Windows 8 Slow Start, Slow Run and crashes to black screen

Hi there

HP Laptop is behaving as described in Topic Title. Below are the three files you requested.

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2019-07-28 15:19:36
—————————–
15:19:36.164    OS Version: Windows x64 6.2.9200
15:19:36.164    Number of processors: 4 586 0x4501
15:19:36.164    ComputerName: HP  UserName:
15:19:37.055    Initialize success
15:19:37.055    VM: initialized successfully
15:19:37.055    VM: outdated driver version !
15:20:59.925    AVAST engine defs: 17030301
15:21:24.347    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000002c
15:21:24.347    Disk 0 Vendor: HGST_HTS545050A7E380 GG2OACA0 Size: 476940MB BusType: 11
15:21:24.535    Disk 0 MBR read successfully
15:21:24.550    Disk 0 MBR scan
15:21:24.566    Disk 0 unknown MBR code
15:21:24.566    Disk 0 Partition 1 00     EE          GPT            476940 MB offset 1
15:21:24.722    Disk 0 scanning C:\WINDOWS\system32\drivers
15:22:24.771    Service scanning
15:23:58.475    Modules scanning
15:23:58.475    Disk 0 trace - called modules:
15:23:58.584    ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys ACPI.sys storport.sys hal.dll iaStorA.sys
15:23:59.116    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe0018d7b6630]
15:23:59.116    3 CLASSPNP.SYS[fffff80118629e10] -> nt!IofCallDriver -> [0xffffe0018d7d67c0]
15:23:59.131    5 hpdskflt.sys[fffff8011873342b] -> nt!IofCallDriver -> [0xffffe0018cbd35e0]
15:23:59.147    7 ACPI.sys[fffff8011757bc21] -> nt!IofCallDriver -> \Device\0000002c[0xffffe0018beb37c0]
15:24:00.147    AVAST engine scan C:\WINDOWS
15:24:03.803    AVAST engine scan C:\WINDOWS\system32
15:30:42.621    AVAST engine scan C:\WINDOWS\system32\drivers
15:31:14.809    AVAST engine scan C:\Users\user
15:55:46.608    Disk 0 MBR has been saved successfully to "C:\Users\user\Desktop\WHAT THE TECH\MBR.dat"
15:55:46.905    The log file has been saved successfully to "C:\Users\user\Desktop\WHAT THE TECH\aswMBR.txt"

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-07-2019 01
Ran by [removed] (administrator) on HP (Hewlett-Packard HP Pavilion TS 14 Notebook PC) (28-07-2019 16:13:09)
Running from C:\Users\[removed]\Desktop\WHAT THE TECH\Farbart Recovery Tool
[removed] Platform: Windows 8.1 (Update) (X64) Language: English (United Kingdom)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\HidMonitorSvc.exe
(Andrea Electronics -> Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc. -> Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVAST Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.154.333\AvastBrowserCrashHandler.exe
(AVAST Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.154.333\AvastBrowserCrashHandler64.exe
(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\aswidsagent.exe
(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(BillP Studios -> BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
(Comodo Security Solutions, Inc. -> COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(Comodo Security Solutions, Inc. -> COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Comodo Security Solutions, Inc. -> COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Comodo Security Solutions, Inc. -> COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(CyberLink Corp. -> CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp. -> CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink Corp. -> CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Huawei Software Technologies Co., LTD. -> ) C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation - pGFX -> ) C:\Windows\System32\igfxTray.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation - Software and Firmware Products -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) Corporation) [File not signed] C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Piriform Software Ltd -> Piriform Software Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(SEIKO EPSON Corporation -> Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIJBE.EXE
(SUPERAntiSpyware.com -> SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Support.com, Inc. -> SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [704344 2016-02-28] (Alps Electric Co., LTD. -> Alps Electric Co., Ltd.)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7188552 2013-05-28] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [261000 2019-04-15] (AVAST Software s.r.o. -> AVAST Software)
HKLM-x32\…\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [98024 2019-05-14] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [439360 2013-08-13] (BillP Studios -> BillP Studios)
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIJBE.EXE [283232 2016-04-08] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [9198512 2019-07-25] (Support.com, Inc. -> SUPERAntiSpyware)
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [23153344 2019-07-11] (Piriform Software Ltd -> Piriform Software Ltd)
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {37c35ab0-c556-11e8-bf41-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {62589221-754c-11e7-bf19-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {62589289-754c-11e7-bf19-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {b7ff2c4e-4d54-11e7-bf15-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {b7ff2cac-4d54-11e7-bf15-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {e4031dbe-902c-11e7-bf1f-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [439360 2013-08-13] (BillP Studios -> BillP Studios)
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIJBE.EXE [283232 2016-04-08] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [9198512 2019-07-25] (Support.com, Inc. -> SUPERAntiSpyware)
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [23153344 2019-07-11] (Piriform Software Ltd -> Piriform Software Ltd)
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\MountPoints2: {37c35ab0-c556-11e8-bf41-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\MountPoints2: {62589221-754c-11e7-bf19-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\MountPoints2: {62589289-754c-11e7-bf19-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\MountPoints2: {b7ff2c4e-4d54-11e7-bf15-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\MountPoints2: {b7ff2cac-4d54-11e7-bf15-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\MountPoints2: {e4031dbe-902c-11e7-bf1f-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{30C521FB-255B-46C8-9F0D-EE5AE371C9AA}] -> C:\Program Files (x86)\AVAST Software\Browser\Application\75.1.1528.100\Installer\chrmstp.exe [2019-07-24] (AVAST Software s.r.o. -> AVAST Software)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> "C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level
HKLM\Software\…\Authentication\Credential Providers: [{538C240D-3DEE-4032-AB4C-08A3A6EB0861}] -> C:\Program Files (x86)\CyberLink\YouCam\CLCredProv\x64\CLCredProv.dll [2013-05-22] (CyberLink Corp. -> CyberLink)
GroupPolicy: Restriction - Chrome <==== ATTENTION
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {04D842D8-2A44-4BD7-BC98-4AE3C4D2EBCE} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {0775CCB2-0BE3-4538-A796-9FD3A4916FC2} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-10-30] (AVAST Software s.r.o. -> AVAST Software)
Task: {094CD275-5C71-4753-B57E-5566CA859498} - System32\Tasks\Microsoft\Windows\SideShow\AutoWake => {E51DFD48-AA36-4B45-BB52-E831F02E8316}
Task: {0A846C5E-97A5-4199-9304-8A3C808F130D} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [13065408 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {0F6DBBD1-1FA5-490B-A482-1F43FCC689E6} - System32\Tasks\Microsoft\Windows\SideShow\SystemDataProviders => {7CCA6768-8373-4D28-8876-83E8B4E3A969}
Task: {13756301-DE12-424C-BAD5-F283A2B56C53} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [561984 2011-06-01] (Apple Inc. -> Apple Inc.)
Task: {1750A00D-04E4-462C-B0D0-6ABA7AACE6B5} - System32\Tasks\{1A8C4248-D550-4608-817B-F01212A4AAB3} => "c:\program files (x86)\mozilla firefox\firefox.exe" hxxp://ui.skype.com/ui/0/6.11.0.102/en/abandoninstall?source=lightinstaller&page;=tsBing
Task: {17B57CE1-3834-4627-9AC4-21ED67DA5299} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFReport.exe [88120 2016-09-17] (Hewlett-Packard Company -> Hewlett-Packard)
Task: {2E957789-B974-403C-A1F3-36F0A48C761F} - System32\Tasks\Avira_Antivirus_Systray => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [2758096 2019-07-28] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
Task: {3393A359-8BB2-406C-AF19-BEC127F2F18A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe
Task: {3BF8E122-5C52-48FF-909C-19A7F2F5C49B} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2925960 2019-04-15] (AVAST Software s.r.o. -> AVAST Software)
Task: {3E147675-4EEB-4872-9C4C-6933D7D8D4F8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [208760 2018-06-27] (HP Inc. -> HP Inc.)
Task: {49738C9D-0E77-488D-A322-BE6311D8613B} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [339008 2013-03-12] (CyberLink Corp. -> CyberLink Corp.)
Task: {4BB9AD6C-0CB4-4E2C-A92E-DADA427588ED} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-07-24] (Adobe Inc. -> Adobe)
Task: {63178DD9-F920-4D08-B9BB-93C394248A8A} - System32\Tasks\COMODO\COMODO Maintenance {947247B5-026A-4437-9371-770782BE839D} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [5737152 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {6C2EBD39-D8E3-4939-B40C-F4E9485C3C25} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [13065408 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {785DCF5D-62E5-4BB2-A122-5835E67B14B8} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1343904 2013-06-07] (Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.)
Task: {7D6AC750-4DEF-4573-A20A-BA63432F8FB5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [541496 2013-06-07] (Hewlett-Packard Company -> Hewlett-Packard Company)
Task: {7FE49948-1816-45A2-BCB3-2AC46FA5F9D5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [541496 2013-06-07] (Hewlett-Packard Company -> Hewlett-Packard Company)
Task: {83EB0807-ECA4-4CBD-A7AE-CE0EB45211ED} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [619416 2019-07-11] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {890FB8E4-BD97-48ED-A552-23A2C0B86C5F} - System32\Tasks\Avast Secure Browser Heartbeat Task (Logon) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [1815792 2019-07-18] (AVAST Software s.r.o. -> AVAST Software)
Task: {8B6759EE-1C08-4B8F-955C-774AB5A6544E} - System32\Tasks\Microsoft\Windows\SideShow\SessionAgent => {45F26E9E-6199-477F-85DA-AF1EDfE067B1}
Task: {8DB763F8-C999-46DF-BF5D-9D75B75F9036} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1195544 2018-12-16] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Task: {A1575042-A1F5-417F-81DC-99A8FB2F111D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [651400 2017-10-27] (Hewlett Packard -> HP Inc.)
Task: {A787F04B-46FE-422C-99C6-48BACFC4AF8A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1059704 2018-11-09] (HP Inc. -> HP Inc.)
Task: {AE02C979-B5AB-42F7-942F-B99AC773B03F} - System32\Tasks\COMODO\COMODO CMC {06A09C0F-DD9C-4191-A670-71115CD78627} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [5737152 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {AF850082-79A2-4BE9-AD5C-A1F631A80A36} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe
Task: {B062BB8E-E2F4-43E3-80EE-E41191D67B2A} - System32\Tasks\Avast Secure Browser Heartbeat Task (Hourly) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [1815792 2019-07-18] (AVAST Software s.r.o. -> AVAST Software)
Task: {B0FFA5D9-8525-40B9-9EF9-B4982952D370} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [110144 2013-03-12] (CyberLink Corp. -> CyberLink)
Task: {B3F2DC17-C9FD-4C60-9357-C6FB57A11965} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\avast software\overseer\overseer.exe [2281944 2019-06-14] (AVAST Software s.r.o. -> AVAST Software)
Task: {B45CAF8D-08AC-4F67-A7DA-C25F58764BB1} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe
Task: {C382CDF4-93B1-453E-A3B9-14ADC88A0D5A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1059704 2018-11-09] (HP Inc. -> HP Inc.)
Task: {C9DCF59E-6B97-4C0C-8641-B8261089C8CA} - System32\Tasks\Microsoft\Windows\MobilePC\HotStart => {06DA0625-9701-43da-BFD7-FBEEA2180A1E}
Task: {CE2956C6-67AE-4D0C-80FB-5ADCFEA95C6D} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-10-30] (AVAST Software s.r.o. -> AVAST Software)
Task: {DB017F43-35F5-4CB0-87EB-BDB85CB72CA4} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_223_Plugin.exe [1457208 2019-07-24] (Adobe Inc. -> Adobe)
Task: {DB21EF32-6BA9-4118-BBC1-BC4FF48961E5} - System32\Tasks\Microsoft\Windows\SideShow\GadgetManager => {FF87090D-4A9A-4f47-879B-29A80C355D61}
Task: {DF765405-6455-4249-AEED-9FCBFA416D24} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [5737152 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {E072A413-5299-4FA3-B5AC-4963C09C8C8B} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [5737152 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {EE823C10-B927-4C2E-92A9-CBA5A125EA62} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [16835256 2019-07-11] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {F267BEBD-78CC-4B54-80EB-C67C0DB12181} - System32\Tasks\COMODO\COMODO Telemetry {18AD3DFA-30C0-4B5F-84F7-F1870B1A4921} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [13065408 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{1DBD3B41-FDE0-4A25-AD74-6E13475A3EDE}: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{399BD968-2383-44A4-B8B6-535455314511}: [DhcpNameServer] [removed] [removed]

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT13/2
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/2
HKU\S-1-5-21-1403370322-224015993-469023631-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/2
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/2
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKLM -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag;=hp-uk3-vsb-21&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKLM-x32 -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag;=hp-uk3-vsb-21&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001 -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag;=hp-uk3-vsb-21&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag;=hp-uk3-vsb-21&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard Company -> Hewlett-Packard)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard Company -> Hewlett-Packard)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKU\S-1-5-21-1403370322-224015993-469023631-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

FireFox:
========
FF DefaultProfile: f1tp426w.default
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\f1tp426w.default [2019-07-28]
FF NewTab: Mozilla\Firefox\Profiles\f1tp426w.default -> about:newtab
FF HomepageOverride: Mozilla\Firefox\Profiles\f1tp426w.default -> Enabled: [removed]
FF NewTabOverride: Mozilla\Firefox\Profiles\f1tp426w.default -> Enabled: [removed]
FF NewTabOverride: Mozilla\Firefox\Profiles\f1tp426w.default -> Enabled: [removed]
FF Extension: (NewTabURL) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\f1tp426w.default\Extensions\[removed] [2016-04-28] [Legacy]
FF Extension: (Avast SafePrice | Comparison, deals, coupons) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\f1tp426w.default\Extensions\[removed] [2019-06-14]
FF Extension: (Avast Online Security) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\f1tp426w.default\Extensions\[removed] [2019-07-24]
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\f1tp426w.default\searchplugins\yahoo-avast.xml [2017-06-18]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_223.dll [2019-07-24] (Adobe Inc. -> )
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_223.dll [2019-07-24] (Adobe Inc. -> )
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll [2013-04-03] (Adobe Systems, Inc.) [File not signed]
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-20] (Apple Inc. -> )
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.29 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-05-08] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-05-08] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-05-03] (Adobe Inc. -> Adobe Systems Inc.)

