Solved Removal of C:\Windows\SysWOW64\cmd.exe

[mdp3157]

I stupidly opened an email attachment since then Kaspersky is telling me I have C:\Windows\SysWOW64\cmd.exe and is refusing to remove it.
FIRST.txt
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-02-2017 02
Ran by Michael (administrator) on MICHAEL-PC (17-02-2017 10:23:01)
Running from C:\Users\Michael\Desktop
Loaded Profiles: Michael (Available Profiles: Michael & DefaultAppPool)
Platform: Windows 10 Pro Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\avp.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\ExpressVPN\bootstrap\AMD64\nssm.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
() C:\Program Files (x86)\ExpressVPN\xvpnd\xvpnd.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\avpui.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_71\bin\javaw.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Apple, Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\secd.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.Sway_17.7870.45131.0_x64__8wekyb3d8bbwe\sway.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7903.40527.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7903.40527.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe
() C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [RtsCM] => C:\WINDOWS\RTSCM64.EXE [210688 2015-06-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-11-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\isuspm.exe [2075480 2013-06-24] (Flexera Software LLC.)
HKLM-x32\...\Run: [PowerPDF Registry Controller] => C:\Program Files (x86)\Nuance\Power PDF\RegistryController.exe [206288 2015-02-06] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [NuanPowerPdf1NPDFLM] => C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe [3452456 2015-02-06] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [Nuance Power PDF Standard-reminder] => "C:\Program Files (x86)\Nuance\Power PDF\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\Power PDF Standard\Ereg\Ereg.ini"
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-12-22] (Oracle Corporation)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1314432 2016-03-11] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [438888 2014-01-15] (CANON INC.)
HKLM-x32\...\Run: [SilentCleanService] => C:\Program Files (x86)\iMobie\PhoneRescue\${CHECK_RUNSERVICE_NAME}
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [Translated.TAV] => C:\Program Files (x86)\TAV\TAV.exe [5394734 2014-07-16] (Translated)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [1987D95A86FCFAF5B82FFA7E9B4B7814763EFF83._service_run] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1120600 2017-02-08] (Google Inc.)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [PrinterProDesktop] => C:\Program Files (x86)\Printer Pro Desktop\PrinterProDesktop.exe [4056064 2015-11-04] ()
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2017-01-17] (Apple Inc.)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [67896 2017-01-17] (Apple Inc.)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [356664 2017-01-17] (Apple Inc.)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [Spotify Web Helper] => C:\Users\Michael\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1529456 2016-10-21] (Spotify Ltd)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [Spotify] => C:\Users\Michael\AppData\Roaming\Spotify\Spotify.exe [6795376 2016-10-21] (Spotify Ltd)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27427808 2017-02-08] (Skype Technologies S.A.)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\RunOnce: [Translated.TAV] => C:\Program Files (x86)\TAV\TAV.exe [5394734 2014-07-16] (Translated)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [37376 2016-07-16] (Microsoft Corporation)
GroupPolicy: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 212.159.13.49 212.159.13.50
Tcpip\..\Interfaces\{1fdc0269-e74d-4758-9420-27dce9e649fb}: [DhcpNameServer] 10.12.0.1
Tcpip\..\Interfaces\{c4431879-55d9-436b-a712-0e9d66579945}: [DhcpNameServer] 80.58.61.250 80.58.61.254
Tcpip\..\Interfaces\{edd1e0ee-9a3f-4f14-809c-e3205930f732}: [DhcpNameServer] 212.159.13.49 212.159.13.50

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-4a1eac3c
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=SL5M&ocid=SL5MDHP&osmkt=en-gb
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.palikan.com/results.php?f=4&q={searchTerms}&a=plk_ggbg_15_37&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0F0AtC0CtAyEyEzytDyEyDtN0D0Tzu0StCtAyDtDtN1L2XzutAtFtCtBtFyDtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2S0BtA0FtCtC0EtCtBtGyBzztA0AtGyEyByByDtGzyzy0F0CtGtC0FyByB0F0B0CtAzzzy0DtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StC0FtB0BtByD0BzytGtDyE0B0CtGyE0CtB0BtGzy0EtDtDtGyCzy0FtB0F0CtByE0D0DzzyD2QtN0A0LzuyE&cr=896150126&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.palikan.com/results.php?f=4&q={searchTerms}&a=plk_ggbg_15_37&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0F0AtC0CtAyEyEzytDyEyDtN0D0Tzu0StCtAyDtDtN1L2XzutAtFtCtBtFyDtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2S0BtA0FtCtC0EtCtBtGyBzztA0AtGyEyByByDtGzyzy0F0CtGtC0FyByB0F0B0CtAzzzy0DtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StC0FtB0BtByD0BzytGtDyE0B0CtGyE0CtB0BtGzy0EtDtDtGyCzy0FtB0F0CtByE0D0DzzyD2QtN0A0LzuyE&cr=896150126&ir=
SearchScopes: HKLM -> {6586d803-df30-46d3-a89a-4136c8571d45} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-4a1eac3c&q={searchTerms}
SearchScopes: HKLM -> {d4fee3d1-1014-4db8-a824-573bf9ab51c7} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-4a1eac3c&q={searchTerms}
SearchScopes: HKU\S-1-5-21-319729760-2674817846-3730761306-1000 -> DefaultScope {6586d803-df30-46d3-a89a-4136c8571d45} URL = hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-319729760-2674817846-3730761306-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.palikan.com/results.php?f=4&q={searchTerms}&a=plk_ggbg_15_37&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0F0AtC0CtAyEyEzytDyEyDtN0D0Tzu0StCtAyDtDtN1L2XzutAtFtCtBtFyDtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2S0BtA0FtCtC0EtCtBtGyBzztA0AtGyEyByByDtGzyzy0F0CtGtC0FyByB0F0B0CtAzzzy0DtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StC0FtB0BtByD0BzytGtDyE0B0CtGyE0CtB0BtGzy0EtDtDtGyCzy0FtB0F0CtByE0D0DzzyD2QtN0A0LzuyE&cr=896150126&ir=
SearchScopes: HKU\S-1-5-21-319729760-2674817846-3730761306-1000 -> {6586d803-df30-46d3-a89a-4136c8571d45} URL = hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-319729760-2674817846-3730761306-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={68297D4F-034B-48F6-9579-E63D87E3C2CE}&mid=6625006e4f5247cdbd6f1d1be9452ab7-b7ce1049860ea2f7df76c5f3174f9680bc0b5cfb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0915avt&pr=fr&d=2015-09-28 10:10:46&v=4.1.6.294&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-319729760-2674817846-3730761306-1000 -> {d4fee3d1-1014-4db8-a824-573bf9ab51c7} URL = hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q={searchTerms}&src=IE-SearchBox
BHO: Kaspersky Protection -> {03993315-5CE9-4F00-8790-D14A94F1D91A} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\x64\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2015-02-23] (CANON INC.)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)
BHO-x32: Kaspersky Protection -> {03993315-5CE9-4F00-8790-D14A94F1D91A} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2015-02-23] (CANON INC.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\ssv.dll [2016-01-25] (Oracle Corporation)
BHO-x32: Nuance PDF Toolbar Helper -> {940361F8-7F16-4498-AB43-2EFFE0235AFA} -> C:\Program Files (x86)\Nuance\Power PDF\Bin\SZeonIEFavClient.dll [2014-11-18] (Zeon Corporation)
BHO-x32: PlusIEEventHelper Class -> {9D137966-2E29-45C5-9B12-29D5427F8F66} -> C:\Program Files (x86)\Nuance\Power PDF\Bin\PlusIEContextMenu.dll [2014-02-27] (Zeon Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\jp2ssv.dll [2016-01-25] (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.)
Toolbar: HKLM - Kaspersky Protection Toolbar - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\x64\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Nuance PDF - {BED78D9C-A025-4FE9-B3BA-27E6D376A3D5} - C:\Program Files (x86)\Nuance\Power PDF\Bin\SZeonIEFavClient.dll [2014-11-18] (Zeon Corporation)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.)
Toolbar: HKLM-x32 - Kaspersky Protection Toolbar - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: sv5layt6.default
FF ProfilePath: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default [2016-03-14]
FF user.js: detected! => C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\user.js [2015-09-12]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\sv5layt6.default -> Bing
FF SearchEngineOrder.3: Mozilla\Firefox\Profiles\sv5layt6.default -> Bing
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\sv5layt6.default -> Bing
FF Homepage: Mozilla\Firefox\Profiles\sv5layt6.default -> hxxp://www.msn.com/?pc=SL5M&ocid=SL5MDHP&osmkt=en-gb
hxxps://mysearch.avg.com/?cid={68297D4F-034B-48F6-9579-E63D87E3C2CE}&mid=6625006e4f5247cdbd6f1d1be9452ab7-b7ce1049860ea2f7df76c5f3174f9680bc0b5cfb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0915avt&pr=fr&d=2015-09-28 10:10:46&v=4.1.6.294&pid=wtu&sg=&sap=hp
FF Keyword.URL: Mozilla\Firefox\Profiles\sv5layt6.default -> hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q=
FF Extension: (Bing Search) - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\Extensions\bingsearch.full@microsoft.com.xpi [2015-12-27]
FF Extension: (Magnify It) - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\Extensions\magit@magit.com [2015-09-12] [not signed]
FF Extension: (Mozilla Firefox Hotfixer) - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\Extensions\veggy@veggyAddon.com [2015-11-08] [not signed]
FF Extension: (BT Toolbar) - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\Extensions\{aba8d0e6-0d4d-4cb8-836a-04d69824b108} [2015-11-09] [not signed]
FF Extension: (No Name) - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\avg@toolbar [not found]
FF Extension: (Nuance PDF Convert) - C:\Program Files (x86)\Nuance\Power PDF\FireFox [2015-09-28] [not signed]
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\searchplugins\bing-.xml [2015-12-27]
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\searchplugins\palikan.xml [2015-09-16]
FF Extension: (Motive Extension) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\mcciwbch@motive.com.xpi [2015-11-09] [not signed]
FF Extension: (Skype) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-01-06]
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_ACF0E80077C511E59DED005056C00008@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\FFExt\light_plugin_firefox\addon.xpi
FF Extension: (Kaspersky Protection) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\FFExt\light_plugin_firefox\addon.xpi [2016-12-02]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2015-10-29] (CANON INC.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.71.2 -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\dtplugin\npDeployJava1.dll [2016-01-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.71.2 -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\plugin2\npjp2.dll [2016-01-25] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-12-28] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-23] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-23] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\Power PDF\bin\nppdf.dll [2015-01-08] (Zeon Corporation)
FF Plugin HKU\S-1-5-21-319729760-2674817846-3730761306-1000: @hola.org/FlashPlayer -> C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\flash\NPSWF32_18_0_0_232.dll [2016-03-16] ()
FF Plugin HKU\S-1-5-21-319729760-2674817846-3730761306-1000: @hola.org/vlc -> C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\npvlc.dll [2016-03-16] (Hola)
StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.co.uk/
CHR StartupUrls: Default -> "hxxp://www.google.co.uk/","hxxp://www.bbc.co.uk/news"
CHR DefaultSearchKeyword: Default -> google.co.uk
CHR Profile: C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default [2017-02-17]
CHR Extension: (Google Slides) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-09-12]
CHR Extension: (Google Docs) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-16]
CHR Extension: (Google Drive) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (Freecell Solitaire) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\cabpjbpfakfhcfidnjahmdophhihafkh [2015-09-28]
CHR Extension: (Street Racers) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\cohkjfondhjjfehnehlpmjpljpihfhfc [2015-09-28]
CHR Extension: (Google Search) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (GetFlightInfo) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc [2016-10-02]
CHR Extension: (Cordy) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgjbkahdllcckjbjijejpmcgkkjpnnfk [2015-09-28]
CHR Extension: (Realm of the Mad God) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhjfmaldpppkmjjgkmadddbanpabfflp [2015-09-28]
CHR Extension: (Solitaire) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkelcbhdkpcdiiancfjhjcpdinbbfolp [2015-09-28]
CHR Extension: (The Godfather: Five Families) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfkoljdeffeedleidebkmmamepgbnbl [2015-09-28]
CHR Extension: (Solitaire: Deck of Cods ) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\eefllalllgpmcjgpohamfcllldfafoac [2015-09-28]
CHR Extension: (Google Sheets) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-09-12]
CHR Extension: (Causality Games) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\femoooemgmjaebeodbbikbkmhlafenpl [2015-09-28]
CHR Extension: (Booking.com for Chrome™) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgkeilefmpmbamgcejhjpiecahcbipip [2016-03-07]
CHR Extension: (Winter Solitaire) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghajoocbdkpejimpioleoiacokncanpl [2015-09-28]
CHR Extension: (Google Docs Offline) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (Qbox - Wisdom of the Ages) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikfnimbehfhlelledoaemompbeihbhfb [2015-09-28]
CHR Extension: (zoomWheel) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfgigbjonaniokmpfflpflkhahhbaej [2015-09-28]
CHR Extension: (Kaspersky Protection) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpeeaghdjmhlakojjcgfdhgcejdaefmi [2017-01-30]
CHR Extension: (Extreme Racing) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdapmkojdflkpldoldoccpobfeaononj [2016-05-18]
CHR Extension: (Google Mail Checker) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2015-09-28]
CHR Extension: (WGT Golf Game) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpedbpkelbhcbkdaglillalioeeekbpb [2015-09-28]
CHR Extension: (Office Online) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndjpnladcallmjemlbaebfadecfhkepb [2016-10-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-23]
CHR Extension: (GTT Automator for Translated.net) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbajcadkkdfbdhljmemgdccfalehmifo [2017-01-13]
CHR Extension: (WorldWar) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbjgfoejobpldjhcjlcijkekinoljank [2015-09-28]
CHR Extension: (World Clocks 2) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjgoijhajhaahklokegbfnohialajpej [2015-09-28]
CHR Extension: (Gmail) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-09-16]
CHR Extension: (Chrome Media Router) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-06]
CHR HKLM\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 AVP16.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\avp.exe [236928 2015-12-22] (AO Kaspersky Lab)
R2 BcmBtRSupport; C:\WINDOWS\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
S2 BT Help Wizard; C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\bin\MAHostService.exe [321024 2014-04-09] (Alcatel-Lucent) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3699904 2016-12-28] (Microsoft Corporation)
R2 ExpressVpnService; C:\Program Files (x86)\ExpressVPN\bootstrap\AMD64\nssm.exe [331264 2016-03-09] () [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [24888 2015-07-26] (Hewlett-Packard Company)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [84616 2013-06-28] ()
S3 klvssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\x64\vssbridge64.exe [152488 2015-12-22] (AO Kaspersky Lab)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7184144 2016-07-06] (TeamViewer GmbH)
S4 TheDesktopWeatherService; C:\Program Files (x86)\WeatherTool\2.0.0.10766\WeatherService.exe [149752 2015-07-21] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S2 pcCMService; "C:\Program Files (x86)\Common Files\Motive\pcCMService.exe" [X]
S2 pcCMService64; "C:\Program Files\Common Files\Motive\pcCMService.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [102912 2015-05-28] (Advanced Micro Devices)
R3 bcbtums; C:\WINDOWS\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R0 cm_km; C:\WINDOWS\System32\DRIVERS\cm_km.sys [389816 2015-07-05] (Kaspersky Lab ZAO)
S3 HtcVCom32; C:\WINDOWS\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-08] (QUALCOMM Incorporated)
R0 kl1; C:\WINDOWS\System32\DRIVERS\kl1.sys [478392 2015-09-11] (Kaspersky Lab ZAO)
R0 klbackupdisk; C:\WINDOWS\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO)
R1 klbackupflt; C:\WINDOWS\System32\DRIVERS\klbackupflt.sys [79752 2015-12-01] (AO Kaspersky Lab)
R2 kldisk; C:\WINDOWS\system32\DRIVERS\kldisk.sys [78200 2015-12-01] (AO Kaspersky Lab)
S0 klelam; C:\WINDOWS\System32\DRIVERS\klelam.sys [30328 2015-06-23] (Kaspersky Lab)
R3 klflt; C:\WINDOWS\system32\DRIVERS\klflt.sys [182664 2015-12-11] (AO Kaspersky Lab)
R1 klhk; C:\WINDOWS\System32\drivers\klhk.sys [237912 2016-12-02] (AO Kaspersky Lab)
R3 klids; C:\ProgramData\Kaspersky Lab\AVP16.0.1\Bases\klids.sys [182360 2016-10-05] (AO Kaspersky Lab)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [992600 2016-08-16] (AO Kaspersky Lab)
R1 KLIM6; C:\WINDOWS\system32\DRIVERS\klim6.sys [51288 2016-04-29] (AO Kaspersky Lab)
R3 klkbdflt; C:\WINDOWS\system32\DRIVERS\klkbdflt.sys [52608 2015-11-11] (AO Kaspersky Lab)
R3 klmouflt; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [41656 2015-06-06] (Kaspersky Lab ZAO)
R1 klpd; C:\WINDOWS\System32\DRIVERS\klpd.sys [45960 2015-12-07] (AO Kaspersky Lab)
R1 klwfp; C:\WINDOWS\system32\DRIVERS\klwfp.sys [87984 2016-08-16] (AO Kaspersky Lab)
R1 Klwtp; C:\WINDOWS\system32\DRIVERS\klwtp.sys [110424 2016-08-16] (AO Kaspersky Lab)
R1 kneps; C:\WINDOWS\system32\DRIVERS\kneps.sys [194440 2015-12-02] (AO Kaspersky Lab)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek )
R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [3068160 2015-06-16] (Realtek Semiconductor Corp.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
U3 idsvc; no ImagePath
S3 MREMP50; \??\C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [X]
S3 MREMP50a64; \??\C:\Program Files\Common Files\Motive\MREMP50a64.sys [X]
S3 MRESP50; \??\C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [X]
S3 MRESP50a64; \??\C:\Program Files\Common Files\Motive\MRESP50a64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-17 10:23 - 2017-02-17 10:23 - 00033346 _____ C:\Users\Michael\Desktop\FRST.txt
2017-02-17 10:22 - 2017-02-17 10:23 - 00000000 ____D C:\FRST
2017-02-17 10:19 - 2017-02-17 10:21 - 02422272 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2017-02-16 11:27 - 2017-02-16 11:27 - 01788434 _____ C:\Users\Michael\Downloads\16496448-18705888-rQGUePan_original.zip
2017-02-16 10:40 - 2017-02-16 10:40 - 00125502 _____ C:\Users\Michael\Downloads\16484677-18703920-iuwSgXcl_original.zip
2017-02-16 08:54 - 2017-02-16 08:54 - 00053502 _____ C:\Users\Michael\Downloads\Use Classes - April 2014.pdf
2017-02-16 08:33 - 2017-02-16 08:33 - 00016363 _____ C:\Users\Michael\Downloads\Copy_of_17-02-14_DE-Grundtexte-in de-en.xlsx
2017-02-16 08:32 - 2017-02-16 08:32 - 00013866 _____ C:\Users\Michael\Downloads\Copy_of_17-02-14_DE-Grundtexte-in.xlsx
2017-02-16 08:10 - 2017-02-16 08:10 - 00110229 _____ C:\Users\Michael\Downloads\16398908-18702626-UJFNPJfh_original.zip
2017-02-16 07:57 - 2017-02-16 07:57 - 00032763 _____ C:\Users\Michael\Downloads\16480612-18698854-FTotNzAa_original.zip
2017-02-15 14:30 - 2017-02-15 14:30 - 00097362 _____ C:\Users\Michael\Desktop\NetFlorist Order No.pdf
2017-02-15 11:30 - 2017-02-15 11:30 - 01090101 _____ C:\Users\Michael\Downloads\16485331-18691420-TxLcnCLp_original.zip
2017-02-14 16:32 - 2017-02-14 16:32 - 00002221 _____ C:\Users\Public\Desktop\Google Earth.lnk
2017-02-14 16:32 - 2017-02-14 16:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
2017-02-14 14:51 - 2017-02-14 14:51 - 00000787 _____ C:\Users\Michael\Downloads\16478014-18680263-QXhsPeMR_original.zip
2017-02-14 14:40 - 2017-02-14 14:40 - 00000745 _____ C:\Users\Michael\Downloads\16477968-18680826-ZijXdLGf_original.zip
2017-02-14 11:45 - 2017-02-14 11:45 - 00010992 _____ C:\Users\Michael\Downloads\16475205-18678433-LIFSjGlh_original.zip
2017-02-09 13:38 - 2017-02-09 13:38 - 00004609 _____ C:\Users\Michael\Downloads\16436849-18631142-OgJugniq_original.zip
2017-02-08 09:05 - 2017-02-14 13:07 - 00029220 _____ C:\Users\Michael\Documents\Perkins Short-term lending - cashflow PL 311216 mdp.xlsx
2017-02-08 08:00 - 2017-02-08 08:00 - 27439058 _____ C:\Users\Michael\Downloads\wetransfer-b9ba66.zip
2017-02-06 09:45 - 2017-02-06 09:45 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-02-06 09:45 - 2017-02-06 09:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-02-06 09:44 - 2017-02-06 09:45 - 00000000 ____D C:\Program Files\iTunes
2017-02-06 09:44 - 2017-02-06 09:44 - 00000000 ____D C:\Program Files\iPod
2017-02-06 09:36 - 2017-02-06 09:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2017-01-31 11:24 - 2017-01-31 11:25 - 07791277 _____ C:\Users\Michael\Downloads\16341510-18520336-BnyVmyDu_original.zip
2017-01-26 09:49 - 2016-12-21 07:08 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2017-01-26 09:49 - 2016-12-21 04:44 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2017-01-20 14:13 - 2017-01-20 14:14 - 00000000 ____D C:\Users\Michael\Documents\Retired
2017-01-19 17:38 - 2017-01-19 17:38 - 00072608 _____ C:\Users\Michael\Downloads\item_6_Report_-_15-2044.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-17 10:24 - 2015-09-28 10:15 - 00000000 ____D C:\ProgramData\TEMP
2017-02-17 10:20 - 2015-09-24 09:55 - 00000000 ____D C:\Users\Michael\AppData\Roaming\Skype
2017-02-17 10:10 - 2015-09-23 16:52 - 00000000 ____D C:\Users\Michael\Documents\Outlook Files
2017-02-17 09:02 - 2016-08-31 21:46 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-17 08:47 - 2015-10-22 08:54 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2017-02-17 08:09 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-17 06:47 - 2016-07-16 11:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-16 16:56 - 2015-10-27 17:06 - 00000000 ____D C:\Users\Michael\AppData\Local\Packages
2017-02-15 22:37 - 2016-05-23 08:37 - 00002272 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-02-15 22:37 - 2016-05-23 08:37 - 00002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-02-14 16:32 - 2015-09-12 11:57 - 00000000 ____D C:\Program Files (x86)\Google
2017-02-14 15:45 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-02-13 09:20 - 2015-09-24 09:54 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-02-13 09:20 - 2015-09-24 09:54 - 00000000 ____D C:\ProgramData\Skype
2017-02-08 08:32 - 2015-09-12 15:09 - 00000000 ___RD C:\Users\Michael\OneDrive
2017-02-07 11:31 - 2016-08-31 21:56 - 00000000 ____D C:\Users\Michael
2017-02-06 10:03 - 2016-08-31 22:18 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-06 10:01 - 2016-07-16 06:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2017-02-06 09:44 - 2015-10-04 11:10 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-01-26 10:51 - 2016-07-16 11:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-01-26 09:39 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-01-23 08:09 - 2016-09-26 15:52 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-01-19 16:23 - 2016-12-23 08:14 - 00003284 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-01-19 16:23 - 2015-10-27 17:14 - 00002409 _____ C:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

