppData\Local\Temp\_av4_\aswScan.dll
2019-04-22 18:30 - 2019-04-22 18:30 - 000081920 _____ (ALWIL Software) [File not signed] C:\Users\John\AppData\Local\Temp\_av4_\aswCmnOS.dll
2019-04-22 18:30 - 2019-04-22 18:30 - 000131072 _____ (ALWIL Software) [File not signed] C:\Users\John\AppData\Local\Temp\_av4_\aswCmnB.dll
2019-04-22 18:30 - 2019-04-22 18:30 - 000192512 _____ (ALWIL Software) [File not signed] C:\Users\John\AppData\Local\Temp\_av4_\aswCmnS.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\WINDOWS\system32\Drivers\btmhsf.sys:Microsoft_Appcompat_ReinstallUpgrade [0]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ZAM.exe" /service => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ZAM.exe" /service => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\zam64.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\zamguard64.sys => ""="Driver"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 09:25 - 2013-08-22 09:25 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path: C:\ProgramData\Oracle\Java\javapath;C:\Program Files (x86)\HP SimplePass\x64;C:\Program Files (x86)\HP SimplePass\;;C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Windows Live\Shared;C:\Program Files (x86)\Intel\OpenCL SDK\3.0\bin\x86;C:\Program Files (x86)\Intel\OpenCL SDK\3.0\bin\x64;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\QuickTime\QTSystem\;C:\Program Files\Intel\WiFi\bin\;C:\Program Files\Common Files\Intel\WirelessCommon\
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\John\SkyDrive\Pictures\Old St. Mary.jpg
DNS Servers: [removed] - [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (No File)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
If an entry is included in the fixlist, it will be removed.
HKLM\…\StartupApproved\Run32: => "Nikon Message Center 2"
HKLM\…\StartupApproved\Run32: => "Dropbox"
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\StartupApproved\StartupFolder: => "Amazon Cloud Drive.lnk"
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\StartupApproved\StartupFolder: => "Dropbox.lnk"
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\StartupApproved\Run: => "Power2GoExpress8"
HKU\S-1-5-21-3050562961-2452711305-273969980-1002\…\StartupApproved\Run: => "Discord"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{1E7FDCE0-89D7-4D6F-BC03-08711F7FB019}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{D19AA599-2E59-4983-A95F-4932F0E1CA95}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{5A14A141-9AF8-414B-AB2E-8B7D1523C36F}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe (Intel Wireless Display -> Intel Corporation)
FirewallRules: [{0C3BB3A2-FB0B-44FC-B4CC-562DD6FCDCEA}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{D914B660-74F0-480B-B0DE-B404DE8E6ACC}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{902214B3-4B3D-4B2A-9839-B6FE12E1FB05}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{090F29D0-B485-4B5B-A440-66D85B3D10B4}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{ECF275D6-C6A9-4EEA-8193-677BBA749EF0}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{FE3361EB-981A-46F8-ADD0-1040536950AC}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{3994FD5D-6540-4322-AA7D-6D0125F54A27}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe (Meridian Audio Ltd -> )
FirewallRules: [{3BB4D7F6-1395-47F9-9E90-B68808D79510}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe (Meridian Audio Ltd -> )
FirewallRules: [{37CF8AC5-D375-485B-B43E-B2E27540C940}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe (Meridian Audio Ltd -> Meridian Audio Ltd)
FirewallRules: [{BB6E8656-BA52-4617-93E5-5D60CE3528A5}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe (Meridian Audio Ltd -> Meridian Audio Ltd)
FirewallRules: [{5E651CF8-EA26-410C-BDD8-CFCC01E7E5F1}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe (Meridian Audio Ltd -> Meridian Audio Ltd)
FirewallRules: [{6B41DBA4-04B9-442E-8DB6-6BCD307D30B1}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe (Meridian Audio Ltd -> Meridian Audio Ltd)
FirewallRules: [{2686689A-8730-41D3-B302-66E4FBF94D16}] => (Allow) LPort=1900