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.google.com"
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default [2019-07-25]
CHR HKLM\…\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\…\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\…\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [daanglpcpkjjlkhcbladppjphglbigam] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-07-2019 01
Ran by [removed] (28-07-2019 16:19:17)
Running from C:\Users\[removed]\Desktop\WHAT THE TECH\Farbart Recovery Tool
Windows 8.1 (Update) (X64) (2016-02-28 20:01:01)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1403370322-224015993-469023631-500 - Administrator - Disabled)
Guest (S-1-5-21-1403370322-224015993-469023631-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1403370322-224015993-469023631-1003 - Limited - Enabled)
user (S-1-5-21-1403370322-224015993-469023631-1001 - Administrator - Enabled) => C:\Users\user

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {88AE6B46-DC3C-455A-A21B-085F285A3546}
AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Avira Antivirus (Enabled - Up to date) {33CF8AA2-FA06-4AD4-98AB-332D53DD7FFB}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
FW: COMODO Firewall (Disabled) {A60587C6-B28F-3D1C-0869-12ED515CC3C3}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\…\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
adbLink version 2.06 (HKLM-x32\…\{05CF1DD3-4A94-4219-B176-BB1796680A6C}_is1) (Version: 2.06 - jocala.com)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 19.012.20035 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 32.0.0.223 - Adobe)
Adobe Shockwave Player 12.0 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)
ALPS Touch Pad Driver (HKLM\…\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1202.1711.102 - Alps Electric)
Apple Application Support (HKLM-x32\…\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avast Free Antivirus (HKLM-x32\…\Avast Antivirus) (Version: 19.4.2374 - AVAST Software)
Avast Secure Browser (HKLM-x32\…\Avast Secure Browser) (Version: 75.1.1528.100 - AVAST Software)
Avira (HKLM-x32\…\{07641669-3466-4C2E-BA95-256AEA825533}) (Version: 1.2.134.23796 - Avira Operations GmbH & Co. KG) Hidden
Avira (HKLM-x32\…\{b7f9e12f-ca78-4964-9ffc-54acebd17675}) (Version: 1.2.134.23796 - Avira Operations GmbH & Co. KG)
Avira Antivirus (HKLM-x32\…\Avira Antivirus) (Version: 15.0.1907.1514 - Avira Operations GmbH & Co. KG)
Avira Phantom VPN (HKLM-x32\…\Avira Phantom VPN) (Version: 2.25.1.30710 - Avira Operations GmbH & Co. KG)
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\…\CCleaner) (Version: 5.60 - Piriform)
COMODO Firewall (HKLM\…\{901D1D88-408D-48E5-80DD-CC3145BD8456}) (Version: 12.0.0.6818 - COMODO Security Solutions Inc.)
CyberLink LabelPrint (HKLM-x32\…\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.4.6515 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\…\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.4.2928 - CyberLink Corp.)
Cyberlink PhotoDirector (HKLM-x32\…\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.2.4128 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\…\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.4.3026 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\…\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.4.3021 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\…\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.1.3024 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\…\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.1.2922 - CyberLink Corp.)
D3DX10 (HKLM-x32\…\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Defraggler (HKLM\…\Defraggler) (Version: 2.21 - Piriform)
DisableMSDefender (HKLM\…\{74FE39A0-FB76-47CD-84BA-91E2BBB17EF2}) (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Energy Star (HKLM-x32\…\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Epson Connect Guide (HKLM-x32\…\Epson Connect Guide) (Version:  - )
Epson Event Manager (HKLM-x32\…\{8F01524C-0676-4CC1-B4AE-64753C723391}) (Version: 3.01.0005 - Seiko Epson Corporation)
Epson Network Guide XP-700 Series (HKLM-x32\…\XP-700 Series Netg) (Version:  - )
EPSON Scan (HKLM-x32\…\EPSON Scanner) (Version:  - Seiko Epson Corporation)
Epson User's Guide XP-700 Series (HKLM-x32\…\XP-700 Series Useg) (Version:  - )
EPSON XP-700 Series Printer Uninstall (HKLM\…\EPSON XP-700 Series) (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (HKLM-x32\…\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
Google Update Helper (HKLM-x32\…\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.21.169 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.1 (HKLM-x32\…\{6F340107-F9AA-47C6-B54C-C3A19F11553F}) (Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HiSuite (HKLM-x32\…\Hi Suite) (Version: 1.0 - Huawei Technologies Co.,Ltd)
HP 3D DriveGuard (HKLM-x32\…\{AE2F1669-5B1F-47C5-B639-78D74DD0BCE4}) (Version: 6.0.9.1 - Hewlett-Packard Company)
HP Connected Music (Meridian - installer) (HKLM-x32\…\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)
HP CoolSense (HKLM-x32\…\{59F8C5AA-91BD-423D-BF05-09A80F39898F}) (Version: 2.10.62 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\…\{69A7894E-99A2-423D-8815-7D3A23F1C413}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Registration Service (HKLM\…\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.6838.4521 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{C88F84E5-AE23-44BD-922C-2ABEACACAF7A}) (Version: 7.2.23.56 - Hewlett-Packard Company)
HP Support Solutions Framework (HKLM-x32\…\{D2F04839-0AD0-4F06-A6B5-6DFF05E27B67}) (Version: 11.50.0019 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\…\{1C5BBAD8-4079-4014-8803-751333FBC112}) (Version: 1.0.8 - Hewlett-Packard Company)
HP Utility Center (HKLM\…\{A48BD764-CFDF-40A5-A07A-710908044F5D}) (Version: 2.2.2 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\…\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.6.1 - Hewlett-Packard Company)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.3.1520 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4264 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.6.0.1033 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\…\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
iTunes (HKLM\…\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Junk Mail filter update (HKLM-x32\…\{0BE9E708-5DC0-4963-9CFD-0AA519090E79}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
KingRoot version 3.5.0.1157 (HKLM-x32\…\{FA3B7324-9EB4-4ADC-84D0-5461BE113832}_is1) (Version: 3.5.0.1157 - KingRoot)
Kodi (HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\Kodi) (Version:  - XBMC Foundation)
Kodi (HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\Kodi) (Version:  - XBMC Foundation)
Malwarebytes version 3.7.1.2839 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.7.1.2839 - Malwarebytes)
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\…\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.16.27012 (HKLM-x32\…\{427ada59-85e7-4bc8-b8d5-ebf59db60423}) (Version: 14.16.27012.6 - Microsoft Corporation)
Movie Maker (HKLM-x32\…\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\…\{EB3DF0F0-0525-4C5A-A2F8-DEC868A3075D}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 57.0 (x64 en-GB) (HKLM\…\Mozilla Firefox 57.0 (x64 en-GB)) (Version: 57.0 - Mozilla)
Mozilla Firefox 68.0.1 (x64 en-GB) (HKLM\…\Mozilla Firefox 68.0.1 (x64 en-GB)) (Version: 68.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 61.0.2 - Mozilla)
OpenOffice 4.0.1 (HKLM-x32\…\{24B89186-2A56-4D28-B930-6F4FCF224E2F}) (Version: 4.01.9714 - Apache Software Foundation)
Realtek Card Reader (HKLM-x32\…\{F0A8BF4A-972F-41E0-9800-1EFE3BF28266}) (Version: 1.1.9200.15 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.15.410.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6923 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\…\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.00.12.0906 - REALTEK Semiconductor Corp.)
Skype Click to Call (HKLM-x32\…\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype™ 7.40 (HKLM-x32\…\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.40.151 - Skype Technologies S.A.)
SpywareBlaster 5.5 (HKLM-x32\…\SpywareBlaster_is1) (Version: 5.5.0 - BrightFort LLC)
SUPERAntiSpyware (HKLM\…\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1264 - SUPERAntiSpyware.com)
swMSM (HKLM-x32\…\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinPatrol (HKLM\…\{4BB7A109-FDB5-45E3-9DB9-ECB2EA7B80EE}) (Version: 28.6.2013.0 - BillP Studios)