==================== Files in the root of some directories =======

2015-09-12 12:56 - 2015-09-12 12:56 - 0000045 _____ () C:\Users\Michael\AppData\Roaming\WB.CFG

Some files in TEMP:
====================
2016-11-14 07:55 - 2016-11-14 07:55 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_1502316955798436089.dll
2017-01-13 10:50 - 2017-01-13 10:50 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_1946860896116147787.dll
2016-11-09 14:23 - 2016-11-09 14:23 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_2955224762791562019.dll
2016-12-12 10:33 - 2016-12-12 10:33 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3595117338664693598.dll
2016-11-16 12:07 - 2016-11-16 12:07 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3620258490207969899.dll
2017-01-04 10:59 - 2017-01-04 10:59 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3749789912587404521.dll
2016-12-30 09:04 - 2016-12-30 09:04 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3938284259698373481.dll
2016-11-28 10:36 - 2016-11-28 10:36 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_4095180269104634827.dll
2016-11-21 09:40 - 2016-11-21 09:40 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_4339129235026392215.dll
2017-02-06 09:29 - 2017-02-06 09:29 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_4888964238262517217.dll
2017-02-06 10:05 - 2017-02-06 10:05 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_5413159699755573671.dll
2016-11-12 08:35 - 2016-11-12 08:35 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_550169103972929519.dll
2016-11-02 07:19 - 2016-11-02 07:19 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6011582628790491166.dll
2016-12-02 07:57 - 2016-12-02 07:57 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6092676241025119789.dll
2017-01-26 09:36 - 2017-01-26 09:36 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6252253867785136471.dll
2017-01-15 11:16 - 2017-01-15 11:16 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6554549432069762015.dll
2016-12-21 15:50 - 2016-12-21 15:50 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6946857114823685689.dll
2016-11-23 11:24 - 2016-11-23 11:24 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_7074007406412860798.dll
2016-11-02 09:37 - 2016-11-02 09:37 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_7549312695266535886.dll
2016-12-23 08:36 - 2016-12-23 08:36 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_843542465262485620.dll
2017-01-27 11:21 - 2017-01-27 11:21 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_8453525500427162863.dll
2016-11-09 15:01 - 2016-11-09 15:01 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_9161306123345145982.dll
2017-02-06 09:29 - 2017-02-06 10:05 - 0266240 ____N (Hyperic, Inc.) C:\Users\Michael\AppData\Local\Temp\sigar-x86-winnt.dll
2016-11-22 07:44 - 2017-02-13 09:18 - 44048864 _____ (Skype Technologies S.A.) C:\Users\Michael\AppData\Local\Temp\SkypeSetup.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-02-13 11:06

==================== End of FRST.txt ============================

 

[mdp3157]

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-02-2017 02
Ran by Michael (17-02-2017 10:24:35)
Running from C:\Users\Michael\Desktop
Windows 10 Pro Version 1607 (X64) (2016-08-31 22:28:27)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-319729760-2674817846-3730761306-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-319729760-2674817846-3730761306-503 - Limited - Disabled)
Guest (S-1-5-21-319729760-2674817846-3730761306-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-319729760-2674817846-3730761306-1002 - Limited - Enabled)
Michael (S-1-5-21-319729760-2674817846-3730761306-1000 - Administrator - Enabled) => C:\Users\Michael