FirewallRules: [{9DF35F11-666B-4078-AFD5-6BAA5E325CFD}] => (Allow) LPort=2869
FirewallRules: [{BE33DA41-C9B7-4839-857A-8906E463A592}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{5071A55D-EBE3-4023-BC67-82160F7F2078}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{AD21E963-BE7C-477C-A840-15103ACCB0CF}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{2F868700-B5BB-42FE-86D7-0BE00D4FB04A}] => (Allow) C:\Users\John\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe (Skype Software Sarl -> Skype Limited)
FirewallRules: [{7A6A668F-EFDE-4BA4-87BB-59210CFA22A1}] => (Allow) C:\Program Files\HP\HP ENVY 4500 series\Bin\DeviceSetup.exe (Hewlett Packard -> Hewlett-Packard Development Company, LP)
FirewallRules: [{B925E75D-09B9-4222-BD1E-0BBBD5CAD534}] => (Allow) LPort=5357
FirewallRules: [{5B9C0192-22EC-4828-9951-56EB3907BB75}] => (Allow) C:\Program Files\HP\HP ENVY 4500 series\Bin\HPNetworkCommunicatorCom.exe (Hewlett Packard -> Hewlett-Packard Development Company, LP)
FirewallRules: [{ACC5F396-B022-4CFE-8A4F-2194019CB5B6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{2175022D-70A4-4074-BE9E-61596B2FB255}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{E3B1F49A-15E4-4D4B-8B9B-79B12B1D77E7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{456D29AD-E847-48EC-91CF-0496017BF6D1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [TCP Query User{3107AB92-9A16-4941-96DA-4C4EEFFAC204}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [UDP Query User{C9A45BEB-5977-421E-A3AD-45F8066F14BD}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{2D26A416-BD85-43F2-9B15-193E2F94B806}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe (Intel Corporation-Mobile Wireless Group -> )
FirewallRules: [{3474E4C1-D9A9-4FB9-9435-4E608E09E01E}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{3995B885-316F-47D2-99C6-8E9D0B13EB9A}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{C84CDA18-9BB5-4CD8-8E3D-83F42C57CF8F}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{31FA62C3-5EC8-417D-BDBB-0D0DD129163C}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{15A1ABA5-94B7-4A4B-A149-8487F0B1E8D8}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc -> Dropbox, Inc.)
==================== Restore Points =========================
08-04-2019 10:06:32 Scheduled Checkpoint
15-04-2019 17:35:21 Scheduled Checkpoint
17-04-2019 22:34:01 Configured Media Suite
22-04-2019 18:03:41 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============
Name: High Definition Audio Device
Description: High Definition Audio Device
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: HdAudAddService
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/22/2019 07:07:34 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - WlanBindEventCallback Received a callback for WLAN BIND/UNBIND event, BIND = 1.
Error: (04/22/2019 07:07:31 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - WlanBindEventCallback Received a callback for WLAN BIND/UNBIND event, BIND = 0.
Error: (04/21/2019 07:40:16 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.22013 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 1230
Start Time: 01d4f836418576c7
Termination Time: 4294967295
Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.22013_x64__8wekyb3d8bbwe\LiveComm.exe
Report Id: 348fc74b-642a-11e9-bf60-68172962675d
Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.22013_x64__8wekyb3d8bbwe
Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1
Error: (04/16/2019 09:20:02 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 37819328
Error: (04/16/2019 09:20:02 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 37819328
Error: (04/16/2019 09:20:02 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/15/2019 10:42:30 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - WlanBindEventCallback Received a callback for WLAN BIND/UNBIND event, BIND = 1.
Error: (04/15/2019 10:42:27 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - WlanBindEventCallback Received a callback for WLAN BIND/UNBIND event, BIND = 0.