Packages:
=========
Box for Windows 8 -> C:\Program Files\WindowsApps\134D4F5B.Box_2.1.4.4_neutral__2qk4zy5s3qmee [2016-03-01] (Box, Inc.)
eBay -> C:\Program Files\WindowsApps\eBayInc.eBay_1.6.0.34_neutral__1618n3s9xq8tw [2016-03-01] (eBay, Inc)
Fresh Paint -> C:\Program Files\WindowsApps\Microsoft.FreshPaint_2.0.15133.0_x86__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation)
Games -> C:\Program Files\WindowsApps\Microsoft.XboxLIVEGames_2.0.139.0_x64__8wekyb3d8bbwe [2014-11-22] (Microsoft Corporation) [MS Ad]
Getting Started with Windows 8 -> C:\Program Files\WindowsApps\AD2F1837.GettingStartedwithWindows8_1.6.0.0_neutral__v10z8vjag6ke6 [2016-03-01] (Hewlett-Packard Company)
HP Games -> C:\Program Files\WindowsApps\AD2F1837.HPGames_1.0.0.50_neutral__v10z8vjag6ke6 [2013-09-26] (Hewlett-Packard Company)
HP Registration -> C:\Program Files\WindowsApps\AD2F1837.HPRegistration_1.2.1.166_neutral__v10z8vjag6ke6 [2016-03-01] (Hewlett-Packard Company)
MSN Food & Drink -> C:\Program Files\WindowsApps\Microsoft.BingFoodAndDrink_3.0.4.336_x64__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation) [MS Ad]
MSN Health & Fitness -> C:\Program Files\WindowsApps\Microsoft.BingHealthAndFitness_3.0.4.336_x64__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation) [MS Ad]
MSN Money -> C:\Program Files\WindowsApps\Microsoft.BingFinance_3.0.4.344_x64__8wekyb3d8bbwe [2016-04-27] (Microsoft Corporation) [MS Ad]
MSN News -> C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.344_x64__8wekyb3d8bbwe [2016-04-27] (Microsoft Corporation) [MS Ad]
MSN Sport -> C:\Program Files\WindowsApps\Microsoft.BingSports_3.0.4.345_x64__8wekyb3d8bbwe [2016-04-29] (Microsoft Corporation) [MS Ad]
MSN Travel -> C:\Program Files\WindowsApps\Microsoft.BingTravel_3.0.4.336_x64__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation) [MS Ad]
MSN Weather -> C:\Program Files\WindowsApps\Microsoft.BingWeather_3.0.4.350_x64__8wekyb3d8bbwe [2016-11-23] (Microsoft Corporation) [MS Ad]
Music -> C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2.6.672.0_x64__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation) [MS Ad]
Skype -> C:\Program Files\WindowsApps\Microsoft.SkypeApp_3.1.0.1016_x86__kzf8qxf38zg5c [2016-03-01] (Skype) [MS Ad]
Snapfish -> C:\Program Files\WindowsApps\AD2F1837.HPConnectedPhotopoweredbySnapfish_5.5.0.8_x86__v10z8vjag6ke6 [2016-05-04] (HP Inc.)
Video -> C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2.6.446.0_x64__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation) [MS Ad]
YouCam for HP -> C:\Program Files\WindowsApps\CyberLinkCorp.hs.YouCamforHP_1.0.2.29632_x86__06qsbagp91rvg [2016-03-01] (CYBERLINKCOM CORP)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1403370322-224015993-469023631-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation - pGFX -> Intel Corporation)
CustomCLSID: HKU\S-1-5-21-1403370322-224015993-469023631-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1403370322-224015993-469023631-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1403370322-224015993-469023631-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1403370322-224015993-469023631-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2019-04-15] (AVAST Software s.r.o. -> AVAST Software)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2019-04-15] (AVAST Software s.r.o. -> AVAST Software)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov) [File not signed]
ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2019-04-15] (AVAST Software s.r.o. -> AVAST Software)
ContextMenuHandlers1: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll [2013-06-27] (CyberLink Corp. -> Cyberlink)
ContextMenuHandlers1: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll [2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
ContextMenuHandlers1: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll [2019-07-28] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
ContextMenuHandlers2: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll [2013-06-27] (CyberLink Corp. -> Cyberlink)
ContextMenuHandlers2: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll [2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2019-04-15] (AVAST Software s.r.o. -> AVAST Software)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-02-01] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov) [File not signed]
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2015-08-09] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2019-04-15] (AVAST Software s.r.o. -> AVAST Software)
ContextMenuHandlers6: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll [2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-02-01] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll [2019-07-28] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2013-12-29 15:21 - 2013-07-15 18:29 - 000620718 ____N () [File not signed] C:\Program Files (x86)\BillP Studios\WinPatrol\sqlite3.dll
2010-11-18 21:08 - 2010-11-18 21:08 - 000086016 _____ (Igor Pavlov) [File not signed] C:\Program Files\7-Zip\7-zip.dll
2013-04-30 12:25 - 2013-04-30 12:25 - 000531456 _____ (Intel Corporation) [File not signed] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\ISDI2.dll
2013-04-30 12:25 - 2013-04-30 12:25 - 000286720 _____ (Intel Corporation) [File not signed] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\PsiData.dll
2013-02-13 12:46 - 2013-02-13 12:46 - 000731648 _____ (Intel(R) Corporation) [File not signed] C:\Program Files\Intel\iCLS Client\HeciServer.exe
2013-09-26 16:21 - 2013-06-21 07:55 - 000499712 _____ (Microsoft Corporation) [File not signed] C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\MSVCP71.dll
2013-09-26 16:21 - 2013-06-21 07:55 - 000348160 _____ (Microsoft Corporation) [File not signed] C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\MSVCR71.dll
2013-09-26 16:02 - 2012-02-14 19:37 - 000594432 _____ (Realtek Semiconductor Corp. ) [File not signed] C:\WINDOWS\system32\Rtlihvs.dll
2013-12-31 15:32 - 2012-11-12 16:15 - 000558592 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enppmon.dll
2013-12-31 15:32 - 2012-10-22 18:19 - 000219648 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enpres.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\WINDOWS\avastSS.scr:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\HelpPane.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\WLXPGSS.SCR:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ActionQueue.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\adtschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\advapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\apisetschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidcertstorecheck.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\appidpolicyconverter.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appinfo.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\asycfilt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atmfd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\authz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\autoconv.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\basecsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\basesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bcrypt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bcryptprimitives.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BFE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certenc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certprop.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certutil.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cic.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cnvfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\compstui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\consent.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\convert.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\credssp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\crypt32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cryptnet.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\csrsrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3d10level9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3d11.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_47.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DafPrintProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DAFWSD.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\difx64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DPTopologyApp.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\DPTopologyAppv2_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dxtmsft.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\escsvc64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\esent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\E_GCINST.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\E_ID4BJBE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fdWCN.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FirewallAPI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FWPUCLNT.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FwRemoteSvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\GfxUIEx.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Gfxv2_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Gfxv4_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gpapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gpsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\hal.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\icfupgd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\icm32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieetwcollector.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieetwproxystub.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ifsutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxCUIService.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxEM.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxext.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxHK.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxTray.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IntelWiDiUMS64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IntelWiDiVAD64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IPHLPAPI.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iprtrmgr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\IPSECSVC.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsidsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsiexe.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsium.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsiwmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfmjpegdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfmp4srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfsvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mgmtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mispace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcbase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcndmgr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcshext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprddm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprdim.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MPSSVC.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mscms.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msctf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msftedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msinfo32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msobjs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msra.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msrating.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MsSpellCheckingFacility.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ncryptsslp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ncsi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nlaapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nlasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ntprint.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ntshrui.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\offreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\P2P.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\p2psvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pcalua.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pcasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PlayToDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pnrpsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\polstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\prnntfy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\puiapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\quartz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rascfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rascustom.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasman.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasmans.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasppp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rastapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rastls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdpudd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdsdwmdr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\regsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rfxvmt.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SCardDlg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SCardSvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ScDeviceEnum.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\scesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\scksp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\shdocvw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\shsetup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\smbwmiv2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\snmptrap.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\srvsvc.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\sscore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\storagewmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sysmain.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TabSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tdc.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tpmvsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TsWpfWrp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinui.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tzsync.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ubpm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uexfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ufat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ulib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\umrdp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\untfs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uReFS.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uudf.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\UXInit.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\uxtheme.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\vmrdvcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\vpnike.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Vxdif.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wbengine.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WcnApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wcncsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wdc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wevtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wevtsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wfapigp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wfdprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Streaming.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wininit.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winlogon.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wintrust.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WinUSBCoInstaller2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wisp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlanmsm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlansec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WMASF.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmitomi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wow64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wow64cpu.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpdbusenum.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpd_ci.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WSDApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wsdchngr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\WSDScDrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WsmAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WsmAuto.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\wsnmp32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xolehlp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xpsrchvw.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\adtschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\advapi32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\appidapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\asycfilt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atmfd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\authz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\autoconv.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\basecsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\bcrypt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\bcryptprimitives.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\certenc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\certutil.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cic.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cnvfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\compstui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\credssp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\crypt32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptnet.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10level9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d11.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_47.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DafPrintProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtmsft.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\esent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\fdWCN.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\FWPUCLNT.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\FwRemoteSvr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\gpapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\icm32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ieui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ifsutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\IPHLPAPI.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iprtrmgr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsidsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsium.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsiwmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmjpegdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mgmtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mispace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcbase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcndmgr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcshext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprddm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprdim.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mscms.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSCOMCTL.OCX:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msctf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msftedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MshtmlDac.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msinfo32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjetoledb40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjint40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjter40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjtes40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msobjs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msrating.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msrepl40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mstext40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mswdat10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mswstr10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ncryptsslp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nlaapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntdll.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntprint.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntshrui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntvdm64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\offreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\olepro32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\P2P.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\pdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\polstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\prnntfy.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\puiapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\quartz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rascfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasman.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasppp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rastapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rastls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\scesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\scksp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\setup16.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\shdocvw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\shsetup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sscore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\storagewmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sysmon.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\tdc.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\TsWpfWrp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uexfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ufat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ulib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\untfs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uReFS.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uudf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UXInit.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uxtheme.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WcnApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wdc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wevtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wfapigp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wfdprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wintrust.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WinTypes.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wisp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanmsm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wlansec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WMASF.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmitomi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wow32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WSDApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsdchngr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAuto.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsnmp32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xpsrchvw.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\acpi.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\afd.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\agilevpn.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\AGP440.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\Apfiltr.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\BasicRender.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\cdrom.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\cmimcext.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dfsc.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\disk.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dumpfve.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\fltMgr.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidclass.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidusb.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\http.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\isapnp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mountmgr.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxdav.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb20.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\msisadrv.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndproxy.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\netbios.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\netio.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\NV_AGP.SYS:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\nwifi.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pacer.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pci.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pdc.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\phantomtap.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdbss.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdyboost.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\scfilter.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\serenum.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\serial.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\spaceport.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\storport.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\tap0901.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\tdx.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ULIAGPKX.SYS:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbccgp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbehci.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbhub.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\volmgrx.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwifibus.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwififlt.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwifimp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdBoot.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdFilter.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdNisDrv.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WSDScan.sys:$CmdTcID [64]
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [125]
AlternateDataStreams: C:\Users\user\Desktop\adblw206.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Desktop\adblw206.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\4l44-2D.msz:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\4l44-2D.msz:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\ATF-Cleaner.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\avira_en_vpnb0_59ec6e54c2bd4__adw.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\avira_en_vpnb0_59ec6e54c2bd4__adw.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup540.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup540.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup541.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup541.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CG_5.0.14.7.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CG_5.0.14.7.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CG_6.0.8_EXP-PF.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CG_6.0.8_EXP-PF.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF(1).docx:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF(1).docx:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF.docx:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF.docx:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221 (1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221 (1).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\epson513623eu.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\epson513623eu.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\Firefox Installer.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\Firefox Installer.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\gt_recovery_v3_4 (1).rar:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\gt_recovery_v3_4.rar:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\KingRoot_pc_en.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\KingRoot_pc_en.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\kodi-16.1-Jarvis.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\kodi-16.1-Jarvis.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\kodi-17.1-Krypton.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\user\Downloads\kodi-17.1-Krypton.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\Minecraft.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\Minecraft.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (1).apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (2).apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (3).apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203.apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming(1).zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming(1).zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-master.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-master.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra.0.0.6.fix.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra.0.0.6.fix.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\Silverlight_x64.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\Silverlight_x64.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup52.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup52.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup54.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup54.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup55.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup55.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\TVMC_Windows.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\TVMC_Windows.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\wlsetup-web.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\wlsetup-web.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Documents\SS16 - Collections _ Irregular Choice LADIES SHOES.htm:$CmdZnID [26]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\1001movie.com -> 1001movie.com

There are 6091 more sites.

IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\…\1001movie.com -> 1001movie.com

There are 6091 more sites.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2019-01-05 11:50 - 000000825 _____ C:\WINDOWS\system32\drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\OpenCL SDK\3.0\bin\x86;C:\Program Files (x86)\Intel\OpenCL SDK\3.0\bin\x64;C:\Program Files (x86)\Windows Live\Shared;C:\Program Files (x86)\Skype\Phone\
HKU\S-1-5-21-1403370322-224015993-469023631-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\user\Pictures\Camera Roll\TOMMY\IMG_1174 - Copy.JPG
HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347\Control Panel\Desktop\\Wallpaper -> C:\Users\user\Pictures\Camera Roll\TOMMY\IMG_1174 - Copy.JPG
DNS Servers: [removed] - [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (No File)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{3F10DB76-5B0B-4DCD-AF46-338F194DFC73}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{D7F645AD-DDAA-497C-B2AD-625D07D9D9EC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{2C023406-873B-4F7C-9615-7EB2734982D7}] => (Allow) LPort=1900
FirewallRules: [{43396E10-9017-4F4A-9A0A-13D44135C4CE}] => (Allow) LPort=2869
FirewallRules: [{442AA05F-CF25-40BD-BC86-27FA3A149F92}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{12B939C9-1E1B-470F-91D2-39F1AB470FE1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{D8575081-79D1-4269-AFB5-05D701EB3E27}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{6D2216FF-CBE0-4F9F-AD56-56A4E058FB01}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{9AE5611F-0A7B-4243-8A13-C08843FFF1EA}] => (Allow) E:\Network\EpsonNetSetup\ENEasyApp.exe No File
FirewallRules: [{BFE5C74F-C088-4E95-BFE9-CAE7527BED6A}] => (Allow) E:\Network\EpsonNetSetup\ENEasyApp.exe No File
FirewallRules: [{045F7BDB-BFCD-43F2-BED4-9E2EFB30ED0F}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{ACBA0269-FC68-4FD1-877D-5F6847266646}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{7B6E12D1-D3AF-4E33-A7A6-FE3A1D0CCCB1}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{5154D19E-8D72-456C-8FB0-7BA801191A66}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{7571A772-A111-44CE-A99E-B22ADA20F4A3}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe (CyberLink Corp. -> CyberLink)
FirewallRules: [{1E92BB79-063D-4B0B-AC39-AE6C396C11C2}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{77FA0945-7FE9-4700-B4B7-7338498E4BA1}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{98F34E2E-C70A-4FB2-B0B5-6EBDE8D96543}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{FA29AC84-8759-4E79-BE15-9D4F68B11E97}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{EA6F67C6-FE3F-4580-B114-5609D037CCC6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{4D0A45E3-574B-48CE-8E0F-17A13761B990}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe (Meridian Audio Ltd -> Meridian Audio Ltd)
FirewallRules: [{7F11DF3E-BA0E-4AEB-839F-D687C22F862E}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe (Meridian Audio Ltd -> Meridian Audio Ltd)
FirewallRules: [TCP Query User{AC09203A-4D76-468B-943F-D39948179F85}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
FirewallRules: [UDP Query User{8BC0988E-C09D-483A-B41D-683963F31FF2}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
FirewallRules: [{28CF0D79-2DA2-4FAD-8A4C-87599C2B6606}] => (Block) C:\program files (x86)\epson software\event manager\eeventmanager.exe (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
FirewallRules: [{92AE8366-2941-46B0-BF21-0CAA9500BAD1}] => (Block) C:\program files (x86)\epson software\event manager\eeventmanager.exe (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
FirewallRules: [{600B5C03-30FF-4E7D-BC56-1BE2DCF1C379}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{18EA988F-0CEB-40BE-B362-01909A5F3A67}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{397B61B0-98CE-47FE-BF6D-710DA2821BE8}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe (Hewlett-Packard Company -> Hewlett-Packard Company)
FirewallRules: [{F90BC466-1B00-47BA-B76B-C0378A3B2F64}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{1770AB1E-6B1E-42F6-8B22-16B00A7BE287}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{CCD21E30-521E-470F-A99E-76F154E3DE82}] => (Allow) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe (AVAST Software s.r.o. -> AVAST Software)

==================== Restore Points =========================

02-05-2019 20:35:33 COMODO Firewall Binary update
16-05-2019 22:53:34 Windows Update
24-07-2019 22:53:51 Windows Update

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/28/2019 04:10:15 PM) (Source: MsiInstaller) (EventID: 11316) (User: NT AUTHORITY)
Description: Product: Avast Update Helper – Error 1316. The specified account already exists.

Error: (07/28/2019 04:02:22 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hp)
Description: Activation of application Microsoft.BingNews_8wekyb3d8bbwe!AppexNews failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (07/28/2019 04:02:22 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hp)
Description: Activation of application Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (07/28/2019 03:53:03 PM) (Source: Perflib) (EventID: 1015) (User: )
Description: The performance data collection function "PerfProc" in the "C:\WINDOWS\System32\perfproc.dll" library did not complete in the allowed time. There may be a problem with this extensible counter, the service from which the counter is collecting data, or the system may have been very busy when this call was attempted.

Error: (07/28/2019 03:45:27 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hp)
Description: Activation of application Microsoft.BingFinance_8wekyb3d8bbwe!AppexFinance failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (07/28/2019 03:31:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hp)
Description: Activation of application Microsoft.BingSports_8wekyb3d8bbwe!AppexSports failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (07/28/2019 03:11:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 68234

Error: (07/28/2019 03:11:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 68234


System errors:
=============
Error: (07/28/2019 04:06:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Avira Protected Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (07/28/2019 04:06:24 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Avira Protected Service service to connect.

Error: (07/28/2019 03:37:41 PM) (Source: DCOM) (EventID: 10010) (User: hp)
Description: The server {1B1F472E-3221-4826-97DB-2C2324D389AE} did not register with DCOM within the required timeout.

Error: (07/28/2019 03:37:10 PM) (Source: DCOM) (EventID: 10010) (User: hp)
Description: The server {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} did not register with DCOM within the required timeout.

Error: (07/28/2019 03:09:41 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly. It has done this 4 time(s).

Error: (07/28/2019 12:18:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly. It has done this 3 time(s).

Error: (07/28/2019 11:43:00 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly. It has done this 2 time(s).

Error: (07/27/2019 01:44:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly. It has done this 1 time(s).


CodeIntegrity:
===================================

Date: 2019-07-28 16:10:02.168
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-27 12:13:03.267
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-27 12:03:34.668
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-26 18:05:19.868
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-25 17:17:51.171
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-25 17:16:48.851
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-25 16:30:20.319
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-24 22:33:53.352
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info ===========================

BIOS: Insyde F.11 07/19/2013
Motherboard: Hewlett-Packard 2161
Processor: Intel(R) Core(TM) i5-4200U CPU @ 1.60GHz
Percentage of memory in use: 66%
Total physical RAM: 3866.15 MB
Available physical RAM: 1305.75 MB
Total Virtual: 7834.15 MB
Available Virtual: 3900.21 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:442.45 GB) (Free:340.7 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (RECOVERY) (Fixed) (Total:22.1 GB) (Free:2.23 GB) NTFS ==>[system with boot components (obtained from drive)]

\\?\Volume{969e5462-71f0-49fd-b3ed-8fb0102e65bc}\ (WINRE) (Fixed) (Total:0.39 GB) (Free:0.13 GB) NTFS
\\?\Volume{ff2d498f-c6f2-4170-afd4-114805135254}\ () (Fixed) (Total:0.44 GB) (Free:0.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 8DED8F94)

Partition: GPT.