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {86367591-4BE4-AE08-2FD9-7FCB8259CD98}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {3D579475-6DDE-A186-1569-44B9F9DE8725}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {BE0DF4B4-018B-AF50-0486-D6FE7C8A8AE3}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.023.20056 - Adobe Systems Incorporated)
AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
Apple Application Support (32-bit) (HKLM-x32\...\{9BA1A894-B42F-4805-BC8C-349C905A3930}) (Version: 5.3.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{7EAC8A42-9FAC-4F6B-AABF-C08C9F2E0F13}) (Version: 5.3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.6.0.0 - Canon Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: 1.5.2.3 - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.5.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.10.15 - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.2.0 - Canon Inc.)
Canon MG2900 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2900_series) (Version: 1.01 - Canon Inc.)
Canon MG2900 series On-screen Manual (HKLM-x32\...\Canon MG2900 series On-screen Manual) (Version: 7.7.1 - Canon Inc.)
Canon MG2900 series User Registration (HKLM-x32\...\Canon MG2900 series User Registration) (Version: - ‭Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 3.5.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 3.5.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.3.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.7.0 - Canon Inc.)
CopyTrans Control Center Uninstall Only (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\CopyTrans Suite) (Version: 4.006 - WindSolutions)
ExpressVPN (HKLM-x32\...\{7e9357d8-8bdd-4e72-88ac-1b3acedd2b32}) (Version: 5.0.1.551 - ExpressVPN)
ExpressVPN (x32 Version: 5.0.1.551 - ExpressVPN) Hidden
ExpressVPN Compatibility Checks (x32 Version: 1.0.0.0 - ExpressVPN) Hidden
Fluency Now (HKLM-x32\...\{8A5CD593-FF6A-42FE-ACE5-58709FA1893A}) (Version: 4.0.0 - Western Standard)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.54 - Google Inc.)
Google Earth (HKLM-x32\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
HP Support Solutions Framework (HKLM-x32\...\{F6A11738-3EE4-4573-AEA5-6CD5D491C167}) (Version: 12.0.30.81 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\...\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.5.1 - Hewlett-Packard Company)
iCloud (HKLM\...\{0493048C-CB1A-44B7-8BB3-8467AF7BA9E4}) (Version: 6.1.2.13 - Apple Inc.)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.9 - HTC)
iTunes (HKLM\...\{9D0D2A8B-7E7B-4D88-8D50-24286ED6A5EB}) (Version: 12.5.5.5 - Apple Inc.)
Java 8 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218071F0}) (Version: 8.0.710.15 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{F575F386-57EF-4943-B003-A13F13B05EEB}) (Version: 16.0.1.445 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 16.0.1.445 - Kaspersky Lab) Hidden
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Nuance Power PDF Standard (HKLM\...\{B43651AB-6285-4FEB-95A2-3450D63378A2}) (Version: 1.10.8423 - Nuance Communications, Inc.)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
PhoneRescue (HKLM-x32\...\PhoneRescue) (Version: 3.2.3.0 - iMobie Inc.)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
Printer Pro Desktop (HKLM-x32\...\PrinterProDesktop) (Version: - Readdle)
QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
Serif DrawPlus Starter Edition (HKLM-x32\...\{33311EA4-0ECA-4E7F-83E5-8A92CD760152}) (Version: 2.0.2.010 - Serif (Europe) Ltd)
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype™ 7.32 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.32.104 - Skype Technologies S.A.)
Speed Fix Tool Plus (HKLM-x32\...\{600A25D8-5738-4AE8-B860-384146900459}) (Version: 3.0.3 - FixBliss)
Spotify (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Spotify) (Version: 1.0.38.171.g5e1cd7b2 - Spotify AB)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)
TAV (HKLM-x32\...\{FBFE84F8-A402-4F7D-B63E-5FBBFE6BA438}) (Version: 1.0.0.0 - Translated)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.62308 - TeamViewer)
The Desktop Weather 2.0 (HKLM\...\WeatherTool) (Version: 2.0.0.10766 - ShenZhen Enode Techology co,.Ltd) <==== ATTENTION
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WhatsApp (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\WhatsApp) (Version: 0.2.2731 - WhatsApp)
Windows 10 Upgrade Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17354 - Microsoft Corporation)
WYSIWYG Web Builder 11 (HKLM-x32\...\WYSIWYG_Web_Builder_11) (Version: - )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {03662996-3668-4022-BD17-1559481C0385} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {082F24D4-01D3-44B7-9207-955751DEF9D8} - System32\Tasks\{79F42A48-05D2-47CB-ABF5-C8ECA15C0F1F} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {0B4CB9A1-561A-41A5-B38D-A8D911FF4572} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => %SystemRoot%\ehome\ehPrivJob.exe
Task: {183E8F21-4548-4EB6-A615-95145418BCF1} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {24D65353-9C66-45EE-9BEC-CCBBAF61B453} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2016-12-29] (Microsoft Corporation)
Task: {29408F2B-0A23-414C-92B2-E0A80A9146AB} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {2EFBC053-9337-47F6-A61E-4FADFD2AA79A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-12] (Google Inc.)
Task: {354B9E14-8459-431C-A8B7-31087CDB6608} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {42FAD1EE-A0B3-4E00-A35D-8A2887E2316D} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {4963C22B-AB51-4E41-A785-5E6B0275A942} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {53B4CA52-3768-4406-B603-BC620DFAAFA7} - System32\Tasks\Go_Palikan => C:\Users\Michael\AppData\Local\{7C344~1\UNINST~1.EXE <==== ATTENTION
Task: {55D83733-396E-4B19-9ECF-CFB44BFB25D4} - System32\Tasks\{2508C3DC-9D26-478B-9AE2-67BF150F4CBB} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {59934F08-3300-4A92-AA0F-AA483E18536F} - System32\Tasks\{046B510E-D61B-4C5A-B0C3-5939DF20B152} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {59C5CFFE-60B2-4500-B35A-5DF65F0C3396} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {68B8B570-97FA-45CD-BAA7-7E271FCF0BE5} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => %SystemRoot%\ehome\mcupdate.exe
Task: {6956A104-A21C-410B-87B0-4102ECA07053} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {6D510903-6E39-4F68-A7EC-169B32026447} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {739BEF00-69DB-4E1A-885B-0E61E1187199} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {7506E117-5222-4876-976E-1E3389F868FA} - System32\Tasks\TechUtilities => C:\Program Files\TechUtilities\TechUtilities.exe
Task: {753AF1A7-71BD-4247-AED3-C96EBD3175F0} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => %SystemRoot%\ehome\ehrec.exe
Task: {765E2CEF-EC61-42C5-9488-4653E2D3AE28} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {7A083FFF-8697-4081-AB5C-5313CEDF14B6} - System32\Tasks\{175C893D-83C4-40BE-A4DE-3B7D9EAD1059} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {7D88719A-0728-4F54-B1EC-803EEAD5599B} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => %SystemRoot%\ehome\ehPrivJob.exe
Task: {815FC1A2-D806-44CF-A00A-56F271656A2D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-12] (Google Inc.)
Task: {822D47B8-3EC4-4C5E-A17A-13702D8B543B} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {8820AF1B-A70D-400F-B3BD-34C06F65C1D3} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {89FE76D1-1A6F-4549-8542-0C2E08AD837E} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {8B514EDF-ED61-442F-A6B8-27A86F7BD592} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => %SystemRoot%\ehome\mcupdate.exe
Task: {8D3EDFFE-81E2-4EDA-8B55-C8A3C4DE8455} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {8F8FE07D-AF62-4774-97DA-7C4234AC66C7} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => %SystemRoot%\ehome\ehPrivJob.exe
Task: {99DE913E-BC2A-405F-9653-F0AB6D5744CE} - System32\Tasks\SpeedFixToolPlus_Popup => C:\Program Files (x86)\Speed Fix Tool Plus\Splash.exe [2016-03-11] ()
Task: {A0CFF039-735C-45A0-933A-277FD1CEC375} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Michael\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe
Task: {A5AD278C-7896-4206-A5EA-1EABBD516B23} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {A95047BC-F9CA-43C1-804A-DF813A9CE7AF} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {AD6C95A2-E148-4258-957B-D782666E8A19} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {B35EBAF2-1116-4A14-8FAE-2C42C69E1E61} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => %windir%\ehome\MCUpdate.exe
Task: {B87A0DEA-3316-4397-9BD2-23C71CA59956} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => %SystemRoot%\ehome\ehPrivJob.exe
Task: {C906019E-88B0-49D7-A496-C567D0182F75} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {CB8E776D-5ED8-486F-92D9-C3201CF24E18} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {D04497CF-A798-446C-859C-C7FF8363AD35} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => %SystemRoot%\ehome\ehPrivJob.exe
Task: {D198FD40-7FF6-4A81-9CFA-C59EDE6617D5} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {D8A90EDA-2699-45D6-9188-0AE5FA70B6AE} - System32\Tasks\{56418FBD-AA82-4D56-B198-1A6BD9AC3C3B} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {DCD0B603-51D6-41A6-A3BB-1B2D5AC36E00} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {DD260EA0-9C3A-4A5C-963B-EC39A8FFEEB3} - System32\Tasks\IHUninstallTrackingTASK => CMD /C DEL C:\Users\Michael\AppData\Local\Temp\IHUCABE.tmp.exe <==== ATTENTION
Task: {E3DCE4D5-772C-45A4-803F-0CC4C4910674} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {E4CF82B4-0050-411C-92F9-C0F95ECD1E72} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => %SystemRoot%\ehome\ehPrivJob.exe
Task: {E83B7A34-7727-472E-B6C6-3B3555CB9C47} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {E9DCF220-5039-4000-9D37-B9F038257247} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {EDF5BE92-9EA8-4102-A09B-C25AA5EB20F3} - System32\Tasks\{31325081-21FA-4F42-8C7E-FB0853955119} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {F1C04D77-0330-4416-835C-C715BCFD478E} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => %SystemRoot%\ehome\ehPrivJob.exe
Task: {F67C5E30-1D24-49A9-8994-D5AE50C22B5B} - System32\Tasks\{B9DBCE12-491E-4EE7-AB8E-ADD2931147BF} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {F71818E3-5D44-401E-A0E5-A5C41797A182} - System32\Tasks\{892C3A89-A423-42F9-A9F8-719EDF67A757} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {F8532A59-D33A-4B41-AC65-564506137E64} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {F9BE1DA5-21D0-47CB-800A-E34D8698F9C1} - System32\Tasks\{A52089E7-4EF3-4404-BB5C-0D98D6799D00} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {FA478953-3D15-4498-ABFC-049D2E7C5D75} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {FDAFC471-7432-49FA-89E7-AE99F3465B2E} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => %SystemRoot%\ehome\mcupdate.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Go_Palikan.job => C:\Users\Michael\AppData\Local\{7C344~1\UNINST~1.EXE <==== ATTENTION
Task: C:\WINDOWS\Tasks\TechUtilities.job => C:\Program Files\TechUtilities\TechUtilities.exe -t C:\Program Files\TechUtilities\TechUtilities.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2016-07-16 11:42 - 2016-07-16 11:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-23 09:12 - 2016-12-09 10:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-09-01 17:12 - 2016-09-01 17:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-01-13 13:56 - 2017-01-13 13:56 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-03-09 13:56 - 2016-03-09 13:56 - 00331264 _____ () C:\Program Files (x86)\ExpressVPN\bootstrap\AMD64\nssm.exe
2016-10-05 15:30 - 2013-06-28 13:28 - 00084616 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2013-10-17 15:27 - 2013-10-17 15:27 - 00166912 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2016-03-10 14:56 - 2016-03-10 14:56 - 09641976 _____ () C:\Program Files (x86)\ExpressVPN\xvpnd\xvpnd.exe
2016-12-23 09:12 - 2016-12-09 10:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-08-07 08:10 - 2016-12-28 17:03 - 08924864 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2016-09-20 14:00 - 2016-09-07 04:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-12 11:37 - 2016-12-21 07:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-12 11:37 - 2016-12-21 07:08 - 00693248 _____ () C:\Windows\ShellExperiences\MtcUvc.dll
2017-02-06 09:30 - 2017-02-06 09:32 - 00073728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-02-06 09:30 - 2017-02-06 09:32 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-02-06 09:30 - 2017-02-06 09:32 - 42895872 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-02-06 09:30 - 2017-02-06 09:32 - 02215424 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\roottools.dll
2017-02-09 09:37 - 2017-02-09 09:37 - 00033992 _____ () C:\Program Files\WindowsApps\Microsoft.Office.Sway_17.7870.45131.0_x64__8wekyb3d8bbwe\PALExtensions.dll
2017-02-09 09:37 - 2017-02-09 09:37 - 00069832 _____ () C:\Program Files\WindowsApps\Microsoft.Office.Sway_17.7870.45131.0_x64__8wekyb3d8bbwe\Aria.dll
2017-02-09 09:37 - 2017-02-09 09:37 - 00063176 _____ () C:\Program Files\WindowsApps\Microsoft.Office.Sway_17.7870.45131.0_x64__8wekyb3d8bbwe\Logging.dll
2017-02-09 09:37 - 2017-02-09 09:37 - 00137928 _____ () C:\Program Files\WindowsApps\Microsoft.Office.Sway_17.7870.45131.0_x64__8wekyb3d8bbwe\Util.dll
2017-02-09 09:37 - 2017-02-09 09:37 - 01574608 _____ () C:\Program Files\WindowsApps\Microsoft.Office.Sway_17.7870.45131.0_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll
2017-02-09 09:37 - 2017-02-09 09:37 - 13327048 _____ () C:\Program Files\WindowsApps\Microsoft.Office.Sway_17.7870.45131.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Core.dll
2017-02-09 09:37 - 2017-02-09 09:37 - 02529992 _____ () C:\Program Files\WindowsApps\Microsoft.Office.Sway_17.7870.45131.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Story.dll
2017-02-09 09:37 - 2017-02-09 09:37 - 00650952 _____ () C:\Program Files\WindowsApps\Microsoft.Office.Sway_17.7870.45131.0_x64__8wekyb3d8bbwe\StoryClientUI_Shared.dll
2017-02-13 12:49 - 2017-02-13 12:51 - 13170368 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7903.40527.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Core.dll
2017-02-09 09:35 - 2017-02-08 09:29 - 02885464 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.37\libglesv2.dll
2017-02-09 09:35 - 2017-02-08 09:29 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.37\libegl.dll
2017-02-15 07:33 - 2017-02-15 07:33 - 03865088 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe
2017-02-16 06:52 - 2017-02-16 06:52 - 00015872 _____ () C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe
2017-02-16 06:52 - 2017-02-16 06:52 - 06538240 _____ () C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.dll
2017-02-06 09:31 - 2017-02-06 09:31 - 31178840 _____ () C:\Users\Michael\AppData\Local\Google\Chrome\User Data\PepperFlash\24.0.0.221\pepflashplayer.dll
2017-01-12 11:37 - 2016-12-21 06:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-12 11:37 - 2016-12-21 06:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-07-16 11:43 - 2016-07-16 11:43 - 00375648 _____ () C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe
2015-12-22 00:47 - 2015-12-22 00:47 - 00794920 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\kpcengine.2.3.dll
2016-03-10 14:56 - 2016-03-10 14:56 - 00379384 _____ () C:\Program Files (x86)\ExpressVPN\xvpnd\windows\ExpressVPN.FilterManager.dll
2017-02-06 10:05 - 2017-02-06 10:05 - 00056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_5413159699755573671.dll
2017-01-13 13:56 - 2017-01-13 13:56 - 01041720 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2016-09-01 17:13 - 2016-09-01 17:13 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2017-01-13 13:56 - 2017-01-13 13:56 - 00189752 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll
2016-08-07 08:01 - 2016-12-28 11:34 - 01010368 _____ () C:\Program Files (x86)\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll
2016-08-07 08:11 - 2017-01-13 08:50 - 00521408 _____ () C:\Program Files (x86)\Microsoft Office\root\Office16\msfad.dll
2016-08-07 08:01 - 2016-12-29 00:49 - 00143040 _____ () C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLCTL.DLL

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:F9CFE070 [762]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\hola.org -> hxxp://hola.org

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 02:34 - 2016-06-02 15:01 - 00002024 ____A C:\WINDOWS\system32\Drivers\etc\hosts

0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com

There are 4 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-319729760-2674817846-3730761306-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Michael\Desktop\19733_en_1.jpg
DNS Servers: 212.159.13.49 - 212.159.13.50
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: GladFileMonSvc => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: TheDesktopWeatherService => 2
MSCONFIG\Services: valWBFPolicyService => 2
MSCONFIG\Services: WtuSystemSupport => 2
HKLM\...\StartupApproved\Run: => "RtsCM"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "IJNetworkScannerSelectorEX"
HKLM\...\StartupApproved\Run32: => "CanonQuickMenu"
HKLM\...\StartupApproved\Run32: => "Nuance Power PDF Standard-reminder"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "NuanPowerPdf1NPDFLM"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "1987D95A86FCFAF5B82FFA7E9B4B7814763EFF83._service_run"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "BingSvc"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "PrinterProDesktop"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "ExpressVPN4"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "ApplePhotoStreams"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "iCloudServices"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "iCloudPhotos"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "Spotify Web Helper"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{4AB8E2A5-AD8C-4B60-8239-B4F751CF2281}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\bin\node.exe
FirewallRules: [{AD5721CD-9F65-49AE-9AD3-4117B611BE8A}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\bin\node.exe
FirewallRules: [{F07AF64C-F660-40C2-98B7-FB6D7363C92C}] => (Allow) C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
FirewallRules: [{E8460422-F07A-442B-9648-72EC7A7510A5}] => (Allow) C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
FirewallRules: [{2A43EAA1-B90B-42E5-9310-2FFBCF157C5E}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
FirewallRules: [{70BB4A7E-58B4-426B-8504-2781D8E45099}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
FirewallRules: [{4C2416FC-0DC1-400E-9CC8-FF378A3E4B69}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{D2AA7726-9C4B-4415-923D-3A3DF9E67426}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{6457D20F-28F6-4F9F-9250-DAD6D27A4706}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{15F21608-58F3-4166-9865-4DB11496055E}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{09724D86-DEE6-4ED0-9331-292FCE252F9E}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{49C00C96-91FE-441C-9F01-2640ACC0C6CD}] => (Allow) LPort=33300
FirewallRules: [{64AE33B2-1549-4F2D-8CED-5988DAE39CFD}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{BCD35B27-E893-4B2A-8208-9D263F10E1DF}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2ACBDF30-5333-46DC-A97A-037755AC0DCD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5564B592-D467-40FC-A909-40A5F1F64777}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [UDP Query User{57BCDEF5-06C6-49B5-ACB6-B07DEC0BA487}C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe] => (Allow) C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe
FirewallRules: [TCP Query User{F7EF5EBE-680F-4174-A980-AA1F6AF5AB93}C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe] => (Allow) C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe
FirewallRules: [{1B2A524E-3AB9-428B-AD14-191394E7BEE5}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr2003.exe
FirewallRules: [{CCB1DC8C-9EE8-4272-9579-1438820BA017}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr2003.exe
FirewallRules: [{BC4D829A-074D-4DC1-B783-7E638987E662}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe
FirewallRules: [{4581EE80-B6DC-4DC0-BD5D-1FD7020581A8}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe
FirewallRules: [{B7F1D112-EE8A-42AC-A193-309029428BDE}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladinetClient.exe
FirewallRules: [{DF4EB7D2-E089-4E99-9274-86B0EE3B88B7}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladinetClient.exe
FirewallRules: [{91874F7F-83F3-4D03-B5B3-D587E87099DE}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\Ereg\Ereg.exe
FirewallRules: [{FC97EEB0-7429-4AD8-9F4B-238CB058ED38}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\Ereg\Ereg.exe
FirewallRules: [{42C3EA27-78FE-460D-B1B9-921B5A7C3F5B}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NuancePDF.exe
FirewallRules: [{2FDA4E3A-DAB1-4CBC-94E1-C5038CE771DE}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NuancePDF.exe
FirewallRules: [{1ECB1205-FC43-43B8-8306-D3E825E528BD}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NPDFCreate.exe
FirewallRules: [{175C2F6D-3161-4E4C-AA67-48C5058B24CA}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NPDFCreate.exe
FirewallRules: [{C7173B54-BD22-4DBA-8422-2C244FB6D6AE}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe
FirewallRules: [{80CB71A0-59B3-4022-AA7D-4A5A62C166EF}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe
FirewallRules: [{D87257B7-A662-41EA-8931-224C506CB4E3}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFAssist.exe
FirewallRules: [{4D5AAB75-E5C8-44B9-BB47-1B74AA2DD08C}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFAssist.exe
FirewallRules: [UDP Query User{4B831A92-97D5-498C-A0F9-E048B5A8396D}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [TCP Query User{7E534F88-244B-48E9-94FF-9DD34218DB66}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [{5081F332-07BF-4CB5-8285-EF04A653F504}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [UDP Query User{70636A32-12C0-41B6-B17E-1242DD7E7BE2}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [TCP Query User{6028BDB7-A07F-4A73-9B62-E2C646950A36}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [{3BDB3194-2C3D-40FC-8FE0-8F4BD16EF58F}] => (Allow) C:\Users\Michael\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{F637C381-EC8D-49C1-AC48-40A01140243E}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{69AD1F1D-1433-4C9F-8CB7-7CFD4C087F60}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{8645F218-6BE2-45E1-AFB5-56143EE0EB53}] => (Allow) C:\Users\Michael\AppData\Local\Chromium\Application\chrome.exe
FirewallRules: [{A93A9AA8-441C-40FF-9204-7430FCCBA788}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{28AC2A8C-9817-405E-9A30-1D1AF22F723E}] => (Allow) C:\Program Files (x86)\bttb\dtuser.exe
FirewallRules: [{95FD9745-60CE-4017-BFFC-1E2151FA6D32}] => (Allow) C:\Program Files (x86)\bttb\dtuser.exe
FirewallRules: [{479F7A60-924D-44C7-9E71-DF261B6308EE}] => (Allow) %systemroot%\system32\alg.exe
FirewallRules: [{5BE7C6BB-0550-4631-8A63-7E0221EE941D}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{ADF931F8-5D2B-4252-975A-2618BE453D8C}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

26-01-2017 10:48:27 Windows Update
06-02-2017 12:05:47 Scheduled Checkpoint
16-02-2017 14:37:28 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/17/2017 10:13:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SearchUI.exe, version: 10.0.14393.693, time stamp: 0x585a272f
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xe0464645
Fault offset: 0x0000000000000000
Faulting process ID: 0x177c
Faulting application start time: 0x01d2806072d0390d
Faulting application path: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
Faulting module path: unknown
Report ID: e8c4cbdb-7699-40ab-8c6c-ce7eae853fca
Faulting package full name: Microsoft.Windows.Cortana_1.7.0.14393_neutral_neutral_cw5n1h2txyewy
Faulting package-relative application ID: CortanaUI

Error: (02/16/2017 02:37:47 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (02/16/2017 01:44:50 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\Nuance\Power PDF\NPDFAssist.exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.