System errors:
=============
Error: (04/22/2019 07:01:25 PM) (Source: Ntfs) (EventID: 55) (User: NT AUTHORITY)
Description: A corruption was discovered in the file system structure on volume Windows.
The Master File Table (MFT) contains a corrupted file record. The file reference number is 0x40000000347a5. The name of the file is "".
Error: (04/22/2019 06:11:30 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
Error: (04/22/2019 06:11:24 PM) (Source: DCOM) (EventID: 10010) (User: JINGRAMPC)
Description: The server {AD3EDBCA-0901-415B-82E9-C16D3B65E38C} did not register with DCOM within the required timeout.
Error: (04/22/2019 06:05:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The NVIDIA Update Service Daemon service failed to start due to the following error:
The service did not start due to a logon failure.
Error: (04/22/2019 06:05:37 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error:
%%1326 = The user name or password is incorrect.
To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
Error: (04/22/2019 06:01:12 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The File History Service service hung on starting.
Error: (04/22/2019 05:55:53 PM) (Source: BTHUSB) (EventID: 30) (User: )
Description: The local adapter does not support an important Low Energy controller state. The minimum required supported state mask is 0x1f7fffff, got 0x1f3fffff. Low Energy functionality will be disabled.
Error: (04/22/2019 05:55:27 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Windows Media Player Network Sharing Service service depends on the Windows Search service which failed to start because of the following error:
%%3 = The system cannot find the path specified.
Windows Defender:
===================================
Date: 2019-04-17 13:55:35.838
Description:
Windows Defender scan has been stopped before completion.
Scan ID: {9521F4E1-DDA6-4511-A0C8-41FA203C03DF}
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2019-04-16 13:38:13.443
Description:
Windows Defender scan has been stopped before completion.
Scan ID: {5B20A090-ADC4-4A7C-9CC3-C9B4A453DA19}
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2019-04-16 10:32:04.167
Description:
Windows Defender scan has been stopped before completion.
Scan ID: {0E2D7234-82F4-441E-8D96-8CED9CFAC740}
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2019-04-15 10:14:45.472
Description:
Windows Defender scan has been stopped before completion.
Scan ID: {FE8CEC48-C2D4-468D-BC22-28DB79500D1A}
Scan Type: Antimalware
Scan Parameters: Quick Scan
Date: 2019-04-07 18:28:04.571
Description:
Windows Defender scan has been stopped before completion.
Scan ID: {70B823D7-BC22-4DD3-8BB4-8388B241BF3A}
Scan Type: Antimalware
Scan Parameters: Quick Scan
CodeIntegrity:
===================================
Date: 2015-01-29 11:34:04.773
Description:
Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-01-29 11:34:04.695
Description:
Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-01-29 11:34:04.508
Description:
Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-01-29 11:34:04.414
Description:
Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-01-08 08:33:14.623
Description:
Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-01-08 08:33:14.545
Description:
Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-01-07 13:11:07.910
Description:
Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-01-07 13:11:07.832
Description:
Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
BIOS: Insyde F.65 11/20/2014
Motherboard: Hewlett-Packard 1966
Processor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz
Percentage of memory in use: 40%
Total physical RAM: 12220.02 MB
Available physical RAM: 7328.59 MB
Total Virtual: 12988.02 MB
Available Virtual: 7874.91 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:904.21 GB) (Free:810.97 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (RECOVERY) (Fixed) (Total:26.18 GB) (Free:2.6 GB) NTFS ==>[system with boot components (obtained from drive)]
\\?\Volume{118ac421-a7e4-4045-989d-320167ab8240}\ (WINRE) (Fixed) (Total:0.39 GB) (Free:0.13 GB) NTFS
\\?\Volume{d45ae283-ba5e-4498-87eb-b9633cb2e83d}\ () (Fixed) (Total:0.34 GB) (Free:0.07 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 1E1F4777)
Partition: GPT.
==================== End of Addition.txt ============================