==================== End of Addition.txt ============================

 

Thank you


 

AVAST Software, Avira\Antivirus, and COMODO Internet Security (<= is this just the firewall? or does it also include antivirus?)
C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe <= maybe a left over uninstall?

This computer shows multiple antivirus which would bring any computer to a crawl.
[external image: warning.gif]Multiple Antivirus Warning!
I see that you have multiple Antivirus programs installed on your system.

You should only have one Antivirus installed at all time on a computer. Reason being that having more than one installed can cause system instability and conflict due to the way these programs works and interact with the system. If you want to read more about these kind of issues, I suggest you to read the "IMPORTANT NOTE" in quietman7's post here. This being said, I'll ask you to choose the Antivirus program you want to keep, and uninstall the other(s). Usually, you would keep the program you pay for, and uninstall the free one(s). If you pay for multiple products, keep the one you prefer the most, and uninstall the other(s).

~~~~~~~~~~~~~~~`

After you make a decision which to keep and which to uninstall (If you have any problems let me know), we can continue.

~~~~~~~~~~~~~~~~~~~~`

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
GroupPolicy: Restriction - Chrome <==== ATTENTION
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001 -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKU\S-1-5-21-1403370322-224015993-469023631-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
AlternateDataStreams: C:\WINDOWS\avastSS.scr:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\HelpPane.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\WLXPGSS.SCR:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ActionQueue.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\adtschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\advapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\apisetschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidcertstorecheck.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\appidpolicyconverter.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appinfo.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\asycfilt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atmfd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\authz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\autoconv.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\basecsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\basesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bcrypt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bcryptprimitives.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BFE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certenc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certprop.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certutil.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cic.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cnvfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\compstui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\consent.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\convert.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\credssp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\crypt32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cryptnet.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\csrsrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3d10level9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3d11.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_47.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DafPrintProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DAFWSD.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\difx64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DPTopologyApp.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\DPTopologyAppv2_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dxtmsft.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\escsvc64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\esent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\E_GCINST.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\E_ID4BJBE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fdWCN.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FirewallAPI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FWPUCLNT.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FwRemoteSvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\GfxUIEx.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Gfxv2_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Gfxv4_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gpapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gpsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\hal.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\icfupgd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\icm32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieetwcollector.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieetwproxystub.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ifsutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxCUIService.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxEM.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxext.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxHK.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxTray.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IntelWiDiUMS64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IntelWiDiVAD64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IPHLPAPI.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iprtrmgr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\IPSECSVC.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsidsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsiexe.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsium.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsiwmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfmjpegdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfmp4srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfsvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mgmtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mispace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcbase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcndmgr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcshext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprddm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprdim.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MPSSVC.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mscms.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msctf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msftedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msinfo32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msobjs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msra.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msrating.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MsSpellCheckingFacility.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ncryptsslp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ncsi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nlaapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nlasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ntprint.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ntshrui.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\offreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\P2P.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\p2psvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pcalua.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pcasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PlayToDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pnrpsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\polstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\prnntfy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\puiapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\quartz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rascfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rascustom.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasman.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasmans.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasppp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rastapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rastls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdpudd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdsdwmdr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\regsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rfxvmt.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SCardDlg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SCardSvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ScDeviceEnum.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\scesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\scksp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\shdocvw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\shsetup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\smbwmiv2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\snmptrap.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\srvsvc.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\sscore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\storagewmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sysmain.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TabSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tdc.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tpmvsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TsWpfWrp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinui.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tzsync.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ubpm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uexfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ufat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ulib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\umrdp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\untfs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uReFS.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uudf.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\UXInit.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\uxtheme.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\vmrdvcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\vpnike.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Vxdif.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wbengine.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WcnApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wcncsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wdc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wevtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wevtsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wfapigp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wfdprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Streaming.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wininit.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winlogon.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wintrust.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WinUSBCoInstaller2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wisp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlanmsm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlansec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WMASF.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmitomi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wow64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wow64cpu.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpdbusenum.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpd_ci.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WSDApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wsdchngr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\WSDScDrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WsmAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WsmAuto.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\wsnmp32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xolehlp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xpsrchvw.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\adtschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\advapi32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\appidapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\asycfilt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atmfd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\authz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\autoconv.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\basecsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\bcrypt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\bcryptprimitives.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\certenc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\certutil.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cic.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cnvfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\compstui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\credssp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\crypt32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptnet.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10level9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d11.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_47.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DafPrintProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtmsft.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\esent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\fdWCN.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\FWPUCLNT.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\FwRemoteSvr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\gpapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\icm32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ieui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ifsutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\IPHLPAPI.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iprtrmgr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsidsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsium.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsiwmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmjpegdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mgmtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mispace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcbase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcndmgr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcshext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprddm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprdim.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mscms.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSCOMCTL.OCX:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msctf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msftedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MshtmlDac.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msinfo32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjetoledb40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjint40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjter40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjtes40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msobjs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msrating.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msrepl40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mstext40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mswdat10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mswstr10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ncryptsslp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nlaapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntdll.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntprint.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntshrui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntvdm64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\offreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\olepro32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\P2P.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\pdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\polstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\prnntfy.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\puiapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\quartz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rascfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasman.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasppp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rastapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rastls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\scesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\scksp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\setup16.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\shdocvw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\shsetup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sscore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\storagewmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sysmon.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\tdc.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\TsWpfWrp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uexfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ufat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ulib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\untfs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uReFS.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uudf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UXInit.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uxtheme.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WcnApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wdc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wevtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wfapigp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wfdprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wintrust.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WinTypes.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wisp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanmsm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wlansec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WMASF.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmitomi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wow32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WSDApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsdchngr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAuto.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsnmp32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xpsrchvw.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\acpi.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\afd.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\agilevpn.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\AGP440.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\Apfiltr.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\BasicRender.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\cdrom.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\cmimcext.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dfsc.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\disk.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dumpfve.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\fltMgr.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidclass.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidusb.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\http.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\isapnp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mountmgr.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxdav.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb20.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\msisadrv.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndproxy.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\netbios.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\netio.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\NV_AGP.SYS:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\nwifi.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pacer.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pci.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pdc.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\phantomtap.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdbss.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdyboost.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\scfilter.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\serenum.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\serial.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\spaceport.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\storport.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\tap0901.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\tdx.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ULIAGPKX.SYS:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbccgp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbehci.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbhub.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\volmgrx.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwifibus.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwififlt.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwifimp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdBoot.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdFilter.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdNisDrv.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WSDScan.sys:$CmdTcID [64]
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [125]
AlternateDataStreams: C:\Users\user\Desktop\adblw206.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Desktop\adblw206.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\4l44-2D.msz:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\4l44-2D.msz:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\ATF-Cleaner.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\avira_en_vpnb0_59ec6e54c2bd4__adw.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\avira_en_vpnb0_59ec6e54c2bd4__adw.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup540.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup540.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup541.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup541.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CG_5.0.14.7.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CG_5.0.14.7.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CG_6.0.8_EXP-PF.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CG_6.0.8_EXP-PF.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF(1).docx:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF(1).docx:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF.docx:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF.docx:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221 (1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221 (1).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\epson513623eu.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\epson513623eu.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\Firefox Installer.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\Firefox Installer.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\gt_recovery_v3_4 (1).rar:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\gt_recovery_v3_4.rar:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\KingRoot_pc_en.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\KingRoot_pc_en.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\kodi-16.1-Jarvis.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\kodi-16.1-Jarvis.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\kodi-17.1-Krypton.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\user\Downloads\kodi-17.1-Krypton.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\Minecraft.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\Minecraft.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (1).apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (2).apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (3).apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203.apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming(1).zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming(1).zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-master.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-master.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra.0.0.6.fix.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra.0.0.6.fix.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\Silverlight_x64.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\Silverlight_x64.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup52.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup52.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup54.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup54.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup55.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup55.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\TVMC_Windows.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\TVMC_Windows.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\wlsetup-web.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\wlsetup-web.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Documents\SS16 - Collections _ Irregular Choice LADIES SHOES.htm:$CmdZnID [26]
C:\Windows\Temp\*.*
End::

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please post this log in your next reply and let me know if removeing the extra anrivirus applications has helped.

Hello there Juliet

Thank you for taking time to look at my logs. I decided to delete Avira and it seems that Comodo = Firewall only.

Here is the next log you requested.

 

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 29-07-2019
Ran by [removed] (29-07-2019 22:39:01) Run:1
Running from C:\Users\[removed]\Desktop\WHAT THE TECH\Farbar Recovery Tool
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
GroupPolicy: Restriction - Chrome <==== ATTENTION
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001 -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKU\S-1-5-21-1403370322-224015993-469023631-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
AlternateDataStreams: C:\WINDOWS\avastSS.scr:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\HelpPane.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\WLXPGSS.SCR:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ActionQueue.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\adtschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\advapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\apisetschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidcertstorecheck.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\appidpolicyconverter.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appinfo.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\asycfilt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atmfd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\authz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\autoconv.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\basecsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\basesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bcrypt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bcryptprimitives.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BFE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certenc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certprop.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certutil.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cic.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cnvfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\compstui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\consent.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\convert.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\credssp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\crypt32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cryptnet.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\csrsrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3d10level9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3d11.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_47.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DafPrintProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DAFWSD.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\difx64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DPTopologyApp.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\DPTopologyAppv2_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dxtmsft.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\escsvc64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\esent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\E_GCINST.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\E_ID4BJBE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fdWCN.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FirewallAPI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FWPUCLNT.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FwRemoteSvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\GfxUIEx.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Gfxv2_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Gfxv4_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gpapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gpsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\hal.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\icfupgd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\icm32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieetwcollector.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieetwproxystub.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ifsutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxCUIService.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxEM.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxext.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxHK.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxTray.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IntelWiDiUMS64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IntelWiDiVAD64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IPHLPAPI.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iprtrmgr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\IPSECSVC.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsidsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsiexe.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsium.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsiwmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfmjpegdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfmp4srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfsvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mgmtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mispace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcbase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcndmgr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcshext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprddm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprdim.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MPSSVC.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mscms.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msctf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msftedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msinfo32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msobjs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msra.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msrating.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MsSpellCheckingFacility.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ncryptsslp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ncsi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nlaapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nlasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ntprint.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ntshrui.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\offreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\P2P.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\p2psvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pcalua.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pcasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PlayToDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pnrpsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\polstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\prnntfy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\puiapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\quartz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rascfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rascustom.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasman.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasmans.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasppp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rastapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rastls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdpudd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdsdwmdr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\regsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rfxvmt.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SCardDlg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SCardSvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ScDeviceEnum.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\scesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\scksp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\shdocvw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\shsetup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\smbwmiv2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\snmptrap.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\srvsvc.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\sscore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\storagewmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sysmain.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TabSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tdc.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tpmvsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TsWpfWrp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinui.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tzsync.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ubpm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uexfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ufat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ulib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\umrdp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\untfs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uReFS.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uudf.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\UXInit.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\uxtheme.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\vmrdvcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\vpnike.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Vxdif.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wbengine.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WcnApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wcncsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wdc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wevtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wevtsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wfapigp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wfdprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Streaming.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wininit.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winlogon.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wintrust.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WinUSBCoInstaller2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wisp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlanmsm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlansec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WMASF.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmitomi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wow64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wow64cpu.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpdbusenum.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpd_ci.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WSDApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wsdchngr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\WSDScDrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WsmAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WsmAuto.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\wsnmp32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xolehlp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xpsrchvw.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\adtschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\advapi32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\appidapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\asycfilt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atmfd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\authz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\autoconv.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\basecsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\bcrypt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\bcryptprimitives.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\certenc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\certutil.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cic.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cnvfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\compstui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\credssp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\crypt32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptnet.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10level9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d11.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_47.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DafPrintProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtmsft.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\esent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\fdWCN.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\FWPUCLNT.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\FwRemoteSvr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\gpapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\icm32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ieui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ifsutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\IPHLPAPI.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iprtrmgr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsidsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsium.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsiwmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmjpegdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mgmtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mispace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcbase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcndmgr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcshext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprddm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprdim.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mscms.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSCOMCTL.OCX:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msctf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msftedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MshtmlDac.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msinfo32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjetoledb40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjint40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjter40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjtes40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msobjs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msrating.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msrepl40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mstext40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mswdat10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mswstr10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ncryptsslp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nlaapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntdll.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntprint.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntshrui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntvdm64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\offreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\olepro32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\P2P.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\pdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\polstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\prnntfy.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\puiapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\quartz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rascfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasman.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasppp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rastapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rastls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\scesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\scksp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\setup16.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\shdocvw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\shsetup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sscore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\storagewmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sysmon.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\tdc.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\TsWpfWrp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uexfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ufat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ulib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\untfs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uReFS.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uudf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UXInit.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uxtheme.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WcnApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wdc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wevtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wfapigp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wfdprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wintrust.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WinTypes.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wisp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanmsm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wlansec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WMASF.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmitomi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wow32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WSDApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsdchngr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAuto.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsnmp32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xpsrchvw.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\acpi.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\afd.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\agilevpn.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\AGP440.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\Apfiltr.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\BasicRender.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\cdrom.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\cmimcext.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dfsc.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\disk.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dumpfve.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\fltMgr.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidclass.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidusb.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\http.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\isapnp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mountmgr.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxdav.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb20.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\msisadrv.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndproxy.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\netbios.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\netio.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\NV_AGP.SYS:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\nwifi.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pacer.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pci.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pdc.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\phantomtap.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdbss.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdyboost.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\scfilter.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\serenum.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\serial.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\spaceport.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\storport.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\tap0901.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\tdx.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ULIAGPKX.SYS:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbccgp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbehci.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbhub.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\volmgrx.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwifibus.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwififlt.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwifimp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdBoot.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdFilter.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdNisDrv.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WSDScan.sys:$CmdTcID [64]
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [125]
AlternateDataStreams: C:\Users\user\Desktop\adblw206.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Desktop\adblw206.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\4l44-2D.msz:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\4l44-2D.msz:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\ATF-Cleaner.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\avira_en_vpnb0_59ec6e54c2bd4__adw.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\avira_en_vpnb0_59ec6e54c2bd4__adw.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup540.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup540.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup541.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup541.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CG_5.0.14.7.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CG_5.0.14.7.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CG_6.0.8_EXP-PF.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CG_6.0.8_EXP-PF.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF(1).docx:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF(1).docx:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF.docx:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF.docx:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221 (1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221 (1).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\epson513623eu.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\epson513623eu.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\Firefox Installer.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\Firefox Installer.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\gt_recovery_v3_4 (1).rar:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\gt_recovery_v3_4.rar:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\KingRoot_pc_en.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\KingRoot_pc_en.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\kodi-16.1-Jarvis.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\kodi-16.1-Jarvis.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\kodi-17.1-Krypton.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\user\Downloads\kodi-17.1-Krypton.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\Minecraft.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\Minecraft.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (1).apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (2).apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (3).apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203.apk:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming(1).zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming(1).zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-master.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-master.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra.0.0.6.fix.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra.0.0.6.fix.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\Silverlight_x64.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\Silverlight_x64.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup52.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup52.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup54.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup54.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup55.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup55.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\TVMC_Windows.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\TVMC_Windows.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Downloads\wlsetup-web.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\wlsetup-web.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\user\Documents\SS16 - Collections _ Irregular Choice LADIES SHOES.htm:$CmdZnID [26]
C:\Windows\Temp\*.*