Error: (02/13/2017 01:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2422

Error: (02/13/2017 01:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2422

Error: (02/13/2017 01:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/13/2017 01:12:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1141

Error: (02/13/2017 01:12:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1141

Error: (02/13/2017 01:12:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/13/2017 09:45:36 AM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: MICHAEL-PC)
Description: Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy32


System errors:
=============
Error: (02/16/2017 01:55:20 PM) (Source: BTHUSB) (EventID: 5) (User: )
Description: The Bluetooth driver expected an HCI event with a certain size but did not receive it.

Error: (02/16/2017 01:55:20 PM) (Source: BTHUSB) (EventID: 16) (User: )
Description: The mutual authentication between the local Bluetooth adapter and a device with Bluetooth adapter address (48:d7:05:60:08:25) failed.

Error: (02/14/2017 11:59:34 AM) (Source: BTHUSB) (EventID: 5) (User: )
Description: The Bluetooth driver expected an HCI event with a certain size but did not receive it.

Error: (02/14/2017 11:27:30 AM) (Source: BTHUSB) (EventID: 5) (User: )
Description: The Bluetooth driver expected an HCI event with a certain size but did not receive it.

Error: (02/14/2017 11:27:29 AM) (Source: BTHUSB) (EventID: 16) (User: )
Description: The mutual authentication between the local Bluetooth adapter and a device with Bluetooth adapter address (48:d7:05:60:08:25) failed.

Error: (02/13/2017 09:14:33 AM) (Source: BTHUSB) (EventID: 5) (User: )
Description: The Bluetooth driver expected an HCI event with a certain size but did not receive it.

Error: (02/13/2017 09:14:33 AM) (Source: BTHUSB) (EventID: 16) (User: )
Description: The mutual authentication between the local Bluetooth adapter and a device with Bluetooth adapter address (48:d7:05:60:08:25) failed.

Error: (02/09/2017 08:57:55 PM) (Source: BTHUSB) (EventID: 5) (User: )
Description: The Bluetooth driver expected an HCI event with a certain size but did not receive it.

Error: (02/09/2017 08:57:55 PM) (Source: BTHUSB) (EventID: 16) (User: )
Description: The mutual authentication between the local Bluetooth adapter and a device with Bluetooth adapter address (48:d7:05:60:08:25) failed.

Error: (02/09/2017 05:56:17 PM) (Source: DCOM) (EventID: 10010) (User: MICHAEL-PC)
Description: The server App.AppXy9rh3t8m2jfpvhhxp6y2ksgeq77vymbq.mca did not register with DCOM within the required timeout.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3 CPU M 380 @ 2.53GHz
Percentage of memory in use: 57%
Total physical RAM: 8047.43 MB
Available physical RAM: 3395.35 MB
Total Virtual: 16239.43 MB
Available Virtual: 9801.29 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:281 GB) (Free:196.88 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:15 GB) (Free:0 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.98 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 48E147D4)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=281 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)

==================== End of Addition.txt ============================

 

[Broni]

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=========================================

Please uninstall following unwanted program: The Desktop Weather.

Download RogueKiller from one of the following links and save it to your Desktop:

Link 1
Link 2

• Close all the running programs
• Double click on downloaded setup.exe file to install the program.
• Click on Start Scan button.
• Click on another Start Scan button.
• Wait until the Status box shows Scan Finished
• Click on Delete.
• Wait until the Status box shows Deleting Finished.
• Click on Report and copy/paste the content of the Notepad into your next reply.
• RKreport.txt could also be found on your desktop.
• If more than one log is produced post all logs.

Please download Malwarebytes to your desktop.

• Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
• Then click Finish.
• Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
• If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
• When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
• Restart your computer when prompted to do so.
• The Scan log is available throughout History ->Application logs. Please post it contents in your next reply.

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator
• The tool will start to update the database if one is required.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Logfile button.
• A window will open which lists the logs of your scans.
• Click on the Scan tab.
• Double-click the most recent scan which will be at the top of the list....the log will appear.
• Review the results...see note below
• After reviewing the log, click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[CX].txt) will open automatically (where the largest value of X represents the most recent report).
• To open a Cleaning log, launch AdwareClearer, click on the Logfile button, click on the Cleaning tab and double-click the log at the top of the list.
• Copy and paste the contents of AdwCleaner[CX].txt in your next reply.
• A copy of all logfiles are saved to C:\AdwCleaner.

-- Note: The contents of the AdwCleaner log file may be confusing. Unless you see a program name or entry that you recognize and know should not be removed, don't worry about it. If you see an entry you want to keep, return to AdwCleaner before cleaning...all detected items will be listed (and checked) in each tab. Click on and uncheck any items you want to keep.

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

 

[mdp3157]

RogueKiller V12.9.7.0 (x64) [Feb 6 2017] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 10 (10.0.14393) 64 bits version
Started in : Normal mode
User : Michael [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Delete -- Date : 02/19/2017 13:19:43 (Duration : 00:55:18)

¤¤¤ Processes : 1 ¤¤¤
[Proc.Injected] NPDFLM.exe(11036) -- C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe[7] -> Killed [TermProc]

¤¤¤ Registry : 19 ¤¤¤
[PUP.Gen1] (X64) HKEY_LOCAL_MACHINE\Software\Hola -> Not selected
[PUP.Conduit|PUP.Gen1] (X86) HKEY_LOCAL_MACHINE\Software\Conduit -> Not selected
[PUP.Gen1] (X86) HKEY_LOCAL_MACHINE\Software\ZoomWebLists -> Not selected
[PUP.Gen1] (X64) HKEY_USERS\.DEFAULT\Software\Hola -> Not selected
[PUP.Gen1] (X86) HKEY_USERS\.DEFAULT\Software\Hola -> Not selected
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-319729760-2674817846-3730761306-1000\Software\csastats -> Not selected
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-319729760-2674817846-3730761306-1000\Software\go_palikan -> Not selected
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-319729760-2674817846-3730761306-1000\Software\ProductSetup -> Not selected
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-319729760-2674817846-3730761306-1000\Software\csastats -> Not selected
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-319729760-2674817846-3730761306-1000\Software\go_palikan -> Not selected
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-319729760-2674817846-3730761306-1000\Software\ProductSetup -> Not selected
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-18\Software\Hola -> Not selected
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-18\Software\Hola -> Not selected
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-4a1eac3c -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 212.159.13.49 212.159.13.50 ([-][United Kingdom]) -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{1fdc0269-e74d-4758-9420-27dce9e649fb} | DhcpNameServer : 10.12.0.1 ([]) -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{edd1e0ee-9a3f-4f14-809c-e3205930f732} | DhcpNameServer : 212.159.13.49 212.159.13.50 ([-][United Kingdom]) -> Not selected
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-319729760-2674817846-3730761306-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Not selected
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-319729760-2674817846-3730761306-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Not selected

¤¤¤ Tasks : 2 ¤¤¤
[PUP.Gen0|Suspicious.Path] %WINDIR%\Tasks\Go_Palikan.job -- C:\Users\Michael\AppData\Local\{7C344~1\UNINST~1.EXE (/Check) -> Not selected
[Suspicious.Path] \Go_Palikan -- C:\Users\Michael\AppData\Local\{7C344~1\UNINST~1.EXE (/Check) -> Not selected

¤¤¤ Files : 7 ¤¤¤
[PUP.Gen1][Folder] C:\ProgramData\AVG Security Toolbar -> Deleted
[PUP.Gen1][File] C:\ProgramData\AVG Security Toolbar\TBCampaign2013.txt -> Deleted
[PUP.Gen1][File] C:\ProgramData\AVG Security Toolbar\TBCampaignINSP.txt -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Easeware -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\client-stats.log -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\drivers\5cn4htea.g0v -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\drivers\anjki1qt.l1f -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\drivers\DownloadDrivers.data -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\drivers\h13efwae.mw1 -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\drivers\h312lru5.4vh -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\drivers\knmmtidx.pb3 -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\drivers\r4hoj0wh.hu4 -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\drivers\tmbbh1jl.wqw -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\drivers\xkmotbop.vgg -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\drivers -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy\settings.dat -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Easeware\DriverEasy -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Roaming\Hola -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\7za.exe -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\flash\flashplayer.xpt -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\flash\NPSWF32_18_0_0_232.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\flash\plugin.vch -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\flash -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\AUTHORS.txt -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\COPYING.txt -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\libvlc.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\libvlc.dll.manifest -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\libvlccore.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\NEWS.txt -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\npvlc.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\npvlc.dll.manifest -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\access\libfilesystem_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\access\libhttp_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\access -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_filter\liba52tospdif_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_filter\libaudio_format_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_filter\libdolby_surround_decoder_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_filter\libdtstospdif_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_filter\libscaletempo_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_filter\libsimple_channel_mixer_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_filter\libugly_resampler_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_filter -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_output\libdirectsound_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_output\libwaveout_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\audio_output -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\liba52_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libadpcm_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libaes3_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libaraw_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libavcodec_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libcc_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libcdg_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libcrystalhd_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libcvdsub_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libdmo_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libdts_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libdvbsub_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libdxva2_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libfaad_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libg711_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libjpeg_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\liblibass_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\liblibmpeg2_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\liblpcm_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libmft_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libmpeg_audio_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libpng_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libqsv_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libscte27_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libspudec_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libstl_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libsubsdec_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libsubstx3g_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libsubsusf_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libsvcdsub_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libuleaddvaudio_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libvorbis_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec\libvpx_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\codec -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\control\libhotkeys_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\control -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libaiff_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libasf_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libau_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libavi_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libcaf_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libdemuxdump_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libdemux_cdg_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libdemux_stl_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libdiracsys_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libes_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libflacsys_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libh264_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libhevc_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libimage_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libmjpeg_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libmkv_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libmp4_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libmpgv_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libnsc_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libnsv_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libnuv_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libogg_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libplaylist_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libps_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libpva_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\librawaud_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\librawdv_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\librawvid_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libsmf_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libsubtitle_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libts_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libtta_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libty_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libvc1_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libvobsub_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libvoc_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libwav_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux\libxa_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\demux -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\gui\libqt4_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\gui\libskins2_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\gui -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\meta_engine\libfolder_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\meta_engine -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\misc\liblogger_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\misc\libxml_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\misc -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\stream_filter\libdash_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\stream_filter\librecord_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\stream_filter\libsmooth_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\stream_filter -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\text_renderer\libfreetype_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\text_renderer -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_chroma\libswscale_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_chroma -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_filter\libscale_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_filter\libyuvp_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_filter -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_output\libdirect2d_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_output\libdirect3d_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_output\libdirectdraw_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_output\libdrawable_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_output\libgl_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_output\libvmem_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_output -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_splitter\libclone_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_splitter\libpanoramix_plugin.dll -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_splitter\libwall_plugin.dll -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins\video_splitter -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\plugins -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\README.txt -> Deleted
[PUP.Gen1][File] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc\THANKS.txt -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app\vlc -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola\app -> Deleted
[PUP.Gen1][Folder] C:\Users\Michael\AppData\Local\Hola\firefox_hola -> Deleted
[PUP.Gen1][Folder] C:\ProgramData\AVG Security Toolbar -> ERROR [3]
[PUP.Gen1][Folder] C:\Program Files\Hola -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\app\7za.exe -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\app\hola_setup.exe -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\app\image\Hola-Setup-x64-1.12.239.1.exe -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\app\image\Hola-Setup-x64-1.12.239.exe -> Deleted
[PUP.Gen1][Folder] C:\Program Files\Hola\app\image -> Deleted
[PUP.Gen1][Folder] C:\Program Files\Hola\app -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\db\cache.db-shm -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\db\cache.db-wal -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\db\chunks.db-shm -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\db\chunks.db-wal -> Deleted
[PUP.Gen1][Folder] C:\Program Files\Hola\db -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\hola_svc.exe.cid -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\hola_updater.exe.cid -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\20160316_160034_bsod_minidump.log -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\20160316_160034_bsod_minidump.sent -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\20160317_010345_perr_svc_bio_timeout_fail_tcp_info.log -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\20160317_010345_perr_svc_bio_timeout_fail_tcp_info.sent -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\20160318_021040_perr_svc_bio_timeout_fail_tcp_info.log -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\20160318_021040_perr_svc_bio_timeout_fail_tcp_info.sent -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\20160318_080758_perr_svc_bio_timeout_fail_tcp_info.log -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\20160318_080758_perr_svc_bio_timeout_fail_tcp_info.sent -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\20160319_174806_uninstall.log -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\20160319_174806_uninstall.sent -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\install.log -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\svc.log -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\ui.log -> Deleted
[PUP.Gen1][File] C:\Program Files\Hola\log\updater.log -> Deleted
[PUP.Gen1][Folder] C:\Program Files\Hola\log -> Deleted
[PUP.Gen1][Folder] C:\Program Files\Hola\temp -> Deleted
[PUP.Gen3][File] C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\searchplugins\palikan.xml -> Deleted

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 6 ¤¤¤
[PUP.Gen2][Firefox:Addon] sv5layt6.default : Magnify It [magit@magit.com] -> Not selected
[PUP.Gen2][Firefox:Addon] sv5layt6.default : AVG Web TuneUp [avg@toolbar] -> Not selected
[PUP.Gen2][Firefox:Addon] sv5layt6.default : Mozilla Firefox Hotfixer [veggy@veggyAddon.com] -> Not selected
[PUM.HomePage][Firefox:Config] sv5layt6.default : user_pref("browser.startup.homepage", "http://www.msn.com/?pc=SL5M&ocid=SL5MDHP&osmkt=en-gb|https://mysearch.avg.com/?cid={68297D4F-034B-48F6-9579-E63D87E3C2CE}&mid=6625006e4f5247cdbd6f1d1be9452ab7-b7ce1049860ea2f7df76c5f3174f9680bc0b5cfb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0915avt&pr=fr&d=2015-09-28 10:10:46&v=4.1.6.294&pid=wtu&sg=&sap=hp"); -> Not selected
[PUM.HomePage][Chrome:Config] Default [SecurePrefs] : session.startup_urls [http://www.google.co.uk/|http://www.bbc.co.uk/news] -> Not selected
[PUM.SearchPage][Chrome:Config] Default [SecurePrefs] : default_search_provider_data.template_url_data.keyword [google.co.uk] -> Not selected

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK3261GSYN +++++
--- User ---
[MBR] 18f2fb33c03e1c02d3ff7d0de31d5819
[BSP] 8d368e2ae217a26c209594e2029e9a09 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 287740 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 589498368 | Size: 15360 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 620955648 | Size: 2043 MB
User = LL1 ... OK
User = LL2 ... OK

 

[mdp3157]

Malwarebytes part 1
www.malwarebytes.com

-Log Details-
Scan Date: 2/19/17
Scan Time: 4:39 PM
Logfile: Malwarebytes report.txt
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.50
Update Package Version: 1.0.1300
License: Trial

-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: MICHAEL-PC\Michael

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 492448
Time Elapsed: 17 min, 40 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 20
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}, Quarantined, [71], [160141],1.0.1300
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}, Quarantined, [71], [160141],1.0.1300
PUP.Optional.Yontoo, HKLM\SOFTWARE\POLICIES\GOOGLE\CHROME, Quarantined, [71], [-1],0.0.0
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\CHROME, Quarantined, [71], [-1],0.0.0
PUP.Optional.VisicomToolbar, HKLM\SOFTWARE\CLASSES\CLSID\{ABA8D0E6-0D4D-4CB8-836A-04D69824B108}, Quarantined, [1826], [346393],1.0.1300
PUP.Optional.VisicomToolbar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{ABA8D0E6-0D4D-4CB8-836A-04D69824B108}, Quarantined, [1826], [346393],1.0.1300
PUP.Optional.VisicomToolbar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{ABA8D0E6-0D4D-4CB8-836A-04D69824B108}, Quarantined, [1826], [346393],1.0.1300
PUP.Optional.VisicomToolbar, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{ABA8D0E6-0D4D-4CB8-836A-04D69824B108}, Quarantined, [1826], [346393],1.0.1300
PUP.Optional.VisicomToolbar, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{ABA8D0E6-0D4D-4CB8-836A-04D69824B108}, Quarantined, [1826], [346393],1.0.1300
PUP.Optional.VisicomToolbar, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{ABA8D0E6-0D4D-4CB8-836A-04D69824B108}, Quarantined, [1826], [346393],1.0.1300
PUP.Optional.Zoom, HKLM\SOFTWARE\WOW6432NODE\ZoomWebLists, Quarantined, [14881], [245227],1.0.1300
PUP.Optional.AuslogicsBoostSpeed, HKLM\SOFTWARE\WOW6432NODE\AUSLOGICS\BoostSpeed, Quarantined, [2029], [341837],1.0.1300
PUP.Optional.ProductSetup, HKU\S-1-5-21-319729760-2674817846-3730761306-1000\SOFTWARE\PRODUCTSETUP, Quarantined, [17368], [242047],1.0.1300
PUP.Optional.Palikan, HKU\S-1-5-21-319729760-2674817846-3730761306-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [2042], [241491],1.0.1300
PUP.Optional.Palikan, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [2042], [241491],1.0.1300
PUP.Optional.Palikan, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, Quarantined, [2042], [241491],1.0.1300
PUP.Optional.Palikan, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Go_Palikan, Quarantined, [2042], [241492],1.0.1300
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{53B4CA52-3768-4406-B603-BC620DFAAFA7}, Quarantined, [117], [258124],1.0.1300
PUP.Optional.InstallCore, HKU\S-1-5-21-319729760-2674817846-3730761306-1000\SOFTWARE\csastats, Quarantined, [8], [260986],1.0.1300
PUP.Optional.Palikan, HKU\S-1-5-21-319729760-2674817846-3730761306-1000\SOFTWARE\go_palikan, Quarantined, [2042], [241487],1.0.1300

Registry Value: 10
PUP.Optional.ProductSetup, HKU\S-1-5-21-319729760-2674817846-3730761306-1000\SOFTWARE\PRODUCTSETUP|TB, Quarantined, [17368], [242047],1.0.1300
PUP.Optional.Palikan, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, Quarantined, [2042], [241491],1.0.1300
PUP.Optional.Palikan, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|TOPRESULTURLFALLBACK, Quarantined, [2042], [241491],1.0.1300
PUP.Optional.Palikan, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|FAVICONPATH, Quarantined, [2042], [241491],1.0.1300
PUP.Optional.Palikan, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|DISPLAYNAME, Quarantined, [2042], [241491],1.0.1300
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{53B4CA52-3768-4406-B603-BC620DFAAFA7}|PATH, Quarantined, [117], [258124],1.0.1300
PUP.Optional.Palikan, HKU\S-1-5-21-319729760-2674817846-3730761306-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, Quarantined, [2042], [241488],1.0.1300
PUP.Optional.Palikan, HKU\S-1-5-21-319729760-2674817846-3730761306-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|TOPRESULTURLFALLBACK, Quarantined, [2042], [241488],1.0.1300
PUP.Optional.Palikan, HKU\S-1-5-21-319729760-2674817846-3730761306-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|FAVICONPATH, Quarantined, [2042], [241488],1.0.1300
PUP.Optional.Palikan, HKU\S-1-5-21-319729760-2674817846-3730761306-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|DISPLAYNAME, Quarantined, [2042], [241488],1.0.1300

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 122
PUP.Optional.AuslogicsBoostSpeed, C:\ProgramData\Auslogics\BoostSpeed\8.x\IgnoredLists, Quarantined, [2029], [341833],1.0.1300
PUP.Optional.AuslogicsBoostSpeed, C:\ProgramData\Auslogics\BoostSpeed\8.x\Logs, Quarantined, [2029], [341833],1.0.1300
PUP.Optional.AuslogicsBoostSpeed, C:\ProgramData\Auslogics\BoostSpeed\8.x, Quarantined, [2029], [341833],1.0.1300
PUP.Optional.AuslogicsBoostSpeed, C:\PROGRAMDATA\Auslogics\BoostSpeed, Quarantined, [2029], [341833],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\content, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\skin, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\modules, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\USERS\MICHAEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SV5LAYT6.DEFAULT\EXTENSIONS\MAGIT@MAGIT.COM, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.VeggyAddon, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com\chrome\content, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.VeggyAddon, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com\chrome\skin, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.VeggyAddon, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com\modules, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.VeggyAddon, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com\chrome, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.VeggyAddon, C:\USERS\MICHAEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SV5LAYT6.DEFAULT\EXTENSIONS\VEGGY@VEGGYADDON.COM, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\abstractbutton\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedscript\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\thirdparty\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\uninstall\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedhtml\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\weather\css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\topapps\css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\weather\js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\weather\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\topapps\js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\generic\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\radio\css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\foreground, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedscript\html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\alert\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\flare\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\radio\js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\moviereviews\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\topapps, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\link\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\weather, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\abstractbutton, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedhtml\html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedscript\js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\common, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\rss\js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\rss\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\radio, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\test, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedhtml\js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedscript, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\flare\icons, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\images, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\rss, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\radio\radioWrapper, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\search\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\thirdparty, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\moviereviews\html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedhtml, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\radio\foreground, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\uninstall, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\radio\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\moviereviews\css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\moviereviews\js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\generic, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\weather, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\api\background, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab\html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\alert, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\flare, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\moviereviews, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab\css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\search\html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\link, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab\js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\rss, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\api\window, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\radio\css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\search, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\radio, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\adapter, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\api, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\native\libs, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\_metadata, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\native, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\icons, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\USERS\MICHAEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\DDDPDJIDPIDDNLDFPABCELINHOKNAPHC, Quarantined, [341], [180912],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\content\widgets\net.vmn.www.FacebookShortcut, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\content\widgets\net.vmn.www.TwitterShortcut, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\content\widgets\net.vmn.www.AmazonShortcut, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\content\widgets\net.vmn.www.ebayshortcut, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\content\widgets, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\background_scripts, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content\panel\CVS, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\skin\ico, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content_scripts, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\content, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content\panel, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\options, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\skin, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\dropmenu, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\ico, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\options, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\about, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\util, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\USERS\TEMP.MICHAEL-PC.000\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\HDPKPBHAPGFJAHBAJEJAHJJCGHICLEGG, Quarantined, [1826], [346379],1.0.1300

 

[mdp3157]

Mailwarebytes part 2


File: 382
PUP.Optional.AuslogicsBoostSpeed, C:\ProgramData\Auslogics\BoostSpeed\8.x\IgnoredLists\TRE_User.igl, Quarantined, [2029], [341833],1.0.1300
PUP.Optional.AuslogicsBoostSpeed, C:\ProgramData\Auslogics\BoostSpeed\8.x\Logs\BoostSpeedLogic.log, Quarantined, [2029], [341833],1.0.1300
PUP.Optional.AuslogicsBoostSpeed, C:\ProgramData\Auslogics\BoostSpeed\8.x\Logs\CheckSerialNumber.log, Quarantined, [2029], [341833],1.0.1300
PUP.Optional.AuslogicsBoostSpeed, C:\ProgramData\Auslogics\BoostSpeed\8.x\Logs\InternetOptimizerStatistics.log, Quarantined, [2029], [341833],1.0.1300
PUP.Optional.AuslogicsBoostSpeed, C:\ProgramData\Auslogics\BoostSpeed\8.x\Logs\TweakManagerStatistics.log, Quarantined, [2029], [341833],1.0.1300
PUP.Optional.AuslogicsBoostSpeed, C:\ProgramData\Auslogics\BoostSpeed\8.x\StatDB.json, Quarantined, [2029], [341833],1.0.1300
PUP.Optional.Yontoo, C:\PROGRAMDATA\NTUSER.POL, Removal Failed, [71], [-1],0.0.0
PUP.Optional.Yontoo, C:\WINDOWS\SYSTEM32\GROUPPOLICY\MACHINE\REGISTRY.POL, Quarantined, [71], [-1],0.0.0
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\content\html5slider.js, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\content\jquery-1.8.3.min.js, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\content\main.js, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\content\main.xul, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\content\options.html, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\content\options.js, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\content\tr.js, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\content\utilContent.js, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\content\vgValidatorLoc.js, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\skin\button.png, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\skin\icon32x32-disabled.png, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\skin\icon32x32.png, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\skin\options.css, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\skin\options_bg.png, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\skin\otaznik.png, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome\skin\slider.png, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\modules\AddonInfo.js, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\modules\PrefMan.js, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\chrome.manifest, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.MagnifyIt, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com\install.rdf, Quarantined, [14430], [178073],1.0.1300
PUP.Optional.VeggyAddon, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com\chrome\content\main.js, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.VeggyAddon, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com\chrome\content\main.xul, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.VeggyAddon, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com\chrome\content\vgValidator.js, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.VeggyAddon, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com\chrome\skin\icon.png, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.VeggyAddon, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com\modules\XCipher.js, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.VeggyAddon, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com\chrome.manifest, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.VeggyAddon, C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com\install.rdf, Quarantined, [14801], [180250],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\adapter\adapterUtil.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\adapter\widget-adapter.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\abstractbutton\background\abstractButton.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\alert\background\alertButton.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedhtml\background\embedHtmlWidget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedhtml\html\embedHtmlTemplate.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedhtml\html\innerEmbedHtmlTemplate.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedhtml\js\embedHtmlUI.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedscript\background\embedScriptWidget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedscript\html\embedScriptTemplate.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedscript\html\innerEmbedScriptTemplate.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\embedscript\js\embedScriptUI.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\flare\background\FlareWidget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\flare\icons\Icon_Flare_blue.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\flare\icons\Icon_Flare_pink.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\flare\icons\Thumbs.db, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\generic\background\GenericWidget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\link\background\linkButton.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\background\menuButton.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\css\menuframe.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\html\menuframe.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\images\right_arrow.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\images\right_arrow_white.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\js\jquery-1.7.1.min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\js\menuframe.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\js\query-string.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\js\underscore-1.3.1.min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\menu\README.txt, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\rss\background\RssWidget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\thirdparty\background\thirdPartyWidget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\uninstall\background\uninstallButton.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\components\weather\background\weatherButton.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\bs.30.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\common.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\dynamic.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\enableDetect.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\eventListening.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\global.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\jquery-1.7.1.min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\list-interaction.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\messageEventListener.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\navRedirector.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\paramReplacer.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\PartnerId.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\set.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\underscore-1.3.1.min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\underscore-1.5.2.min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\js\unifiedLogging.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\common\common.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\common\eventListening.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\common\jquery-1.7.1.min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\common\list-interaction.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\common\set.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\common\underscore-1.3.1.min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\radio\css\radio-widget.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\radio\js\radio-custom.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\radio\js\radio-parser.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\radio\js\radio-widget-ui.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\radio\js\radio-widget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\radio\radio-widget.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\rss\js\rss-widget-custom.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\rss\js\rss-widget-parse.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\rss\js\rss-widget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\rss\rssWidget.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\test\invalid.json, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\test\jquery.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\test\qunit.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\test\qunit.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\test\resource.json, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\test\resource.xml, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\test\testWidget.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\test\testWidget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\topapps\css\widget.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\topapps\js\nanigans-topapps-feed.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\topapps\js\topapps-config.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\topapps\js\widget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\topapps\widget.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\weather\css\weatherButton.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\weather\js\weather.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widgets\weather\weatherButton.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\common\widget-api\widget-context-1.0.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\api\background\ApiBasedWidget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\api\background\widget-api-impl.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\api\window\hiddenWidgetWindow.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\api\window\hiddenWidgetWindow.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\api\window\hiddenWidgetWindowInit.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\api\window\widgetWindow.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\api\window\widgetWindow.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\background\updateSearch.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\background\updateSearchPromptBg.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\foreground\07_buttons2.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\foreground\08_buttons2.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\foreground\defaultSearchModal.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\foreground\defaultSearchModalInjector.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\foreground\defaultSearchModalInjector.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\foreground\tvf_btn_ok.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\foreground\tvf_btn_ok2.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\foreground\tvf_restart_alert_icon.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\foreground\tvf_restart_icon.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\defaultSearch\foreground\updateSearchPromptFg.js, Quarantined, [341], [180912],1.0.1300

 

[mdp3157]

Mailwarebytes part 3

PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\moviereviews\background\MovieReviewsWidget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\moviereviews\css\movieReviews.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\moviereviews\html\movieReviews.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\moviereviews\js\movieReviews.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\radio\background\RadioWidget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\radio\css\toolbar-item.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\radio\foreground\button.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\radio\radioWrapper\radioWrapper.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\radio\radioWrapper\radioWrapper.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\search\background\searchBox.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\search\html\searchSuggestions.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\search\html\searchSuggestions.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\search\html\searchSuggestions.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\search\html\searchSuggestionsInit.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab\css\supertab.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab\html\supertab.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab\js\newtabfork.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab\js\reporting.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab\js\srchsugg.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab\js\supertab.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab\js\unifiedLogging.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\components\supertab\js\__utm.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\icons\arrowSprite.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\icons\icon128.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\icons\icon16.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\icons\icon19disabled.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\icons\icon19on.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\icons\icon48.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\icons\tb_icon_search_disappearing_ask.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647843.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647856.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647857.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647858.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647865.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647869.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647870.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647871.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647872.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647873.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647934.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\225647951.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\down_arrow.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\IDR_PRODUCT_LOGO_16.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\IDR_WEBSTORE_ICON.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\magnifying_glass.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\RadioPlayerSprite.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\search_button.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\tvf_icon_guide.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\tvf_logo.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\images\wrench.png, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\newTabInitialize.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\chromeStorage.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\chromeUtils.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\companionSWUtils.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\exeManager.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\exeManagerNMD.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\exePackageManager.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\focusManager.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\globalBlacklistManager.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\messaging.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\mutation_summary-min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\mutation_summary.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\nativeMessagingDispatcher.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\newTabInfo.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\options.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\readLocalStorage.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\reservespacefortoolbar.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\reservespaceifenabled.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\scriptInjector.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\searchContext.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\settingsOverrides.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\toolbarCookieParser.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\toolbarPreinit.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\underscore-1.3.1.min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\URILoaderContentScript.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\webTooltabAPI.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\Widget.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\widgetContentScriptInjectee.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\widgetFactory.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\js\widgetWindowManager.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\native\libs\jquery-1.7.1.min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\native\libs\jquery-1.9.1.min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\native\libs\underscore-1.5.2.min.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\native\cache.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\native\ce.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\native\debug.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\native\ss.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\activePing.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\buttonLogger.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\competitorDnsList.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\console.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\FFPreferencesPersister.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\httpTransport.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\HttpURL.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\internationalSearch.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\LocalStoragePersister.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\MindsparkGlobal.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\MindsparkGlobal.unitTest.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\MindsparkGlobalNotes.txt, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\rsvp-latest.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\searchSuggestLocale.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\testHttpTransport.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\unifiedLogger.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\unifiedLogging.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\universalConsole.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\shared\utils.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\_metadata\verified_contents.json, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\spent.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\bg.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\buildVars, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\buildVars.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\companionSW.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\config.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\contentScript.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\contentScript.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\debug.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\debug.jade, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\extension_toolbar_api.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\initWidgetWindow.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\manifest.json, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\newTabContentScript.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\options.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\spent.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\spent.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\spent2.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\spent2.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\spentJ.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\spentK.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\spentK.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\startup.js, Quarantined, [341], [180912],1.0.1300

 

[mdp3157]