*****************

Processes closed successfully.
Restore point was successfully created.
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => moved successfully
HKLM\SOFTWARE\Policies\Mozilla => removed successfully
HKLM\SOFTWARE\Policies\Google => removed successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC} => removed successfully
HKLM\Software\Classes\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => not found
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E5E5CADB-EEC9-47E0-8610-557BE904B97C} => removed successfully
HKLM\Software\Classes\CLSID\{E5E5CADB-EEC9-47E0-8610-557BE904B97C} => not found
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC} => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => not found
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{E5E5CADB-EEC9-47E0-8610-557BE904B97C} => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{E5E5CADB-EEC9-47E0-8610-557BE904B97C} => not found
HKU\S-1-5-21-1403370322-224015993-469023631-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC} => removed successfully
HKLM\Software\Classes\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => not found
HKU\S-1-5-21-1403370322-224015993-469023631-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E5E5CADB-EEC9-47E0-8610-557BE904B97C} => removed successfully
HKLM\Software\Classes\CLSID\{E5E5CADB-EEC9-47E0-8610-557BE904B97C} => not found
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/710-29550-11896-25/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms} => Error: No automatic fix found for this entry.
SearchScopes: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> {E5E5CADB-EEC9-47E0-8610-557BE904B97C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} => Error: No automatic fix found for this entry.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}" => removed successfully
HKLM\Software\Classes\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => not found
"HKU\S-1-5-21-1403370322-224015993-469023631-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" => removed successfully
HKLM\Software\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => not found
Toolbar: HKU\S-1-5-21-1403370322-224015993-469023631-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07272019121800347 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File => Error: No automatic fix found for this entry.
C:\WINDOWS\avastSS.scr => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\HelpPane.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\WLXPGSS.SCR => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ActionQueue.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\adsmsext.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\adtschema.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\advapi32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\apisetschema.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\appidapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\appidcertstorecheck.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\appidpolicyconverter.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\appidsvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\appinfo.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\asycfilt.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atmfd.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atmlib.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\authz.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\autoconv.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\basecsp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\basesrv.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\bcrypt.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\bcryptprimitives.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\BFE.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\certenc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\certprop.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\certutil.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\cic.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\cnvfat.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\compstui.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\consent.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\convert.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\credssp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\crypt32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\cryptnet.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\csrsrv.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3d10level9.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3d11.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DCompiler_47.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DafPrintProvider.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DAFWSD.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\difx64.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DPTopologyApp.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DPTopologyAppv2_0.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\dxtmsft.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\escsvc64.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\esent.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\E_GCINST.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\E_ID4BJBE.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\fdWCN.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\FirewallAPI.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\FWPUCLNT.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\FwRemoteSvr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\GfxUIEx.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Gfxv2_0.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Gfxv4_0.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\gpapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\gpsvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\hal.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\icfupgd.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\icm32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ieetwcollector.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ieetwproxystub.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ifsutil.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\igfxCUIService.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\igfxEM.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\igfxext.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\igfxHK.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\igfxTray.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\input.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\IntelWiDiUMS64.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\IntelWiDiVAD64.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\IPHLPAPI.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\iprtrmgr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\IPSECSVC.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\iscsidsc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\iscsiexe.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\iscsium.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\iscsiwmi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mfmjpegdec.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mfmp4srcsnk.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mfsvr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mgmtapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mispace.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mmc.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mmcbase.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mmcndmgr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mmcshext.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mprapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mprddm.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mprdim.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MPSSVC.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mscms.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\msctf.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\msftedit.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\msinfo32.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\msobjs.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\msra.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\msrating.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MsSpellCheckingFacility.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MSVidCtl.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ncryptsslp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ncsi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\nlaapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\nlasvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ntprint.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ntshrui.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\offreg.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\P2P.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\p2psvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\pcalua.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\pcasvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\pdh.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\PlayToDevice.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\pnrpsvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\polstore.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\prnntfy.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\puiapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\quartz.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\rasapi32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\rascfg.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\rascustom.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\rasman.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\rasmans.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\rasppp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\rastapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\rastls.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\rdpudd.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\rdsdwmdr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\regsvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\rfxvmt.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\samlib.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SCardDlg.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SCardSvr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ScDeviceEnum.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\scesrv.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\scksp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\shdocvw.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\shsetup.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\smbwmiv2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\snmptrap.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\srvsvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\sscore.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\storagewmi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\sysmain.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\TabSvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\tdc.ocx => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\tpmvsc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\TsWpfWrp.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\twinui.appcore.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\twinui.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\tzsync.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ubpm.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\uexfat.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ufat.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\UIAnimation.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ulib.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\umrdp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\untfs.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\uReFS.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\user32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\uudf.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\UXInit.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\uxtheme.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\vmrdvcore.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\vpnike.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Vxdif.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wbengine.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\WcnApi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wcncsvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wdc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\werdiagcontroller.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wevtapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wevtsvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wfapigp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wfdprov.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Windows.Media.Streaming.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Windows.UI.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wininit.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\winlogon.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wintrust.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\WinUSBCoInstaller2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wisp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wlanmsm.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wlansec.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\WMASF.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wmitomi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wmploc.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wow64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wow64cpu.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wpdbusenum.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wpd_ci.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\WSDApi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wsdchngr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\WSDScDrv.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\WsmAgent.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\WsmAuto.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wsnmp32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xolehlp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xpsrchvw.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\adsmsext.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\adtschema.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\advapi32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\appidapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\asycfilt.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atmfd.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atmlib.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\authz.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\autoconv.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\basecsp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\bcrypt.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\bcryptprimitives.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\certenc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\certutil.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\cic.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\cnvfat.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\compstui.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\credssp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\crypt32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\cryptnet.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3d10level9.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3d11.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DCompiler_47.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\DafPrintProvider.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\dxtmsft.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\esent.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\fdWCN.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\FWPUCLNT.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\FwRemoteSvr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\gpapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\icm32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\ieui.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\ifsutil.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\input.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\IPHLPAPI.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\iprtrmgr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\iscsidsc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\iscsium.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\iscsiwmi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mfmjpegdec.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mfsvr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mgmtapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mispace.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mmc.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mmcbase.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mmcndmgr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mmcshext.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mprapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mprddm.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mprdim.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mscms.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\MSCOMCTL.OCX => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\msctf.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\msftedit.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\MshtmlDac.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\msinfo32.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\msjetoledb40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\msjint40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\msjter40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\msjtes40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\msobjs.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\msrating.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\msrepl40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mstext40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\MSVidCtl.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mswdat10.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mswstr10.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\ncryptsslp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\nlaapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\ntdll.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\ntprint.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\ntshrui.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\ntvdm64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\offreg.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\olepro32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\P2P.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\pdh.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\PlayToDevice.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\polstore.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\prnntfy.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\puiapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\quartz.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\rasapi32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\rascfg.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\rasman.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\rasppp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\rastapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\rastls.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\samlib.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\scesrv.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\scksp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\setup16.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\shdocvw.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\shsetup.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\sscore.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\storagewmi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\sysmon.ocx => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\tdc.ocx => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\TsWpfWrp.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\twinui.appcore.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\twinui.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\uexfat.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\ufat.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\UIAnimation.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\ulib.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\untfs.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\uReFS.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\user32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\uudf.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\UXInit.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\uxtheme.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\WcnApi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wdc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\werdiagcontroller.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wevtapi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wfapigp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wfdprov.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\Windows.UI.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wintrust.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\WinTypes.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wisp.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wlanmsm.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wlansec.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\WMASF.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wmitomi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wmploc.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wow32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\WSDApi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wsdchngr.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\WsmAgent.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\WsmAuto.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wsnmp32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\wvc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xpsrchvw.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\acpi.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\afd.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\agilevpn.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\AGP440.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\Apfiltr.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\BasicRender.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\cdrom.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\cmimcext.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\dfsc.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\disk.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\dumpfve.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\fltMgr.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\hidclass.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\hidusb.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\http.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\isapnp.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\mountmgr.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\mrxdav.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\mrxsmb20.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\msisadrv.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\ndproxy.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\netbios.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\netio.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\NV_AGP.SYS => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\nwifi.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\pacer.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\pci.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\pdc.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\phantomtap.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\rdbss.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\rdyboost.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\scfilter.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\serenum.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\serial.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\spaceport.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\storport.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\tap0901.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\tdx.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\ULIAGPKX.SYS => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\usbccgp.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\usbehci.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\usbhub.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\volmgrx.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\vwifibus.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\vwififlt.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\vwifimp.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\WdBoot.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\WdFilter.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\WdNisDrv.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\WSDScan.sys => ":$CmdTcID" ADS could not remove.
C:\ProgramData\Temp => ":5C321E34" ADS removed successfully
C:\Users\user\Desktop\adblw206.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Desktop\adblw206.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\4l44-2D.msz => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\4l44-2D.msz => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\ATF-Cleaner.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\avira_en_vpnb0_59ec6e54c2bd4__adw.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\avira_en_vpnb0_59ec6e54c2bd4__adw.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\ccsetup540.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\ccsetup540.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\ccsetup541.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\ccsetup541.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\CG_5.0.14.7.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\CG_5.0.14.7.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\CG_6.0.8_EXP-PF.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\CG_6.0.8_EXP-PF.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF(1).docx => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF(1).docx => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF.docx => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF.docx => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\dfsetup221 (1).exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\dfsetup221 (1).exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\dfsetup221.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\dfsetup221.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\epson513623eu.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\epson513623eu.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\Firefox Installer.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\Firefox Installer.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\gt_recovery_v3_4 (1).rar => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\gt_recovery_v3_4.rar => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\KingRoot_pc_en.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\KingRoot_pc_en.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\kodi-16.1-Jarvis.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\kodi-16.1-Jarvis.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\kodi-17.1-Krypton.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\kodi-17.1-Krypton.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\Minecraft.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\Minecraft.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (1).apk => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (2).apk => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203 (3).apk => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\NewKingrootV5.2.1_C182_B431_en_release_2017_07_20_20170725105022_105203.apk => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming(1).zip => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming(1).zip => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming.zip => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming.zip => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\plugin.video.nbcsnliveextra-master.zip => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\plugin.video.nbcsnliveextra-master.zip => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\plugin.video.nbcsnliveextra.0.0.6.fix.zip => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\plugin.video.nbcsnliveextra.0.0.6.fix.zip => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\Silverlight_x64.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\Silverlight_x64.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\spywareblastersetup52.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\spywareblastersetup52.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\spywareblastersetup54.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\spywareblastersetup54.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\spywareblastersetup55.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\spywareblastersetup55.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\TVMC_Windows.zip => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\TVMC_Windows.zip => ":$CmdZnID" ADS removed successfully
C:\Users\user\Downloads\wlsetup-web.exe => ":$CmdTcID" ADS could not remove.
C:\Users\user\Downloads\wlsetup-web.exe => ":$CmdZnID" ADS removed successfully
C:\Users\user\Documents\SS16 - Collections _ Irregular Choice LADIES SHOES.htm => ":$CmdZnID" ADS removed successfully

=========== "C:\Windows\Temp\*.*" ==========

C:\Windows\Temp\avira_antivirus_setup.log => moved successfully
C:\Windows\Temp\battery-report.html => moved successfully
C:\Windows\Temp\battery-report.xml => moved successfully
C:\Windows\Temp\MpCmdRun.log => moved successfully
C:\Windows\Temp\MSI1278d.LOG => moved successfully
C:\Windows\Temp\MSI16f32.LOG => moved successfully
C:\Windows\Temp\MSI2107b.LOG => moved successfully
C:\Windows\Temp\MSI22ea6.LOG => moved successfully
C:\Windows\Temp\MSI3863.LOG => moved successfully
C:\Windows\Temp\MSI427f6.LOG => moved successfully
C:\Windows\Temp\MSI4c997.LOG => moved successfully
C:\Windows\Temp\MSI5b886.LOG => moved successfully
C:\Windows\Temp\MSI670aa.LOG => moved successfully
C:\Windows\Temp\MSI6cbd.LOG => moved successfully
C:\Windows\Temp\MSI817a7.LOG => moved successfully
C:\Windows\Temp\MSI83a48.LOG => moved successfully
C:\Windows\Temp\MSI8985a.LOG => moved successfully
C:\Windows\Temp\MSI8c358.LOG => moved successfully
C:\Windows\Temp\MSIa855c.LOG => moved successfully
C:\Windows\Temp\MSIb0f3e.LOG => moved successfully
C:\Windows\Temp\MSIb15ca.LOG => moved successfully
C:\Windows\Temp\MSIb4993.LOG => moved successfully
C:\Windows\Temp\MSIbde74.LOG => moved successfully
C:\Windows\Temp\MSId3bc8.LOG => moved successfully
C:\Windows\Temp\MSId45d6.LOG => moved successfully
C:\Windows\Temp\MSIdd076.LOG => moved successfully
C:\Windows\Temp\MSIe248a.LOG => moved successfully
C:\Windows\Temp\MSIe56f4.LOG => moved successfully
C:\Windows\Temp\MSIe95a4.LOG => moved successfully
C:\Windows\Temp\MSIf6dbc.LOG => moved successfully
C:\Windows\Temp\TS_8912.tmp => moved successfully
C:\Windows\Temp\TS_9F07.tmp => moved successfully

========= End -> "C:\Windows\Temp\*.*" ========



The system needed a reboot.