Mailwarebytes part 4

al\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\stub.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\stubby.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\superFrame.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\toolbar.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\toolbar.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\toolbarUI.css, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\toolbarUI.html, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\toolbarUI.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\url.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.MindSpark, C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dddpdjidpiddnldfpabcelinhoknaphc\12.202.10.29671_0\webtooltab.cs.js, Quarantined, [341], [180912],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\about\about.css, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\about\about.html, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\about\about.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\about\about.js.bak, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\background_scripts\background.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\background_scripts\stats.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\content\widgets\net.vmn.www.AmazonShortcut\tb_icon.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\content\widgets\net.vmn.www.ebayshortcut\tb_icon.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\content\widgets\net.vmn.www.FacebookShortcut\tb_icon.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\content\widgets\net.vmn.www.TwitterShortcut\tb_icon.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\skin\ico\ico-amazon.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\skin\ico\ico-ebay.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\skin\ico\ico-facebook.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\skin\ico\twitter.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\skin\BT-Cloud-icon_22_toolbar.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\chrome\skin\ico-mail.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content\panel\CVS\Entries, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content\panel\CVS\Entries.Extra, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content\panel\CVS\Entries.Extra.Old, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content\panel\CVS\Entries.Old, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content\panel\CVS\Repository, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content\panel\CVS\Root, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content\panel\CVS\Template, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content\panel\chromepanel.html, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content_scripts\content.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content_scripts\events.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content_scripts\injector.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content_scripts\namespace.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content_scripts\namespace_full.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\content_scripts\stats.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\dropmenu\dropmenu.css, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\dropmenu\dropmenu.html, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\dropmenu\dropmenu.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\options\options.css, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\options\options.html, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\options\options.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\ico\ico-amazon.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\ico\ico-ebay.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\ico\ico-facebook.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\ico\twitter.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\options\options-main.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\options\options-search.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\options\options-weather.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\options\options-widgets.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\add.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\bg-aboutbox.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\bluelite.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\bluesky.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\BT-Cloud-icon_22_toolbar.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\bt-drop-contact-over.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\bt-drop-contact.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\bt-drop-hdr.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\bt-drop-help-over.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\bt-drop-help.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\bt-drop-settings-over.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\bt-drop-settings.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\BTmark16.ico, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\BTmark24.ico, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\Btmark32.ico, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\BTmark48.ico, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\BTmark64.ico, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\btn-search-over.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\btn-search.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\chevron.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\dtx.css, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\dtxlogo.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\gcHeader.bmp, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\grey.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\ico-mail.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\icon32.ico, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\install.ico, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\install48.ico, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\lichen.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\logo-about.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\logo-over.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\logo.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\orange.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\searchbox-watermark.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\settings-header.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\settings.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\settings_menu.json, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\skin-bluelite.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\skin-bluesky.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\skin-grey.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\skin-lichen.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\skin-orange.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\skin-yellow.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\toolbarsplitter.gif, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\toolbarsplitter.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\websearch.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\skin\yellow.png, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\util\util.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\install.ico, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\manifest.json, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\test.js, Quarantined, [1826], [346379],1.0.1300
PUP.Optional.VisicomToolbar, C:\Users\TEMP.MICHAEL-PC.000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdpkpbhapgfjahbajejahjjcghiclegg\1.0.0.36_0\toolbar.json, Quarantined, [1826], [346379],1.0.1300
PUM.Optional.FireFoxSearchOverride, C:\USERS\MICHAEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SV5LAYT6.DEFAULT\USER.JS, Quarantined, [19887], [302334],1.0.1300
PUP.Optional.InstallCore, C:\USERS\MICHAEL\DOWNLOADS\PICASA.EXE, Quarantined, [8], [78708],1.0.1300
PUP.Optional.Palikan, C:\WINDOWS\SYSTEM32\TASKS\Go_Palikan, Quarantined, [2042], [241485],1.0.1300
PUP.Optional.Pakilan, C:\USERS\MICHAEL\APPDATA\LOCAL\CHROMIUM\USER DATA\DEFAULT\LOCAL STORAGE\http_www.palikan.com_0.localstorage, Quarantined, [15260], [246368],1.0.1300
PUP.Optional.Pakilan, C:\USERS\MICHAEL\APPDATA\LOCAL\CHROMIUM\USER DATA\DEFAULT\LOCAL STORAGE\http_www.palikan.com_0.localstorage-journal, Quarantined, [15260], [246368],1.0.1300
PUP.Optional.Pakilan, C:\USERS\MICHAEL\APPDATA\LOCALLOW\MICROSOFT\INTERNET EXPLORER\SERVICES\GO_PALIKAN.ICO, Quarantined, [15260], [246369],1.0.1300
PUP.Optional.MindSpark, C:\USERS\MICHAEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\chrome-extension_dddpdjidpiddnldfpabcelinhoknaphc_0.localstorage, Quarantined, [341], [246936],1.0.1300
PUP.Optional.MindSpark, C:\USERS\MICHAEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\chrome-extension_dddpdjidpiddnldfpabcelinhoknaphc_0.localstorage-journal, Quarantined, [341], [246936],1.0.1300
PUP.Optional.SearchManager.ChrPRST, C:\USERS\MICHAEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\chrome-extension_bahkljhhdeciiaodlkppoonappfnheoi_0.localstorage, Quarantined, [15060], [260105],1.0.1300
PUP.Optional.Palikan, C:\WINDOWS\TASKS\Go_Palikan.job, Quarantined, [2042], [241486],1.0.1300
PUP.Optional.Palikan, C:\USERS\MICHAEL\APPDATA\LOCAL\CHROMIUM\USER DATA\DEFAULT\SECURE PREFERENCES, Replaced, [2042], [303034],1.0.1300

Physical Sector: 0
(No malicious items detected)


(end)

 

[mdp3157]

Adw cleaner (CO)txt

# AdwCleaner v6.043 - Logfile created 19/02/2017 at 17:18:54
# Updated on 27/01/2017 by Malwarebytes
# Database : 2017-02-13.1 [Server]
# Operating System : Windows 10 Pro (X64)
# Username : Michael - MICHAEL-PC
# Running from : C:\Users\Michael\Desktop\AdwCleaner.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support



***** [ Services ] *****



***** [ Folders ] *****

[-] Folder deleted: C:\ProgramData\Auslogics
[#] Folder deleted on reboot: C:\ProgramData\Application Data\Auslogics
[-] Folder deleted: C:\Users\Public\Documents\Guid


***** [ Files ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Shortcuts ] *****



***** [ Scheduled Tasks ] *****

[-] Task deleted: IHUninstallTrackingTASK


***** [ Registry ] *****

[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\TheDesktopWeatherService
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\WtuSystemSupport
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key deleted: HKU\.DEFAULT\Software\Hola
[#] Key deleted on reboot: HKU\S-1-5-18\Software\Hola
[-] Key deleted: HKLM\SOFTWARE\Conduit
[-] Key deleted: HKLM\SOFTWARE\Auslogics
[-] Key deleted: [x64] HKLM\SOFTWARE\Hola
[-] Key deleted: HKU\S-1-5-21-319729760-2674817846-3730761306-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Value deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 [vProt]
[-] Key deleted: HKCU\Software\MozillaPlugins\@hola.org/FlashPlayer
[-] Key deleted: HKCU\Software\MozillaPlugins\@hola.org/vlc
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\hola.org


***** [ Web browsers ] *****

[-] [C:\Users\Michael\AppData\Local\Chromium\User Data\Default\Web data] [Search Provider] Deleted: palikan
[-] [C:\Users\Michael\AppData\Local\Chromium\User Data\Default] [homepage] Deleted: hxxp://www.palikan.com/?f=1&a=plk_ggbg_15_37&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0F0AtC0CtAyEyEzytDyEyDtN0D0Tzu0StCtAyDtDtN1L2XzutAtFtCtBtFyDtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2S0BtA0FtCtC0EtCtBtGyBzztA0AtGyEyByByDtGzyzy0F0CtGtC0FyByB0F0B0CtAzzzy0DtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StC0FtB0BtByD0BzytGtDyE0B0CtGyE0CtB0BtGzy0EtDtDtGyCzy0FtB0F0CtByE0D0DzzyD2QtN0A0LzuyE&cr=896150126&ir=&uref=chmm


*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [2933 Bytes] - [19/02/2017 17:18:54]
C:\AdwCleaner\AdwCleaner[S0].txt - [2811 Bytes] - [19/02/2017 17:16:35]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [3079 Bytes] ##########

 

[mdp3157]

Adw ckeaber (SO) .txt

# AdwCleaner v6.043 - Logfile created 19/02/2017 at 17:16:35
# Updated on 27/01/2017 by Malwarebytes
# Database : 2017-02-13.1 [Server]
# Operating System : Windows 10 Pro (X64)
# Username : Michael - MICHAEL-PC
# Running from : C:\Users\Michael\Desktop\AdwCleaner.exe
# Mode: Scan
# Support : https://www.malwarebytes.com/support



***** [ Services ] *****

No malicious services found.


***** [ Folders ] *****

Folder Found: C:\ProgramData\Auslogics
Folder Found: C:\ProgramData\Application Data\Auslogics
Folder Found: C:\Users\Public\Documents\Guid


***** [ Files ] *****

No malicious files found.


***** [ DLL ] *****

No malicious DLLs found.


***** [ WMI ] *****

No malicious keys found.


***** [ Shortcuts ] *****

No infected shortcut found.


***** [ Scheduled Tasks ] *****

Task Found: IHUninstallTrackingTASK


***** [ Registry ] *****

Key Found: [x64] HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\TheDesktopWeatherService
Key Found: [x64] HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\WtuSystemSupport
Key Found: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
Key Found: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
Key Found: HKU\.DEFAULT\Software\Hola
Key Found: HKU\S-1-5-18\Software\Hola
Key Found: HKLM\SOFTWARE\Conduit
Key Found: HKLM\SOFTWARE\Auslogics
Key Found: [x64] HKLM\SOFTWARE\Hola
Key Found: HKU\S-1-5-21-319729760-2674817846-3730761306-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Value Found: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 [vProt]
Key Found: HKCU\Software\MozillaPlugins\@hola.org/FlashPlayer
Key Found: HKCU\Software\MozillaPlugins\@hola.org/vlc
Key Found: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\hola.org


***** [ Web browsers ] *****

No malicious Firefox based browser items found.
Chrome pref Found: [C:\Users\Michael\AppData\Local\Chromium\User Data\Default\Web data] - palikan
Chrome pref Found: [C:\Users\Michael\AppData\Local\Chromium\User Data\Default\Secure Preferences ] - hxxp://www.palikan.com/?f=1&a=plk_ggbg_15_37&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0F0AtC0CtAyEyEzytDyEyDtN0D0Tzu0StCtAyDtDtN1L2

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [2639 Bytes] - [19/02/2017 17:16:35]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2712 Bytes] ##########

 

[mdp3157]

I have now run all the software you suggest and have uploaded the reports

 

[Broni]

Yes, but you posted AdwCleaner log twice.
I still need JRT log.

Then...

Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

• Double click to run it.
• Make sure you checkmark Addition.txt box.
• Press Scan button.
• Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.

 

[mdp3157]

JRT Log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.0 (12.05.2016)
Operating System: Windows 10 Pro x64
Ran by Michael (Administrator) on 19/02/2017 at 17:30:44.43
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 2

Successfully deleted: C:\WINDOWS\system32\Tasks\SpeedFixToolPlus_Popup (Task)
Successfully deleted: C:\WINDOWS\system32\Tasks\SpeedFixToolPlus_Start (Task)

Deleted the following from C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\prefs.js
user_pref(browser.startup.homepage, hxxp://www.msn.com/?pc=SL5M&ocid=SL5MDHP&osmkt=en-gb|hxxps://mysearch.avg.com/?cid={68297D4F-034B-48F6-9579-E63D87E3C2CE}&mid=6625006e4f



Registry: 2

Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D137966-2E29-45C5-9B12-29D5427F8F66} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D137966-2E29-45C5-9B12-29D5427F8F66} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19/02/2017 at 17:36:47.61
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[mdp3157]

2nd Farbar scan

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2017 01
Ran by Michael (19-02-2017 18:45:45)
Running from C:\Users\Michael\Desktop
Windows 10 Pro Version 1607 (X64) (2016-08-31 22:28:27)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-319729760-2674817846-3730761306-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-319729760-2674817846-3730761306-503 - Limited - Disabled)
Guest (S-1-5-21-319729760-2674817846-3730761306-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-319729760-2674817846-3730761306-1002 - Limited - Enabled)
Michael (S-1-5-21-319729760-2674817846-3730761306-1000 - Administrator - Enabled) => C:\Users\Michael

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {86367591-4BE4-AE08-2FD9-7FCB8259CD98}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Kaspersky Internet Security (Enabled - Up to date) {3D579475-6DDE-A186-1569-44B9F9DE8725}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {BE0DF4B4-018B-AF50-0486-D6FE7C8A8AE3}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.023.20056 - Adobe Systems Incorporated)
AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
Apple Application Support (32-bit) (HKLM-x32\...\{9BA1A894-B42F-4805-BC8C-349C905A3930}) (Version: 5.3.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{7EAC8A42-9FAC-4F6B-AABF-C08C9F2E0F13}) (Version: 5.3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.6.0.0 - Canon Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: 1.5.2.3 - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.5.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.10.15 - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.2.0 - Canon Inc.)
Canon MG2900 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2900_series) (Version: 1.01 - Canon Inc.)
Canon MG2900 series On-screen Manual (HKLM-x32\...\Canon MG2900 series On-screen Manual) (Version: 7.7.1 - Canon Inc.)
Canon MG2900 series User Registration (HKLM-x32\...\Canon MG2900 series User Registration) (Version: - ‭Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 3.5.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 3.5.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.3.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.7.0 - Canon Inc.)
CopyTrans Control Center Uninstall Only (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\CopyTrans Suite) (Version: 4.006 - WindSolutions)
ExpressVPN (HKLM-x32\...\{7e9357d8-8bdd-4e72-88ac-1b3acedd2b32}) (Version: 5.0.1.551 - ExpressVPN)
ExpressVPN (x32 Version: 5.0.1.551 - ExpressVPN) Hidden
ExpressVPN Compatibility Checks (x32 Version: 1.0.0.0 - ExpressVPN) Hidden
Fluency Now (HKLM-x32\...\{8A5CD593-FF6A-42FE-ACE5-58709FA1893A}) (Version: 4.0.0 - Western Standard)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.54 - Google Inc.)
Google Earth (HKLM-x32\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
HP Support Solutions Framework (HKLM-x32\...\{F6A11738-3EE4-4573-AEA5-6CD5D491C167}) (Version: 12.0.30.81 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\...\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.5.1 - Hewlett-Packard Company)
iCloud (HKLM\...\{0493048C-CB1A-44B7-8BB3-8467AF7BA9E4}) (Version: 6.1.2.13 - Apple Inc.)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.9 - HTC)
iTunes (HKLM\...\{9D0D2A8B-7E7B-4D88-8D50-24286ED6A5EB}) (Version: 12.5.5.5 - Apple Inc.)
Java 8 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218071F0}) (Version: 8.0.710.15 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{F575F386-57EF-4943-B003-A13F13B05EEB}) (Version: 16.0.1.445 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 16.0.1.445 - Kaspersky Lab) Hidden
Malwarebytes version 3.0.6.1469 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Nuance Power PDF Standard (HKLM\...\{B43651AB-6285-4FEB-95A2-3450D63378A2}) (Version: 1.10.8423 - Nuance Communications, Inc.)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
PhoneRescue (HKLM-x32\...\PhoneRescue) (Version: 3.2.3.0 - iMobie Inc.)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
Printer Pro Desktop (HKLM-x32\...\PrinterProDesktop) (Version: - Readdle)
QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
RogueKiller version 12.9.7.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.9.7.0 - Adlice Software)
Serif DrawPlus Starter Edition (HKLM-x32\...\{33311EA4-0ECA-4E7F-83E5-8A92CD760152}) (Version: 2.0.2.010 - Serif (Europe) Ltd)
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype™ 7.32 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.32.104 - Skype Technologies S.A.)
Speed Fix Tool Plus (HKLM-x32\...\{600A25D8-5738-4AE8-B860-384146900459}) (Version: 3.0.3 - FixBliss)
Spotify (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Spotify) (Version: 1.0.38.171.g5e1cd7b2 - Spotify AB)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)
TAV (HKLM-x32\...\{FBFE84F8-A402-4F7D-B63E-5FBBFE6BA438}) (Version: 1.0.0.0 - Translated)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.62308 - TeamViewer)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WhatsApp (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\WhatsApp) (Version: 0.2.2731 - WhatsApp)
Windows 10 Upgrade Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17354 - Microsoft Corporation)
WYSIWYG Web Builder 11 (HKLM-x32\...\WYSIWYG_Web_Builder_11) (Version: - )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {03662996-3668-4022-BD17-1559481C0385} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {082F24D4-01D3-44B7-9207-955751DEF9D8} - System32\Tasks\{79F42A48-05D2-47CB-ABF5-C8ECA15C0F1F} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {0B4CB9A1-561A-41A5-B38D-A8D911FF4572} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => %SystemRoot%\ehome\ehPrivJob.exe
Task: {183E8F21-4548-4EB6-A615-95145418BCF1} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {24D65353-9C66-45EE-9BEC-CCBBAF61B453} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2016-12-29] (Microsoft Corporation)
Task: {29408F2B-0A23-414C-92B2-E0A80A9146AB} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {2EFBC053-9337-47F6-A61E-4FADFD2AA79A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-12] (Google Inc.)
Task: {354B9E14-8459-431C-A8B7-31087CDB6608} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {42FAD1EE-A0B3-4E00-A35D-8A2887E2316D} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {4963C22B-AB51-4E41-A785-5E6B0275A942} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {55D83733-396E-4B19-9ECF-CFB44BFB25D4} - System32\Tasks\{2508C3DC-9D26-478B-9AE2-67BF150F4CBB} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {59934F08-3300-4A92-AA0F-AA483E18536F} - System32\Tasks\{046B510E-D61B-4C5A-B0C3-5939DF20B152} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {59C5CFFE-60B2-4500-B35A-5DF65F0C3396} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {68B8B570-97FA-45CD-BAA7-7E271FCF0BE5} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => %SystemRoot%\ehome\mcupdate.exe
Task: {6956A104-A21C-410B-87B0-4102ECA07053} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {6D510903-6E39-4F68-A7EC-169B32026447} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {739BEF00-69DB-4E1A-885B-0E61E1187199} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {7506E117-5222-4876-976E-1E3389F868FA} - System32\Tasks\TechUtilities => C:\Program Files\TechUtilities\TechUtilities.exe
Task: {753AF1A7-71BD-4247-AED3-C96EBD3175F0} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => %SystemRoot%\ehome\ehrec.exe
Task: {765E2CEF-EC61-42C5-9488-4653E2D3AE28} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {7A083FFF-8697-4081-AB5C-5313CEDF14B6} - System32\Tasks\{175C893D-83C4-40BE-A4DE-3B7D9EAD1059} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {7D88719A-0728-4F54-B1EC-803EEAD5599B} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => %SystemRoot%\ehome\ehPrivJob.exe
Task: {815FC1A2-D806-44CF-A00A-56F271656A2D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-12] (Google Inc.)
Task: {822D47B8-3EC4-4C5E-A17A-13702D8B543B} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {8820AF1B-A70D-400F-B3BD-34C06F65C1D3} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {89FE76D1-1A6F-4549-8542-0C2E08AD837E} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {8B514EDF-ED61-442F-A6B8-27A86F7BD592} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => %SystemRoot%\ehome\mcupdate.exe
Task: {8D3EDFFE-81E2-4EDA-8B55-C8A3C4DE8455} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {8F8FE07D-AF62-4774-97DA-7C4234AC66C7} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => %SystemRoot%\ehome\ehPrivJob.exe
Task: {A0CFF039-735C-45A0-933A-277FD1CEC375} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Michael\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe
Task: {A5AD278C-7896-4206-A5EA-1EABBD516B23} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {A95047BC-F9CA-43C1-804A-DF813A9CE7AF} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {AD6C95A2-E148-4258-957B-D782666E8A19} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {B35EBAF2-1116-4A14-8FAE-2C42C69E1E61} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => %windir%\ehome\MCUpdate.exe
Task: {B87A0DEA-3316-4397-9BD2-23C71CA59956} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => %SystemRoot%\ehome\ehPrivJob.exe
Task: {C906019E-88B0-49D7-A496-C567D0182F75} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {CB8E776D-5ED8-486F-92D9-C3201CF24E18} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {D04497CF-A798-446C-859C-C7FF8363AD35} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => %SystemRoot%\ehome\ehPrivJob.exe
Task: {D198FD40-7FF6-4A81-9CFA-C59EDE6617D5} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {D8A90EDA-2699-45D6-9188-0AE5FA70B6AE} - System32\Tasks\{56418FBD-AA82-4D56-B198-1A6BD9AC3C3B} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {DCD0B603-51D6-41A6-A3BB-1B2D5AC36E00} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {E3DCE4D5-772C-45A4-803F-0CC4C4910674} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {E4CF82B4-0050-411C-92F9-C0F95ECD1E72} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => %SystemRoot%\ehome\ehPrivJob.exe
Task: {E83B7A34-7727-472E-B6C6-3B3555CB9C47} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {E9DCF220-5039-4000-9D37-B9F038257247} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {EDF5BE92-9EA8-4102-A09B-C25AA5EB20F3} - System32\Tasks\{31325081-21FA-4F42-8C7E-FB0853955119} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {F1C04D77-0330-4416-835C-C715BCFD478E} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => %SystemRoot%\ehome\ehPrivJob.exe
Task: {F67C5E30-1D24-49A9-8994-D5AE50C22B5B} - System32\Tasks\{B9DBCE12-491E-4EE7-AB8E-ADD2931147BF} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {F71818E3-5D44-401E-A0E5-A5C41797A182} - System32\Tasks\{892C3A89-A423-42F9-A9F8-719EDF67A757} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {F8532A59-D33A-4B41-AC65-564506137E64} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {F9BE1DA5-21D0-47CB-800A-E34D8698F9C1} - System32\Tasks\{A52089E7-4EF3-4404-BB5C-0D98D6799D00} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {FA478953-3D15-4498-ABFC-049D2E7C5D75} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {FDAFC471-7432-49FA-89E7-AE99F3465B2E} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => %SystemRoot%\ehome\mcupdate.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\TechUtilities.job => C:\Program Files\TechUtilities\TechUtilities.exe -t C:\Program Files\TechUtilities\TechUtilities.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2016-07-16 11:42 - 2016-07-16 11:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-23 09:12 - 2016-12-09 10:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-09-01 17:12 - 2016-09-01 17:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-01-13 13:56 - 2017-01-13 13:56 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-03-09 13:56 - 2016-03-09 13:56 - 00331264 _____ () C:\Program Files (x86)\ExpressVPN\bootstrap\AMD64\nssm.exe
2016-10-05 15:30 - 2013-06-28 13:28 - 00084616 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2017-02-19 15:13 - 2017-01-20 07:47 - 02264352 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
2017-02-19 15:13 - 2017-01-20 07:47 - 02254800 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2017-02-19 15:13 - 2017-01-20 07:47 - 02829776 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\arwlib.dll
2013-10-17 15:27 - 2013-10-17 15:27 - 00166912 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2016-03-10 14:56 - 2016-03-10 14:56 - 09641976 _____ () C:\Program Files (x86)\ExpressVPN\xvpnd\xvpnd.exe
2016-12-23 09:12 - 2016-12-09 10:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-08-07 08:10 - 2016-12-28 17:03 - 08924864 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2016-09-20 14:00 - 2016-09-07 04:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-12 11:37 - 2016-12-21 07:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-12 11:37 - 2016-12-21 06:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-12 11:37 - 2016-12-21 06:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-02-18 03:21 - 2017-02-18 03:44 - 00073728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.109.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-02-18 03:21 - 2017-02-18 03:44 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.109.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-02-15 22:37 - 2017-02-15 09:21 - 02885464 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.54\libglesv2.dll
2017-02-15 22:37 - 2017-02-15 09:21 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.54\libegl.dll
2015-12-22 00:47 - 2015-12-22 00:47 - 00794920 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\kpcengine.2.3.dll
2016-03-10 14:56 - 2016-03-10 14:56 - 00379384 _____ () C:\Program Files (x86)\ExpressVPN\xvpnd\windows\ExpressVPN.FilterManager.dll
2017-02-19 17:55 - 2017-02-19 17:55 - 00056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_2993282669555816622.dll
2016-08-07 08:01 - 2016-12-28 11:34 - 01010368 _____ () C:\Program Files (x86)\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:F9CFE070 [762]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 02:34 - 2016-06-02 15:01 - 00002024 ____A C:\WINDOWS\system32\Drivers\etc\hosts

0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com

There are 4 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-319729760-2674817846-3730761306-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Michael\Desktop\19733_en_1.jpg
HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-02192017175440529\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 212.159.13.49 - 212.159.13.50
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: GladFileMonSvc => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: valWBFPolicyService => 2
HKLM\...\StartupApproved\Run: => "RtsCM"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "IJNetworkScannerSelectorEX"
HKLM\...\StartupApproved\Run32: => "CanonQuickMenu"
HKLM\...\StartupApproved\Run32: => "Nuance Power PDF Standard-reminder"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "NuanPowerPdf1NPDFLM"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "1987D95A86FCFAF5B82FFA7E9B4B7814763EFF83._service_run"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "BingSvc"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "PrinterProDesktop"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "ExpressVPN4"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "ApplePhotoStreams"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "iCloudServices"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "iCloudPhotos"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "Spotify Web Helper"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{4AB8E2A5-AD8C-4B60-8239-B4F751CF2281}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\bin\node.exe
FirewallRules: [{AD5721CD-9F65-49AE-9AD3-4117B611BE8A}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\bin\node.exe
FirewallRules: [{F07AF64C-F660-40C2-98B7-FB6D7363C92C}] => (Allow) C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
FirewallRules: [{E8460422-F07A-442B-9648-72EC7A7510A5}] => (Allow) C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
FirewallRules: [{2A43EAA1-B90B-42E5-9310-2FFBCF157C5E}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
FirewallRules: [{70BB4A7E-58B4-426B-8504-2781D8E45099}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
FirewallRules: [{4C2416FC-0DC1-400E-9CC8-FF378A3E4B69}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{D2AA7726-9C4B-4415-923D-3A3DF9E67426}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{6457D20F-28F6-4F9F-9250-DAD6D27A4706}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{15F21608-58F3-4166-9865-4DB11496055E}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{09724D86-DEE6-4ED0-9331-292FCE252F9E}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{49C00C96-91FE-441C-9F01-2640ACC0C6CD}] => (Allow) LPort=33300
FirewallRules: [{64AE33B2-1549-4F2D-8CED-5988DAE39CFD}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{BCD35B27-E893-4B2A-8208-9D263F10E1DF}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2ACBDF30-5333-46DC-A97A-037755AC0DCD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5564B592-D467-40FC-A909-40A5F1F64777}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [UDP Query User{57BCDEF5-06C6-49B5-ACB6-B07DEC0BA487}C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe] => (Allow) C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe
FirewallRules: [TCP Query User{F7EF5EBE-680F-4174-A980-AA1F6AF5AB93}C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe] => (Allow) C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe
FirewallRules: [{1B2A524E-3AB9-428B-AD14-191394E7BEE5}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr2003.exe
FirewallRules: [{CCB1DC8C-9EE8-4272-9579-1438820BA017}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr2003.exe
FirewallRules: [{BC4D829A-074D-4DC1-B783-7E638987E662}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe
FirewallRules: [{4581EE80-B6DC-4DC0-BD5D-1FD7020581A8}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe
FirewallRules: [{B7F1D112-EE8A-42AC-A193-309029428BDE}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladinetClient.exe
FirewallRules: [{DF4EB7D2-E089-4E99-9274-86B0EE3B88B7}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladinetClient.exe
FirewallRules: [UDP Query User{4B831A92-97D5-498C-A0F9-E048B5A8396D}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [TCP Query User{7E534F88-244B-48E9-94FF-9DD34218DB66}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [{5081F332-07BF-4CB5-8285-EF04A653F504}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [UDP Query User{70636A32-12C0-41B6-B17E-1242DD7E7BE2}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [TCP Query User{6028BDB7-A07F-4A73-9B62-E2C646950A36}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [{3BDB3194-2C3D-40FC-8FE0-8F4BD16EF58F}] => (Allow) C:\Users\Michael\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{F637C381-EC8D-49C1-AC48-40A01140243E}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{69AD1F1D-1433-4C9F-8CB7-7CFD4C087F60}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{8645F218-6BE2-45E1-AFB5-56143EE0EB53}] => (Allow) C:\Users\Michael\AppData\Local\Chromium\Application\chrome.exe
FirewallRules: [{A93A9AA8-441C-40FF-9204-7430FCCBA788}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{28AC2A8C-9817-405E-9A30-1D1AF22F723E}] => (Allow) C:\Program Files (x86)\bttb\dtuser.exe
FirewallRules: [{95FD9745-60CE-4017-BFFC-1E2151FA6D32}] => (Allow) C:\Program Files (x86)\bttb\dtuser.exe
FirewallRules: [{479F7A60-924D-44C7-9E71-DF261B6308EE}] => (Allow) %systemroot%\system32\alg.exe
FirewallRules: [{5BE7C6BB-0550-4631-8A63-7E0221EE941D}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{ADF931F8-5D2B-4252-975A-2618BE453D8C}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{155BD362-1586-48F3-AFA3-88CF6ED492BC}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFAssist.exe
FirewallRules: [{2E8D5A38-EC37-446D-AB17-3B48A9F3BDB8}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFAssist.exe
FirewallRules: [{D5993C01-6AF4-4888-9EC9-43527F66A8AD}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe
FirewallRules: [{53D76232-E996-4329-BDBB-60DABAA0F9BC}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe
FirewallRules: [{4E9E6211-5CF3-47E2-BCC3-491EEAED669A}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NPDFCreate.exe
FirewallRules: [{8894AA2C-47D3-4FA5-A19B-5DC64453F9A5}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NPDFCreate.exe
FirewallRules: [{E5B16744-E4D7-4B94-8324-C183F5D386B5}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NuancePDF.exe
FirewallRules: [{9F7C15EF-DCB9-48FA-A89C-14AAC5D71130}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NuancePDF.exe
FirewallRules: [{659C9A16-E551-437B-BF24-A2EB576262BA}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\Ereg\Ereg.exe
FirewallRules: [{CF432F0F-E12C-45E1-A85A-D01AB4F7D225}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\Ereg\Ereg.exe

==================== Restore Points =========================

26-01-2017 10:48:27 Windows Update
06-02-2017 12:05:47 Scheduled Checkpoint
16-02-2017 14:37:28 Scheduled Checkpoint
19-02-2017 17:30:48 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/19/2017 06:41:37 PM) (Source: MsiInstaller) (EventID: 11706) (User: MICHAEL-PC)
Description: Product: Nuance Power PDF Standard -- Error 1706.No valid source could be found for product Nuance Power PDF Standard. The Windows Installer cannot continue.

Error: (02/19/2017 05:54:27 PM) (Source: nssm) (EventID: 1018) (User: )
Description: Failed to read registry value AppDirectory:
The operation completed successfully.

Error: (02/19/2017 05:39:22 PM) (Source: MsiInstaller) (EventID: 11706) (User: MICHAEL-PC)
Description: Product: Nuance Power PDF Standard -- Error 1706.No valid source could be found for product Nuance Power PDF Standard. The Windows Installer cannot continue.

Error: (02/19/2017 05:31:13 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (02/19/2017 05:27:28 PM) (Source: MsiInstaller) (EventID: 11706) (User: MICHAEL-PC)
Description: Product: Nuance Power PDF Standard -- Error 1706.No valid source could be found for product Nuance Power PDF Standard. The Windows Installer cannot continue.

Error: (02/19/2017 05:20:42 PM) (Source: nssm) (EventID: 1018) (User: )
Description: Failed to read registry value AppDirectory:
The operation completed successfully.

Error: (02/19/2017 05:09:19 PM) (Source: MsiInstaller) (EventID: 11706) (User: MICHAEL-PC)
Description: Product: Nuance Power PDF Standard -- Error 1706.No valid source could be found for product Nuance Power PDF Standard. The Windows Installer cannot continue.

Error: (02/19/2017 05:04:49 PM) (Source: nssm) (EventID: 1018) (User: )
Description: Failed to read registry value AppDirectory:
The operation completed successfully.

Error: (02/19/2017 03:14:32 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\Nuance\Power PDF\NPDFAssist.exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.

Error: (02/19/2017 03:14:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mbamservice.exe, version: 3.1.0.415, time stamp: 0x5881b7a1
Faulting module name: ntdll.dll, version: 10.0.14393.479, time stamp: 0x5825887f
Exception code: 0xc0000005
Fault offset: 0x0000000000035793
Faulting process ID: 0x3f40
Faulting application start time: 0x01d28ac2c2ef47be
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report ID: 4f1015b7-5bb8-4b9b-aeab-9331074eed83
Faulting package full name:
Faulting package-relative application ID:


System errors:
=============
Error: (02/19/2017 05:54:45 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (02/19/2017 05:54:45 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (02/19/2017 05:54:42 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (02/19/2017 05:54:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The pcCMService64 service failed to start due to the following error:
The system cannot find the file specified.

Error: (02/19/2017 05:54:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The pcCMService service failed to start due to the following error:
The system cannot find the file specified.

Error: (02/19/2017 05:54:27 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Error: (02/19/2017 05:54:26 PM) (Source: BTHUSB) (EventID: 5) (User: )
Description: The Bluetooth driver expected an HCI event with a certain size but did not receive it.

Error: (02/19/2017 05:54:25 PM) (Source: BTHUSB) (EventID: 16) (User: )
Description: The mutual authentication between the local Bluetooth adapter and a device with Bluetooth adapter address (48:d7:05:60:08:25) failed.

Error: (02/19/2017 05:21:46 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (02/19/2017 05:21:46 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3 CPU M 380 @ 2.53GHz
Percentage of memory in use: 49%
Total physical RAM: 8047.43 MB
Available physical RAM: 4059.06 MB
Total Virtual: 16239.43 MB
Available Virtual: 12746.54 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:281 GB) (Free:195.99 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:15 GB) (Free:0 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.98 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 48E147D4)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=281 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)

==================== End of Addition.txt ============================

 

[mdp3157]

I use Kaspersky as an anti virus tool, it is still telling me that
C:\Windows\SysWOW64\cmd.exe is present.

 

[Broni]

It's most likely false positive since this is correct location for that file and it doesn't bother any of our tools.
I suggest you report it at Kaspersky's forum.

I still need TRST.txt log.

 

[mdp3157]

Sorry if I am being stupid but did you meant FRST.txt log?

 

[Broni]

Yes. FRST produces two logs. You posted only one.