==== End of Fixlog 22:41:11 ====

Hello Juliet

I am running Windows 8.1 so not quite sure what you mean by the Fast Startup in Windows 10

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 3-08-2019
Ran by [removed] (administrator) on HP (Hewlett-Packard HP Pavilion TS 14 Notebook PC) (03-08-2019 23:49:25)
Running from C:\Users\[removed]\Desktop\WHAT THE TECH\Farbar Recovery Tool
[removed] Platform: Windows 8.1 (Update) (X64) Language: English (United Kingdom)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\HidMonitorSvc.exe
(Andrea Electronics -> Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc. -> Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVAST Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.154.333\AvastBrowserCrashHandler.exe
(AVAST Software s.r.o. -> AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.154.333\AvastBrowserCrashHandler64.exe
(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\aswidsagent.exe
(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(BillP Studios -> BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
(Comodo Security Solutions, Inc. -> COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(Comodo Security Solutions, Inc. -> COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Comodo Security Solutions, Inc. -> COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Comodo Security Solutions, Inc. -> COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(CyberLink Corp. -> CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp. -> CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink Corp. -> CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard Company -> Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Huawei Software Technologies Co., LTD. -> ) C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation - pGFX -> ) C:\Windows\System32\igfxTray.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation - Software and Firmware Products -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) Corporation) [File not signed] C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(SEIKO EPSON Corporation -> Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIJBE.EXE
(SUPERAntiSpyware.com -> SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Support.com, Inc. -> SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [704344 2016-02-28] (Alps Electric Co., LTD. -> Alps Electric Co., Ltd.)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7188552 2013-05-28] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [269192 2019-07-29] (AVAST Software s.r.o. -> AVAST Software)
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\Run: [WinPatrol] => C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [439360 2013-08-13] (BillP Studios -> BillP Studios)
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIJBE.EXE [283232 2016-04-08] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [9198512 2019-07-25] (Support.com, Inc. -> SUPERAntiSpyware)
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {37c35ab0-c556-11e8-bf41-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {62589221-754c-11e7-bf19-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {62589289-754c-11e7-bf19-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {b7ff2c4e-4d54-11e7-bf15-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {b7ff2cac-4d54-11e7-bf15-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\MountPoints2: {e4031dbe-902c-11e7-bf1f-a0481c2092ae} - "F:\HiSuiteDownLoader.exe"
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{30C521FB-255B-46C8-9F0D-EE5AE371C9AA}] -> C:\Program Files (x86)\AVAST Software\Browser\Application\75.1.1528.100\Installer\chrmstp.exe [2019-07-24] (AVAST Software s.r.o. -> AVAST Software)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> "C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level
HKLM\Software\…\Authentication\Credential Providers: [{538C240D-3DEE-4032-AB4C-08A3A6EB0861}] -> C:\Program Files (x86)\CyberLink\YouCam\CLCredProv\x64\CLCredProv.dll [2013-05-22] (CyberLink Corp. -> CyberLink)
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {04D842D8-2A44-4BD7-BC98-4AE3C4D2EBCE} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {0775CCB2-0BE3-4538-A796-9FD3A4916FC2} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-10-30] (AVAST Software s.r.o. -> AVAST Software)
Task: {094CD275-5C71-4753-B57E-5566CA859498} - System32\Tasks\Microsoft\Windows\SideShow\AutoWake => {E51DFD48-AA36-4B45-BB52-E831F02E8316}
Task: {0A846C5E-97A5-4199-9304-8A3C808F130D} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [13065408 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {0F6DBBD1-1FA5-490B-A482-1F43FCC689E6} - System32\Tasks\Microsoft\Windows\SideShow\SystemDataProviders => {7CCA6768-8373-4D28-8876-83E8B4E3A969}
Task: {13756301-DE12-424C-BAD5-F283A2B56C53} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [561984 2011-06-01] (Apple Inc. -> Apple Inc.)
Task: {1750A00D-04E4-462C-B0D0-6ABA7AACE6B5} - System32\Tasks\{1A8C4248-D550-4608-817B-F01212A4AAB3} => "c:\program files (x86)\mozilla firefox\firefox.exe" hxxp://ui.skype.com/ui/0/6.11.0.102/en/abandoninstall?source=lightinstaller&page;=tsBing
Task: {17B57CE1-3834-4627-9AC4-21ED67DA5299} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFReport.exe [88120 2016-09-17] (Hewlett-Packard Company -> Hewlett-Packard)
Task: {3393A359-8BB2-406C-AF19-BEC127F2F18A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe
Task: {3E147675-4EEB-4872-9C4C-6933D7D8D4F8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [208760 2018-06-27] (HP Inc. -> HP Inc.)
Task: {49738C9D-0E77-488D-A322-BE6311D8613B} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [339008 2013-03-12] (CyberLink Corp. -> CyberLink Corp.)
Task: {4BB9AD6C-0CB4-4E2C-A92E-DADA427588ED} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-07-24] (Adobe Inc. -> Adobe)
Task: {63178DD9-F920-4D08-B9BB-93C394248A8A} - System32\Tasks\COMODO\COMODO Maintenance {947247B5-026A-4437-9371-770782BE839D} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [5737152 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {6C2EBD39-D8E3-4939-B40C-F4E9485C3C25} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [13065408 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {785DCF5D-62E5-4BB2-A122-5835E67B14B8} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1343904 2013-06-07] (Hewlett-Packard Company -> Hewlett-Packard Development Company, L.P.)
Task: {7D6AC750-4DEF-4573-A20A-BA63432F8FB5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [541496 2013-06-07] (Hewlett-Packard Company -> Hewlett-Packard Company)
Task: {7FE49948-1816-45A2-BCB3-2AC46FA5F9D5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [541496 2013-06-07] (Hewlett-Packard Company -> Hewlett-Packard Company)
Task: {83EB0807-ECA4-4CBD-A7AE-CE0EB45211ED} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [619416 2019-07-11] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {890FB8E4-BD97-48ED-A552-23A2C0B86C5F} - System32\Tasks\Avast Secure Browser Heartbeat Task (Logon) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [1815792 2019-07-18] (AVAST Software s.r.o. -> AVAST Software)
Task: {8B6759EE-1C08-4B8F-955C-774AB5A6544E} - System32\Tasks\Microsoft\Windows\SideShow\SessionAgent => {45F26E9E-6199-477F-85DA-AF1EDfE067B1}
Task: {8DB763F8-C999-46DF-BF5D-9D75B75F9036} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1195544 2018-12-16] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Task: {98D346E6-A141-4478-877D-450D2581970A} - System32\Tasks\HPCeeScheduleForuser => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [91704 2010-09-13] (Hewlett-Packard Company -> Hewlett-Packard)
Task: {A1575042-A1F5-417F-81DC-99A8FB2F111D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [651400 2017-10-27] (Hewlett Packard -> HP Inc.)
Task: {A787F04B-46FE-422C-99C6-48BACFC4AF8A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1059704 2018-11-09] (HP Inc. -> HP Inc.)
Task: {AE02C979-B5AB-42F7-942F-B99AC773B03F} - System32\Tasks\COMODO\COMODO CMC {06A09C0F-DD9C-4191-A670-71115CD78627} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [5737152 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {AF850082-79A2-4BE9-AD5C-A1F631A80A36} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe
Task: {B062BB8E-E2F4-43E3-80EE-E41191D67B2A} - System32\Tasks\Avast Secure Browser Heartbeat Task (Hourly) => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [1815792 2019-07-18] (AVAST Software s.r.o. -> AVAST Software)
Task: {B0FFA5D9-8525-40B9-9EF9-B4982952D370} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [110144 2013-03-12] (CyberLink Corp. -> CyberLink)
Task: {B3F2DC17-C9FD-4C60-9357-C6FB57A11965} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\avast software\overseer\overseer.exe [2047368 2019-07-30] (AVAST Software s.r.o. -> AVAST Software)
Task: {B45CAF8D-08AC-4F67-A7DA-C25F58764BB1} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe
Task: {C382CDF4-93B1-453E-A3B9-14ADC88A0D5A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1059704 2018-11-09] (HP Inc. -> HP Inc.)
Task: {C9DCF59E-6B97-4C0C-8641-B8261089C8CA} - System32\Tasks\Microsoft\Windows\MobilePC\HotStart => {06DA0625-9701-43da-BFD7-FBEEA2180A1E}
Task: {CE2956C6-67AE-4D0C-80FB-5ADCFEA95C6D} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-10-30] (AVAST Software s.r.o. -> AVAST Software)
Task: {DB017F43-35F5-4CB0-87EB-BDB85CB72CA4} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_223_Plugin.exe [1457208 2019-07-24] (Adobe Inc. -> Adobe)
Task: {DB21EF32-6BA9-4118-BBC1-BC4FF48961E5} - System32\Tasks\Microsoft\Windows\SideShow\GadgetManager => {FF87090D-4A9A-4f47-879B-29A80C355D61}
Task: {DF765405-6455-4249-AEED-9FCBFA416D24} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [5737152 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {E072A413-5299-4FA3-B5AC-4963C09C8C8B} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [5737152 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {EE823C10-B927-4C2E-92A9-CBA5A125EA62} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [16835256 2019-07-11] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {F267BEBD-78CC-4B54-80EB-C67C0DB12181} - System32\Tasks\COMODO\COMODO Telemetry {18AD3DFA-30C0-4B5F-84F7-F1870B1A4921} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [13065408 2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
Task: {F6A0A1F5-2944-4902-96D0-838F4555F380} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [3940232 2019-07-29] (AVAST Software s.r.o. -> AVAST Software)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\HPCeeScheduleForuser.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{1DBD3B41-FDE0-4A25-AD74-6E13475A3EDE}: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{399BD968-2383-44A4-B8B6-535455314511}: [DhcpNameServer] [removed] [removed]

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT13/2
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/2
HKU\S-1-5-21-1403370322-224015993-469023631-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/2
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard Company -> Hewlett-Packard)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard Company -> Hewlett-Packard)

FireFox:
========
FF DefaultProfile: f1tp426w.default
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k54slf9d.default-release [2019-08-03]
FF Extension: (Avast SafePrice | Comparison, deals, coupons) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k54slf9d.default-release\Extensions\[removed] [2019-04-15]
FF Extension: (Avast Online Security) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\k54slf9d.default-release\Extensions\[removed] [2018-10-14]
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\f1tp426w.default [2019-08-03]
FF NewTab: Mozilla\Firefox\Profiles\f1tp426w.default -> about:newtab
FF HomepageOverride: Mozilla\Firefox\Profiles\f1tp426w.default -> Enabled: [removed]
FF NewTabOverride: Mozilla\Firefox\Profiles\f1tp426w.default -> Enabled: [removed]
FF NewTabOverride: Mozilla\Firefox\Profiles\f1tp426w.default -> Enabled: [removed]
FF Extension: (Avast SafePrice | Comparison, deals, coupons) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\f1tp426w.default\Extensions\[removed] [2019-04-15]
FF Extension: (Avast Online Security) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\f1tp426w.default\Extensions\[removed] [2018-10-14]
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\f1tp426w.default\searchplugins\yahoo-avast.xml [2017-06-18]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_223.dll [2019-07-24] (Adobe Inc. -> )
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_223.dll [2019-07-24] (Adobe Inc. -> )
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll [2013-04-03] (Adobe Systems, Inc.) [File not signed]
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-20] (Apple Inc. -> )
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.29 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-05-08] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-05-08] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-05-03] (Adobe Inc. -> Adobe Systems Inc.)

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.google.com"
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default [2019-07-25]
CHR HKLM\…\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\…\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\…\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [daanglpcpkjjlkhcbladppjphglbigam] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 3-08-2019
Ran by [removed] (03-08-2019 23:51:22)
Running from C:\Users\[removed]\Desktop\WHAT THE TECH\Farbar Recovery Tool
Windows 8.1 (Update) (X64) (2016-02-28 20:01:01)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1403370322-224015993-469023631-500 - Administrator - Disabled)
Guest (S-1-5-21-1403370322-224015993-469023631-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1403370322-224015993-469023631-1003 - Limited - Enabled)
user (S-1-5-21-1403370322-224015993-469023631-1001 - Administrator - Enabled) => C:\Users\user

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
FW: COMODO Firewall (Enabled) {A60587C6-B28F-3D1C-0869-12ED515CC3C3}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\…\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
adbLink version 2.06 (HKLM-x32\…\{05CF1DD3-4A94-4219-B176-BB1796680A6C}_is1) (Version: 2.06 - jocala.com)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 19.012.20035 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 32.0.0.223 - Adobe)
Adobe Shockwave Player 12.0 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)
ALPS Touch Pad Driver (HKLM\…\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1202.1711.102 - Alps Electric)
Apple Application Support (HKLM-x32\…\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avast Free Antivirus (HKLM-x32\…\Avast Antivirus) (Version: 19.6.2383 - AVAST Software)
Avast Secure Browser (HKLM-x32\…\Avast Secure Browser) (Version: 75.1.1528.100 - AVAST Software)
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\…\CCleaner) (Version: 5.60 - Piriform)
COMODO Firewall (HKLM\…\{901D1D88-408D-48E5-80DD-CC3145BD8456}) (Version: 12.0.0.6818 - COMODO Security Solutions Inc.)
CyberLink LabelPrint (HKLM-x32\…\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.4.6515 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\…\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.4.2928 - CyberLink Corp.)
Cyberlink PhotoDirector (HKLM-x32\…\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.2.4128 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\…\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.4.3026 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\…\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.4.3021 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\…\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.1.3024 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\…\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.1.2922 - CyberLink Corp.)
D3DX10 (HKLM-x32\…\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Defraggler (HKLM\…\Defraggler) (Version: 2.21 - Piriform)
DisableMSDefender (HKLM\…\{74FE39A0-FB76-47CD-84BA-91E2BBB17EF2}) (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Energy Star (HKLM-x32\…\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Epson Connect Guide (HKLM-x32\…\Epson Connect Guide) (Version:  - )
Epson Event Manager (HKLM-x32\…\{8F01524C-0676-4CC1-B4AE-64753C723391}) (Version: 3.01.0005 - Seiko Epson Corporation)
Epson Network Guide XP-700 Series (HKLM-x32\…\XP-700 Series Netg) (Version:  - )
EPSON Scan (HKLM-x32\…\EPSON Scanner) (Version:  - Seiko Epson Corporation)
Epson User's Guide XP-700 Series (HKLM-x32\…\XP-700 Series Useg) (Version:  - )
EPSON XP-700 Series Printer Uninstall (HKLM\…\EPSON XP-700 Series) (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (HKLM-x32\…\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
Google Update Helper (HKLM-x32\…\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.21.169 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.1 (HKLM-x32\…\{6F340107-F9AA-47C6-B54C-C3A19F11553F}) (Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HiSuite (HKLM-x32\…\Hi Suite) (Version: 1.0 - Huawei Technologies Co.,Ltd)
HP 3D DriveGuard (HKLM-x32\…\{AE2F1669-5B1F-47C5-B639-78D74DD0BCE4}) (Version: 6.0.9.1 - Hewlett-Packard Company)
HP Connected Music (Meridian - installer) (HKLM-x32\…\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)
HP CoolSense (HKLM-x32\…\{59F8C5AA-91BD-423D-BF05-09A80F39898F}) (Version: 2.10.62 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\…\{69A7894E-99A2-423D-8815-7D3A23F1C413}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Registration Service (HKLM\…\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.6838.4521 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{C88F84E5-AE23-44BD-922C-2ABEACACAF7A}) (Version: 7.2.23.56 - Hewlett-Packard Company)
HP Support Solutions Framework (HKLM-x32\…\{D2F04839-0AD0-4F06-A6B5-6DFF05E27B67}) (Version: 11.50.0019 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\…\{1C5BBAD8-4079-4014-8803-751333FBC112}) (Version: 1.0.8 - Hewlett-Packard Company)
HP Utility Center (HKLM\…\{A48BD764-CFDF-40A5-A07A-710908044F5D}) (Version: 2.2.2 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\…\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.6.1 - Hewlett-Packard Company)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.3.1520 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4264 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.6.0.1033 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\…\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
iTunes (HKLM\…\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Junk Mail filter update (HKLM-x32\…\{0BE9E708-5DC0-4963-9CFD-0AA519090E79}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
KingRoot version 3.5.0.1157 (HKLM-x32\…\{FA3B7324-9EB4-4ADC-84D0-5461BE113832}_is1) (Version: 3.5.0.1157 - KingRoot)
Kodi (HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\Kodi) (Version:  - XBMC Foundation)
Malwarebytes version 3.7.1.2839 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.7.1.2839 - Malwarebytes)
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\…\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.16.27012 (HKLM-x32\…\{427ada59-85e7-4bc8-b8d5-ebf59db60423}) (Version: 14.16.27012.6 - Microsoft Corporation)
Movie Maker (HKLM-x32\…\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\…\{EB3DF0F0-0525-4C5A-A2F8-DEC868A3075D}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 68.0.1 (x64 en-GB) (HKLM\…\Mozilla Firefox 68.0.1 (x64 en-GB)) (Version: 68.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 61.0.2 - Mozilla)
OpenOffice 4.0.1 (HKLM-x32\…\{24B89186-2A56-4D28-B930-6F4FCF224E2F}) (Version: 4.01.9714 - Apache Software Foundation)
Realtek Card Reader (HKLM-x32\…\{F0A8BF4A-972F-41E0-9800-1EFE3BF28266}) (Version: 1.1.9200.15 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.15.410.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6923 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\…\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.00.12.0906 - REALTEK Semiconductor Corp.)
Skype Click to Call (HKLM-x32\…\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype™ 7.40 (HKLM-x32\…\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.40.151 - Skype Technologies S.A.)
SpywareBlaster 5.5 (HKLM-x32\…\SpywareBlaster_is1) (Version: 5.5.0 - BrightFort LLC)
SUPERAntiSpyware (HKLM\…\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1264 - SUPERAntiSpyware.com)
swMSM (HKLM-x32\…\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

Packages:
=========
Box for Windows 8 -> C:\Program Files\WindowsApps\134D4F5B.Box_2.1.4.4_neutral__2qk4zy5s3qmee [2016-03-01] (Box, Inc.)
eBay -> C:\Program Files\WindowsApps\eBayInc.eBay_1.6.0.34_neutral__1618n3s9xq8tw [2016-03-01] (eBay, Inc)
Fresh Paint -> C:\Program Files\WindowsApps\Microsoft.FreshPaint_2.0.15133.0_x86__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation)
Games -> C:\Program Files\WindowsApps\Microsoft.XboxLIVEGames_2.0.139.0_x64__8wekyb3d8bbwe [2014-11-22] (Microsoft Corporation) [MS Ad]
Getting Started with Windows 8 -> C:\Program Files\WindowsApps\AD2F1837.GettingStartedwithWindows8_1.6.0.0_neutral__v10z8vjag6ke6 [2016-03-01] (Hewlett-Packard Company)
HP Games -> C:\Program Files\WindowsApps\AD2F1837.HPGames_1.0.0.50_neutral__v10z8vjag6ke6 [2013-09-26] (Hewlett-Packard Company)
HP Registration -> C:\Program Files\WindowsApps\AD2F1837.HPRegistration_1.2.1.166_neutral__v10z8vjag6ke6 [2016-03-01] (Hewlett-Packard Company)
MSN Food & Drink -> C:\Program Files\WindowsApps\Microsoft.BingFoodAndDrink_3.0.4.336_x64__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation) [MS Ad]
MSN Health & Fitness -> C:\Program Files\WindowsApps\Microsoft.BingHealthAndFitness_3.0.4.336_x64__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation) [MS Ad]
MSN Money -> C:\Program Files\WindowsApps\Microsoft.BingFinance_3.0.4.344_x64__8wekyb3d8bbwe [2016-04-27] (Microsoft Corporation) [MS Ad]
MSN News -> C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.344_x64__8wekyb3d8bbwe [2016-04-27] (Microsoft Corporation) [MS Ad]
MSN Sport -> C:\Program Files\WindowsApps\Microsoft.BingSports_3.0.4.345_x64__8wekyb3d8bbwe [2016-04-29] (Microsoft Corporation) [MS Ad]
MSN Travel -> C:\Program Files\WindowsApps\Microsoft.BingTravel_3.0.4.336_x64__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation) [MS Ad]
MSN Weather -> C:\Program Files\WindowsApps\Microsoft.BingWeather_3.0.4.350_x64__8wekyb3d8bbwe [2016-11-23] (Microsoft Corporation) [MS Ad]
Music -> C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2.6.672.0_x64__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation) [MS Ad]
Skype -> C:\Program Files\WindowsApps\Microsoft.SkypeApp_3.1.0.1016_x86__kzf8qxf38zg5c [2016-03-01] (Skype) [MS Ad]
Snapfish -> C:\Program Files\WindowsApps\AD2F1837.HPConnectedPhotopoweredbySnapfish_5.5.0.8_x86__v10z8vjag6ke6 [2016-05-04] (HP Inc.)
Video -> C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2.6.446.0_x64__8wekyb3d8bbwe [2016-03-01] (Microsoft Corporation) [MS Ad]
YouCam for HP -> C:\Program Files\WindowsApps\CyberLinkCorp.hs.YouCamforHP_1.0.2.29632_x86__06qsbagp91rvg [2016-03-01] (CYBERLINKCOM CORP)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1403370322-224015993-469023631-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation - pGFX -> Intel Corporation)
CustomCLSID: HKU\S-1-5-21-1403370322-224015993-469023631-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1403370322-224015993-469023631-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1403370322-224015993-469023631-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1403370322-224015993-469023631-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2019-07-29] (AVAST Software s.r.o. -> AVAST Software)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2019-07-29] (AVAST Software s.r.o. -> AVAST Software)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov) [File not signed]
ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2019-07-29] (AVAST Software s.r.o. -> AVAST Software)
ContextMenuHandlers1: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll [2013-06-27] (CyberLink Corp. -> Cyberlink)
ContextMenuHandlers1: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll [2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
ContextMenuHandlers2: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll [2013-06-27] (CyberLink Corp. -> Cyberlink)
ContextMenuHandlers2: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll [2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2019-07-29] (AVAST Software s.r.o. -> AVAST Software)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-02-01] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov) [File not signed]
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2015-08-09] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2019-07-29] (AVAST Software s.r.o. -> AVAST Software)
ContextMenuHandlers6: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll [2019-04-16] (Comodo Security Solutions, Inc. -> COMODO)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-02-01] (Malwarebytes Corporation -> Malwarebytes)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2013-12-29 15:21 - 2013-07-15 18:29 - 000620718 ____N () [File not signed] C:\Program Files (x86)\BillP Studios\WinPatrol\sqlite3.dll
2010-11-18 21:08 - 2010-11-18 21:08 - 000086016 _____ (Igor Pavlov) [File not signed] C:\Program Files\7-Zip\7-zip.dll
2013-04-30 12:25 - 2013-04-30 12:25 - 000531456 _____ (Intel Corporation) [File not signed] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\ISDI2.dll
2013-04-30 12:25 - 2013-04-30 12:25 - 000286720 _____ (Intel Corporation) [File not signed] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\PsiData.dll
2013-02-13 12:46 - 2013-02-13 12:46 - 000731648 _____ (Intel(R) Corporation) [File not signed] C:\Program Files\Intel\iCLS Client\HeciServer.exe
2013-09-26 16:21 - 2013-06-21 07:55 - 000499712 _____ (Microsoft Corporation) [File not signed] C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\MSVCP71.dll
2013-09-26 16:21 - 2013-06-21 07:55 - 000348160 _____ (Microsoft Corporation) [File not signed] C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\MSVCR71.dll
2013-09-26 16:02 - 2012-02-14 19:37 - 000594432 _____ (Realtek Semiconductor Corp. ) [File not signed] C:\WINDOWS\system32\Rtlihvs.dll
2013-12-31 15:32 - 2012-11-12 16:15 - 000558592 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enppmon.dll
2013-12-31 15:32 - 2012-10-22 18:19 - 000219648 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enpres.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\WINDOWS\avastSS.scr:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\HelpPane.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\WLXPGSS.SCR:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ActionQueue.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\adtschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\advapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\apisetschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidcertstorecheck.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\appidpolicyconverter.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appidsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appinfo.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\asycfilt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atmfd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\authz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\autoconv.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\basecsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\basesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bcrypt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bcryptprimitives.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BFE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certenc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certprop.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certutil.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cic.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cnvfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\compstui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\consent.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\convert.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\credssp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\crypt32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cryptnet.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\csrsrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3d10level9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3d11.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_47.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DafPrintProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DAFWSD.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\difx64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DPTopologyApp.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\DPTopologyAppv2_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dxtmsft.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\escsvc64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\esent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\E_GCINST.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\E_ID4BJBE.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fdWCN.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FirewallAPI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FWPUCLNT.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FwRemoteSvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\GfxUIEx.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Gfxv2_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Gfxv4_0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gpapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gpsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\hal.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\icfupgd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\icm32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieetwcollector.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieetwproxystub.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ifsutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxCUIService.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxEM.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxext.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxHK.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\igfxTray.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IntelWiDiUMS64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IntelWiDiVAD64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IPHLPAPI.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iprtrmgr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\IPSECSVC.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsidsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsiexe.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsium.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsiwmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfmjpegdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfmp4srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfsvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mgmtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mispace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcbase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcndmgr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mmcshext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprddm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprdim.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MPSSVC.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mscms.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msctf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msftedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msinfo32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msobjs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msra.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msrating.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MsSpellCheckingFacility.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ncryptsslp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ncsi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nlaapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nlasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ntprint.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ntshrui.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\offreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\P2P.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\p2psvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pcalua.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pcasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PlayToDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pnrpsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\polstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\prnntfy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\puiapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\quartz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rascfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rascustom.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasman.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasmans.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasppp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rastapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rastls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdpudd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdsdwmdr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\regsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rfxvmt.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SCardDlg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SCardSvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ScDeviceEnum.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\scesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\scksp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\shdocvw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\shsetup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\smbwmiv2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\snmptrap.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\srvsvc.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\sscore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\storagewmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sysmain.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TabSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tdc.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tpmvsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TsWpfWrp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinui.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tzsync.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ubpm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uexfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ufat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ulib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\umrdp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\untfs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uReFS.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uudf.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\UXInit.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\uxtheme.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\vmrdvcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\vpnike.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Vxdif.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wbengine.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WcnApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wcncsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wdc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wevtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wevtsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wfapigp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wfdprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Streaming.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wininit.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winlogon.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wintrust.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WinUSBCoInstaller2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wisp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlanmsm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlansec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WMASF.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmitomi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wow64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wow64cpu.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpdbusenum.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpd_ci.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WSDApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wsdchngr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\WSDScDrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WsmAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WsmAuto.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\wsnmp32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xolehlp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xpsrchvw.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\adtschema.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\advapi32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\appidapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\asycfilt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atmfd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\authz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\autoconv.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\basecsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\bcrypt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\bcryptprimitives.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\certenc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\certutil.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cic.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cnvfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\compstui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\credssp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\crypt32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptnet.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10level9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d11.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_47.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DafPrintProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtmsft.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\esent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\fdWCN.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\FWPUCLNT.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\FwRemoteSvr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\gpapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\icm32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ieui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ifsutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\IPHLPAPI.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iprtrmgr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsidsc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsium.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsiwmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmjpegdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mgmtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mispace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcbase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcndmgr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mmcshext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprddm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprdim.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mscms.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSCOMCTL.OCX:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msctf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msftedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MshtmlDac.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msinfo32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjetoledb40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjint40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjter40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msjtes40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msobjs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msrating.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msrepl40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mstext40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mswdat10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mswstr10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ncryptsslp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nlaapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntdll.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntprint.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntshrui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntvdm64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\offreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\olepro32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\P2P.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\pdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\polstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\prnntfy.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\puiapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\quartz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rascfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasman.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasppp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rastapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rastls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\scesrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\scksp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\setup16.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\shdocvw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\shsetup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sscore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\storagewmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sysmon.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\tdc.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\TsWpfWrp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uexfat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ufat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ulib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\untfs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uReFS.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uudf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UXInit.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uxtheme.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WcnApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wdc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wevtapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wfapigp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wfdprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wintrust.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WinTypes.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wisp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanmsm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wlansec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WMASF.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmitomi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wow32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WSDApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsdchngr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmAuto.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsnmp32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xpsrchvw.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\acpi.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\afd.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\agilevpn.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\AGP440.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\Apfiltr.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\BasicRender.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\cdrom.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\cmimcext.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dfsc.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\disk.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dumpfve.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\fltMgr.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidclass.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidusb.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\http.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\isapnp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mountmgr.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxdav.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb20.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\msisadrv.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndproxy.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\netbios.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\netio.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\NV_AGP.SYS:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\nwifi.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pacer.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pci.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pdc.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\phantomtap.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdbss.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdyboost.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\scfilter.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\serenum.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\serial.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\spaceport.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\storport.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\tap0901.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\tdx.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ULIAGPKX.SYS:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbccgp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbehci.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbhub.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\volmgrx.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwifibus.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwififlt.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vwifimp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdBoot.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdFilter.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdNisDrv.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WSDScan.sys:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Desktop\adblw206.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\4l44-2D.msz:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\avira_en_vpnb0_59ec6e54c2bd4__adw.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup540.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\ccsetup541.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CG_5.0.14.7.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CG_6.0.8_EXP-PF.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF(1).docx:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\CurrentRatesforResidentialChargingApril2015forPDF.docx:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221 (1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\dfsetup221.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\epson513623eu.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\Firefox Installer.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\KingRoot_pc_en.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\kodi-16.1-Jarvis.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\kodi-17.1-Krypton.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\user\Downloads\Minecraft.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming(1).zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-fix_upcoming.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra-master.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\plugin.video.nbcsnliveextra.0.0.6.fix.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\Silverlight_x64.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup52.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup54.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\spywareblastersetup55.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\TVMC_Windows.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\user\Downloads\wlsetup-web.exe:$CmdTcID [64]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-1403370322-224015993-469023631-1001\…\1001movie.com -> 1001movie.com