 

[mdp3157]

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2017 01
Ran by Michael (19-02-2017 18:45:45)
Running from C:\Users\Michael\Desktop
Windows 10 Pro Version 1607 (X64) (2016-08-31 22:28:27)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-319729760-2674817846-3730761306-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-319729760-2674817846-3730761306-503 - Limited - Disabled)
Guest (S-1-5-21-319729760-2674817846-3730761306-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-319729760-2674817846-3730761306-1002 - Limited - Enabled)
Michael (S-1-5-21-319729760-2674817846-3730761306-1000 - Administrator - Enabled) => C:\Users\Michael

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {86367591-4BE4-AE08-2FD9-7FCB8259CD98}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Kaspersky Internet Security (Enabled - Up to date) {3D579475-6DDE-A186-1569-44B9F9DE8725}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {BE0DF4B4-018B-AF50-0486-D6FE7C8A8AE3}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.023.20056 - Adobe Systems Incorporated)
AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
Apple Application Support (32-bit) (HKLM-x32\...\{9BA1A894-B42F-4805-BC8C-349C905A3930}) (Version: 5.3.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{7EAC8A42-9FAC-4F6B-AABF-C08C9F2E0F13}) (Version: 5.3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.6.0.0 - Canon Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: 1.5.2.3 - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.5.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.10.15 - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.2.0 - Canon Inc.)
Canon MG2900 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2900_series) (Version: 1.01 - Canon Inc.)
Canon MG2900 series On-screen Manual (HKLM-x32\...\Canon MG2900 series On-screen Manual) (Version: 7.7.1 - Canon Inc.)
Canon MG2900 series User Registration (HKLM-x32\...\Canon MG2900 series User Registration) (Version: - ‭Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 3.5.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 3.5.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.3.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.7.0 - Canon Inc.)
CopyTrans Control Center Uninstall Only (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\CopyTrans Suite) (Version: 4.006 - WindSolutions)
ExpressVPN (HKLM-x32\...\{7e9357d8-8bdd-4e72-88ac-1b3acedd2b32}) (Version: 5.0.1.551 - ExpressVPN)
ExpressVPN (x32 Version: 5.0.1.551 - ExpressVPN) Hidden
ExpressVPN Compatibility Checks (x32 Version: 1.0.0.0 - ExpressVPN) Hidden
Fluency Now (HKLM-x32\...\{8A5CD593-FF6A-42FE-ACE5-58709FA1893A}) (Version: 4.0.0 - Western Standard)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.54 - Google Inc.)
Google Earth (HKLM-x32\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
HP Support Solutions Framework (HKLM-x32\...\{F6A11738-3EE4-4573-AEA5-6CD5D491C167}) (Version: 12.0.30.81 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\...\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.5.1 - Hewlett-Packard Company)
iCloud (HKLM\...\{0493048C-CB1A-44B7-8BB3-8467AF7BA9E4}) (Version: 6.1.2.13 - Apple Inc.)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.9 - HTC)
iTunes (HKLM\...\{9D0D2A8B-7E7B-4D88-8D50-24286ED6A5EB}) (Version: 12.5.5.5 - Apple Inc.)
Java 8 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218071F0}) (Version: 8.0.710.15 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{F575F386-57EF-4943-B003-A13F13B05EEB}) (Version: 16.0.1.445 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 16.0.1.445 - Kaspersky Lab) Hidden
Malwarebytes version 3.0.6.1469 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Nuance Power PDF Standard (HKLM\...\{B43651AB-6285-4FEB-95A2-3450D63378A2}) (Version: 1.10.8423 - Nuance Communications, Inc.)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
PhoneRescue (HKLM-x32\...\PhoneRescue) (Version: 3.2.3.0 - iMobie Inc.)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
Printer Pro Desktop (HKLM-x32\...\PrinterProDesktop) (Version: - Readdle)
QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
RogueKiller version 12.9.7.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.9.7.0 - Adlice Software)
Serif DrawPlus Starter Edition (HKLM-x32\...\{33311EA4-0ECA-4E7F-83E5-8A92CD760152}) (Version: 2.0.2.010 - Serif (Europe) Ltd)
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype™ 7.32 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.32.104 - Skype Technologies S.A.)
Speed Fix Tool Plus (HKLM-x32\...\{600A25D8-5738-4AE8-B860-384146900459}) (Version: 3.0.3 - FixBliss)
Spotify (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Spotify) (Version: 1.0.38.171.g5e1cd7b2 - Spotify AB)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)
TAV (HKLM-x32\...\{FBFE84F8-A402-4F7D-B63E-5FBBFE6BA438}) (Version: 1.0.0.0 - Translated)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.62308 - TeamViewer)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WhatsApp (HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\WhatsApp) (Version: 0.2.2731 - WhatsApp)
Windows 10 Upgrade Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17354 - Microsoft Corporation)
WYSIWYG Web Builder 11 (HKLM-x32\...\WYSIWYG_Web_Builder_11) (Version: - )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {03662996-3668-4022-BD17-1559481C0385} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {082F24D4-01D3-44B7-9207-955751DEF9D8} - System32\Tasks\{79F42A48-05D2-47CB-ABF5-C8ECA15C0F1F} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {0B4CB9A1-561A-41A5-B38D-A8D911FF4572} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => %SystemRoot%\ehome\ehPrivJob.exe
Task: {183E8F21-4548-4EB6-A615-95145418BCF1} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => %SystemRoot%\ehome\ehPrivJob.exe
Task: {24D65353-9C66-45EE-9BEC-CCBBAF61B453} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2016-12-29] (Microsoft Corporation)
Task: {29408F2B-0A23-414C-92B2-E0A80A9146AB} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {2EFBC053-9337-47F6-A61E-4FADFD2AA79A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-12] (Google Inc.)
Task: {354B9E14-8459-431C-A8B7-31087CDB6608} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {42FAD1EE-A0B3-4E00-A35D-8A2887E2316D} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {4963C22B-AB51-4E41-A785-5E6B0275A942} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {55D83733-396E-4B19-9ECF-CFB44BFB25D4} - System32\Tasks\{2508C3DC-9D26-478B-9AE2-67BF150F4CBB} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {59934F08-3300-4A92-AA0F-AA483E18536F} - System32\Tasks\{046B510E-D61B-4C5A-B0C3-5939DF20B152} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {59C5CFFE-60B2-4500-B35A-5DF65F0C3396} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {68B8B570-97FA-45CD-BAA7-7E271FCF0BE5} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => %SystemRoot%\ehome\mcupdate.exe
Task: {6956A104-A21C-410B-87B0-4102ECA07053} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {6D510903-6E39-4F68-A7EC-169B32026447} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {739BEF00-69DB-4E1A-885B-0E61E1187199} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {7506E117-5222-4876-976E-1E3389F868FA} - System32\Tasks\TechUtilities => C:\Program Files\TechUtilities\TechUtilities.exe
Task: {753AF1A7-71BD-4247-AED3-C96EBD3175F0} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => %SystemRoot%\ehome\ehrec.exe
Task: {765E2CEF-EC61-42C5-9488-4653E2D3AE28} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {7A083FFF-8697-4081-AB5C-5313CEDF14B6} - System32\Tasks\{175C893D-83C4-40BE-A4DE-3B7D9EAD1059} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {7D88719A-0728-4F54-B1EC-803EEAD5599B} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => %SystemRoot%\ehome\ehPrivJob.exe
Task: {815FC1A2-D806-44CF-A00A-56F271656A2D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-12] (Google Inc.)
Task: {822D47B8-3EC4-4C5E-A17A-13702D8B543B} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => %SystemRoot%\ehome\ehPrivJob.exe
Task: {8820AF1B-A70D-400F-B3BD-34C06F65C1D3} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {89FE76D1-1A6F-4549-8542-0C2E08AD837E} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => %SystemRoot%\ehome\ehPrivJob.exe
Task: {8B514EDF-ED61-442F-A6B8-27A86F7BD592} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => %SystemRoot%\ehome\mcupdate.exe
Task: {8D3EDFFE-81E2-4EDA-8B55-C8A3C4DE8455} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {8F8FE07D-AF62-4774-97DA-7C4234AC66C7} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => %SystemRoot%\ehome\ehPrivJob.exe
Task: {A0CFF039-735C-45A0-933A-277FD1CEC375} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Michael\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe
Task: {A5AD278C-7896-4206-A5EA-1EABBD516B23} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {A95047BC-F9CA-43C1-804A-DF813A9CE7AF} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {AD6C95A2-E148-4258-957B-D782666E8A19} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {B35EBAF2-1116-4A14-8FAE-2C42C69E1E61} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => %windir%\ehome\MCUpdate.exe
Task: {B87A0DEA-3316-4397-9BD2-23C71CA59956} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => %SystemRoot%\ehome\ehPrivJob.exe
Task: {C906019E-88B0-49D7-A496-C567D0182F75} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {CB8E776D-5ED8-486F-92D9-C3201CF24E18} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {D04497CF-A798-446C-859C-C7FF8363AD35} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => %SystemRoot%\ehome\ehPrivJob.exe
Task: {D198FD40-7FF6-4A81-9CFA-C59EDE6617D5} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {D8A90EDA-2699-45D6-9188-0AE5FA70B6AE} - System32\Tasks\{56418FBD-AA82-4D56-B198-1A6BD9AC3C3B} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {DCD0B603-51D6-41A6-A3BB-1B2D5AC36E00} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {E3DCE4D5-772C-45A4-803F-0CC4C4910674} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {E4CF82B4-0050-411C-92F9-C0F95ECD1E72} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => %SystemRoot%\ehome\ehPrivJob.exe
Task: {E83B7A34-7727-472E-B6C6-3B3555CB9C47} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {E9DCF220-5039-4000-9D37-B9F038257247} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => %SystemRoot%\ehome\mcupdate.exe
Task: {EDF5BE92-9EA8-4102-A09B-C25AA5EB20F3} - System32\Tasks\{31325081-21FA-4F42-8C7E-FB0853955119} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {F1C04D77-0330-4416-835C-C715BCFD478E} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => %SystemRoot%\ehome\ehPrivJob.exe
Task: {F67C5E30-1D24-49A9-8994-D5AE50C22B5B} - System32\Tasks\{B9DBCE12-491E-4EE7-AB8E-ADD2931147BF} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {F71818E3-5D44-401E-A0E5-A5C41797A182} - System32\Tasks\{892C3A89-A423-42F9-A9F8-719EDF67A757} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {F8532A59-D33A-4B41-AC65-564506137E64} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {F9BE1DA5-21D0-47CB-800A-E34D8698F9C1} - System32\Tasks\{A52089E7-4EF3-4404-BB5C-0D98D6799D00} => Chrome.exe hxxp://ui.skype.com/ui/0/7.23.0.105/en/abandoninstall?page=tsProgressBar
Task: {FA478953-3D15-4498-ABFC-049D2E7C5D75} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {FDAFC471-7432-49FA-89E7-AE99F3465B2E} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => %SystemRoot%\ehome\mcupdate.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\TechUtilities.job => C:\Program Files\TechUtilities\TechUtilities.exe -t C:\Program Files\TechUtilities\TechUtilities.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2016-07-16 11:42 - 2016-07-16 11:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-23 09:12 - 2016-12-09 10:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-09-01 17:12 - 2016-09-01 17:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-01-13 13:56 - 2017-01-13 13:56 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-03-09 13:56 - 2016-03-09 13:56 - 00331264 _____ () C:\Program Files (x86)\ExpressVPN\bootstrap\AMD64\nssm.exe
2016-10-05 15:30 - 2013-06-28 13:28 - 00084616 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2017-02-19 15:13 - 2017-01-20 07:47 - 02264352 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
2017-02-19 15:13 - 2017-01-20 07:47 - 02254800 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2017-02-19 15:13 - 2017-01-20 07:47 - 02829776 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\arwlib.dll
2013-10-17 15:27 - 2013-10-17 15:27 - 00166912 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2016-03-10 14:56 - 2016-03-10 14:56 - 09641976 _____ () C:\Program Files (x86)\ExpressVPN\xvpnd\xvpnd.exe
2016-12-23 09:12 - 2016-12-09 10:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-08-07 08:10 - 2016-12-28 17:03 - 08924864 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2016-09-20 14:00 - 2016-09-07 04:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-12 11:37 - 2016-12-21 07:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-12 11:37 - 2016-12-21 06:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-12 11:37 - 2016-12-21 06:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-12 11:37 - 2016-12-21 06:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-02-18 03:21 - 2017-02-18 03:44 - 00073728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.109.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-02-18 03:21 - 2017-02-18 03:44 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.109.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-02-15 22:37 - 2017-02-15 09:21 - 02885464 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.54\libglesv2.dll
2017-02-15 22:37 - 2017-02-15 09:21 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.54\libegl.dll
2015-12-22 00:47 - 2015-12-22 00:47 - 00794920 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\kpcengine.2.3.dll
2016-03-10 14:56 - 2016-03-10 14:56 - 00379384 _____ () C:\Program Files (x86)\ExpressVPN\xvpnd\windows\ExpressVPN.FilterManager.dll
2017-02-19 17:55 - 2017-02-19 17:55 - 00056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_2993282669555816622.dll
2016-08-07 08:01 - 2016-12-28 11:34 - 01010368 _____ () C:\Program Files (x86)\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:F9CFE070 [762]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 02:34 - 2016-06-02 15:01 - 00002024 ____A C:\WINDOWS\system32\Drivers\etc\hosts

0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com

There are 4 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-319729760-2674817846-3730761306-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Michael\Desktop\19733_en_1.jpg
HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-02192017175440529\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 212.159.13.49 - 212.159.13.50
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: GladFileMonSvc => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: valWBFPolicyService => 2
HKLM\...\StartupApproved\Run: => "RtsCM"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "IJNetworkScannerSelectorEX"
HKLM\...\StartupApproved\Run32: => "CanonQuickMenu"
HKLM\...\StartupApproved\Run32: => "Nuance Power PDF Standard-reminder"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "NuanPowerPdf1NPDFLM"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "1987D95A86FCFAF5B82FFA7E9B4B7814763EFF83._service_run"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "BingSvc"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "PrinterProDesktop"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "ExpressVPN4"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "ApplePhotoStreams"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "iCloudServices"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "iCloudPhotos"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\StartupApproved\Run: => "Spotify Web Helper"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{4AB8E2A5-AD8C-4B60-8239-B4F751CF2281}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\bin\node.exe
FirewallRules: [{AD5721CD-9F65-49AE-9AD3-4117B611BE8A}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\bin\node.exe
FirewallRules: [{F07AF64C-F660-40C2-98B7-FB6D7363C92C}] => (Allow) C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
FirewallRules: [{E8460422-F07A-442B-9648-72EC7A7510A5}] => (Allow) C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
FirewallRules: [{2A43EAA1-B90B-42E5-9310-2FFBCF157C5E}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
FirewallRules: [{70BB4A7E-58B4-426B-8504-2781D8E45099}] => (Allow) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
FirewallRules: [{4C2416FC-0DC1-400E-9CC8-FF378A3E4B69}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{D2AA7726-9C4B-4415-923D-3A3DF9E67426}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{6457D20F-28F6-4F9F-9250-DAD6D27A4706}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{15F21608-58F3-4166-9865-4DB11496055E}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{09724D86-DEE6-4ED0-9331-292FCE252F9E}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{49C00C96-91FE-441C-9F01-2640ACC0C6CD}] => (Allow) LPort=33300
FirewallRules: [{64AE33B2-1549-4F2D-8CED-5988DAE39CFD}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{BCD35B27-E893-4B2A-8208-9D263F10E1DF}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2ACBDF30-5333-46DC-A97A-037755AC0DCD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5564B592-D467-40FC-A909-40A5F1F64777}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [UDP Query User{57BCDEF5-06C6-49B5-ACB6-B07DEC0BA487}C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe] => (Allow) C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe
FirewallRules: [TCP Query User{F7EF5EBE-680F-4174-A980-AA1F6AF5AB93}C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe] => (Allow) C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe
FirewallRules: [{1B2A524E-3AB9-428B-AD14-191394E7BEE5}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr2003.exe
FirewallRules: [{CCB1DC8C-9EE8-4272-9579-1438820BA017}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr2003.exe
FirewallRules: [{BC4D829A-074D-4DC1-B783-7E638987E662}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe
FirewallRules: [{4581EE80-B6DC-4DC0-BD5D-1FD7020581A8}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe
FirewallRules: [{B7F1D112-EE8A-42AC-A193-309029428BDE}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladinetClient.exe
FirewallRules: [{DF4EB7D2-E089-4E99-9274-86B0EE3B88B7}] => (Allow) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladinetClient.exe
FirewallRules: [UDP Query User{4B831A92-97D5-498C-A0F9-E048B5A8396D}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [TCP Query User{7E534F88-244B-48E9-94FF-9DD34218DB66}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [{5081F332-07BF-4CB5-8285-EF04A653F504}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [UDP