There are 6091 more sites.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2019-01-05 11:50 - 000000825 _____ C:\WINDOWS\system32\drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\OpenCL SDK\3.0\bin\x86;C:\Program Files (x86)\Intel\OpenCL SDK\3.0\bin\x64;C:\Program Files (x86)\Windows Live\Shared;C:\Program Files (x86)\Skype\Phone\
HKU\S-1-5-21-1403370322-224015993-469023631-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\user\Pictures\Camera Roll\TOMMY\IMG_1174 - Copy.JPG
DNS Servers: [removed] - [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (No File)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{3F10DB76-5B0B-4DCD-AF46-338F194DFC73}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{D7F645AD-DDAA-497C-B2AD-625D07D9D9EC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{2C023406-873B-4F7C-9615-7EB2734982D7}] => (Allow) LPort=1900
FirewallRules: [{43396E10-9017-4F4A-9A0A-13D44135C4CE}] => (Allow) LPort=2869
FirewallRules: [{442AA05F-CF25-40BD-BC86-27FA3A149F92}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{12B939C9-1E1B-470F-91D2-39F1AB470FE1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{D8575081-79D1-4269-AFB5-05D701EB3E27}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{6D2216FF-CBE0-4F9F-AD56-56A4E058FB01}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{9AE5611F-0A7B-4243-8A13-C08843FFF1EA}] => (Allow) E:\Network\EpsonNetSetup\ENEasyApp.exe No File
FirewallRules: [{BFE5C74F-C088-4E95-BFE9-CAE7527BED6A}] => (Allow) E:\Network\EpsonNetSetup\ENEasyApp.exe No File
FirewallRules: [{045F7BDB-BFCD-43F2-BED4-9E2EFB30ED0F}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{ACBA0269-FC68-4FD1-877D-5F6847266646}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{7B6E12D1-D3AF-4E33-A7A6-FE3A1D0CCCB1}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{5154D19E-8D72-456C-8FB0-7BA801191A66}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{7571A772-A111-44CE-A99E-B22ADA20F4A3}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe (CyberLink Corp. -> CyberLink)
FirewallRules: [{1E92BB79-063D-4B0B-AC39-AE6C396C11C2}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe (CyberLink Corp. -> CyberLink Corp.)
FirewallRules: [{77FA0945-7FE9-4700-B4B7-7338498E4BA1}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{98F34E2E-C70A-4FB2-B0B5-6EBDE8D96543}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{FA29AC84-8759-4E79-BE15-9D4F68B11E97}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{EA6F67C6-FE3F-4580-B114-5609D037CCC6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
FirewallRules: [{4D0A45E3-574B-48CE-8E0F-17A13761B990}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe (Meridian Audio Ltd -> Meridian Audio Ltd)
FirewallRules: [{7F11DF3E-BA0E-4AEB-839F-D687C22F862E}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe (Meridian Audio Ltd -> Meridian Audio Ltd)
FirewallRules: [TCP Query User{AC09203A-4D76-468B-943F-D39948179F85}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
FirewallRules: [UDP Query User{8BC0988E-C09D-483A-B41D-683963F31FF2}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
FirewallRules: [{28CF0D79-2DA2-4FAD-8A4C-87599C2B6606}] => (Block) C:\program files (x86)\epson software\event manager\eeventmanager.exe (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
FirewallRules: [{92AE8366-2941-46B0-BF21-0CAA9500BAD1}] => (Block) C:\program files (x86)\epson software\event manager\eeventmanager.exe (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
FirewallRules: [{600B5C03-30FF-4E7D-BC56-1BE2DCF1C379}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{18EA988F-0CEB-40BE-B362-01909A5F3A67}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{397B61B0-98CE-47FE-BF6D-710DA2821BE8}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe (Hewlett-Packard Company -> Hewlett-Packard Company)
FirewallRules: [{F90BC466-1B00-47BA-B76B-C0378A3B2F64}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{1770AB1E-6B1E-42F6-8B22-16B00A7BE287}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{CCD21E30-521E-470F-A99E-76F154E3DE82}] => (Allow) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe (AVAST Software s.r.o. -> AVAST Software)

==================== Restore Points =========================

16-05-2019 22:53:34 Windows Update
24-07-2019 22:53:51 Windows Update
29-07-2019 22:39:17 Restore Point Created by FRST

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/03/2019 11:52:17 PM) (Source: Perflib) (EventID: 1015) (User: )
Description: The performance data collection function "PerfProc" in the "C:\WINDOWS\System32\perfproc.dll" library did not complete in the allowed time. There may be a problem with this extensible counter, the service from which the counter is collecting data, or the system may have been very busy when this call was attempted.

Error: (08/03/2019 11:50:22 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hp)
Description: Activation of application Microsoft.BingNews_8wekyb3d8bbwe!AppexNews failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/03/2019 11:50:13 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hp)
Description: Activation of application Microsoft.BingFinance_8wekyb3d8bbwe!AppexFinance failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/03/2019 11:35:13 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hp)
Description: Activation of application Microsoft.BingSports_8wekyb3d8bbwe!AppexSports failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/03/2019 11:20:13 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hp)
Description: Activation of application Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/03/2019 11:06:28 PM) (Source: MsiInstaller) (EventID: 11316) (User: NT AUTHORITY)
Description: Product: Avast Update Helper – Error 1316. The specified account already exists.

Error: (08/03/2019 10:06:28 PM) (Source: MsiInstaller) (EventID: 11316) (User: NT AUTHORITY)
Description: Product: Avast Update Helper – Error 1316. The specified account already exists.

Error: (08/03/2019 10:05:13 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: hp)
Description: Activation of application Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.


System errors:
=============
Error: (08/03/2019 12:11:57 PM) (Source: DCOM) (EventID: 10010) (User: hp)
Description: The server {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} did not register with DCOM within the required timeout.

Error: (08/03/2019 12:11:27 PM) (Source: DCOM) (EventID: 10010) (User: hp)
Description: The server {1B1F472E-3221-4826-97DB-2C2324D389AE} did not register with DCOM within the required timeout.

Error: (08/03/2019 11:46:29 AM) (Source: DCOM) (EventID: 10010) (User: hp)
Description: The server {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} did not register with DCOM within the required timeout.

Error: (08/03/2019 11:45:59 AM) (Source: DCOM) (EventID: 10010) (User: hp)
Description: The server {1B1F472E-3221-4826-97DB-2C2324D389AE} did not register with DCOM within the required timeout.

Error: (08/03/2019 11:13:05 AM) (Source: DCOM) (EventID: 10010) (User: hp)
Description: The server {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} did not register with DCOM within the required timeout.

Error: (08/03/2019 11:12:34 AM) (Source: DCOM) (EventID: 10010) (User: hp)
Description: The server {1B1F472E-3221-4826-97DB-2C2324D389AE} did not register with DCOM within the required timeout.

Error: (08/03/2019 10:48:39 AM) (Source: DCOM) (EventID: 10010) (User: hp)
Description: The server {1B1F472E-3221-4826-97DB-2C2324D389AE} did not register with DCOM within the required timeout.

Error: (08/03/2019 10:48:09 AM) (Source: DCOM) (EventID: 10010) (User: hp)
Description: The server {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} did not register with DCOM within the required timeout.


CodeIntegrity:
===================================

Date: 2019-07-29 21:49:25.952
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-29 21:47:59.263
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-28 16:10:02.168
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-27 12:13:03.267
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-27 12:03:34.668
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-26 18:05:19.868
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-25 17:17:51.171
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-07-25 17:16:48.851
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\SysWOW64\guard32.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info ===========================

BIOS: Insyde F.11 07/19/2013
Motherboard: Hewlett-Packard 2161
Processor: Intel(R) Core(TM) i5-4200U CPU @ 1.60GHz
Percentage of memory in use: 63%
Total physical RAM: 3866.15 MB
Available physical RAM: 1404.89 MB
Total Virtual: 7834.15 MB
Available Virtual: 4790.46 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:442.45 GB) (Free:342.2 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (RECOVERY) (Fixed) (Total:22.1 GB) (Free:2.23 GB) NTFS ==>[system with boot components (obtained from drive)]

\\?\Volume{969e5462-71f0-49fd-b3ed-8fb0102e65bc}\ (WINRE) (Fixed) (Total:0.39 GB) (Free:0.13 GB) NTFS
\\?\Volume{ff2d498f-c6f2-4170-afd4-114805135254}\ () (Fixed) (Total:0.44 GB) (Free:0.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 8DED8F94)

Partition: GPT.

==================== End of Addition.txt ============================

 

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 00:12:43, on 04/08/2019
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.19036)


Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
C:\Users\user\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPNOT13/2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll
O4 - HKCU\..\Run: [WinPatrol] C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [EPLTarget\P0000000000000000] C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIJBE.EXE /EPT "EPLTarget\P0000000000000000" /M "XP-700 Series"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.EXE
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: @oem30.inf,%HidMonitor.SvcDisp%;Alps HID Monitor Service (ApHidMonitorService) - Alps Electric Co., Ltd. - C:\Program Files\Apoint2K\HidMonitorSvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: aswbIDSAgent - AVAST Software - C:\Program Files\AVAST Software\Avast\aswidsagent.exe
O23 - Service: %1!s! Update Service (avast) (avast) - Unknown owner - C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: %1!s! Update Service (avastm) (avastm) - Unknown owner - C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
O23 - Service: Avast Secure Browser Elevation Service (AvastSecureBrowserElevationService) - AVAST Software - C:\Program Files (x86)\AVAST Software\Browser\Application\75.1.1528.100\elevation_service.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: COMODO Virtual Service Manager (cmdvirth) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
O23 - Service: CyberLink PowerDVD 12 Media Server Monitor Service - CyberLink - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
O23 - Service: CyberLink PowerDVD 12 Media Server Service - CyberLink - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: Epson Scanner Service (EpsonScanSvc) - Unknown owner - C:\WINDOWS\system32\EscSvc64.exe (file missing)
O23 - Service: EPSON V3 Service4(04) (EPSON_PM_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: @oem9.inf,%hpservice_desc%;HP Service (hpsrv) - Unknown owner - C:\WINDOWS\system32\Hpservice.exe (file missing)
O23 - Service: HPWMISVC - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
O23 - Service: HuaweiHiSuiteService64.exe - Unknown owner - C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService1.0.0.0) - Unknown owner - C:\WINDOWS\system32\igfxCUIService.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: Realtek Audio Service (RtkAudioService) - Realtek Semiconductor - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 10981 bytes
 

Hi Juliet

Comodo Update would of installed the full suite including anti-virus on a thirty day trial but it was never purchased so reverted back to firewall only. Here is the requested Log.

 

 

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 05-08-2019
Ran by [removed] (06-08-2019 22:26:03) Run:2
Running from C:\Users\[removed]\Desktop\WHAT THE TECH\Farbar Recovery Tool
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
Task: {3393A359-8BB2-406C-AF19-BEC127F2F18A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe
Task: {AF850082-79A2-4BE9-AD5C-A1F631A80A36} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe
Task: {B45CAF8D-08AC-4F67-A7DA-C25F58764BB1} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\f1tp426w.default\searchplugins\yahoo-avast.xml [2017-06-18]
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx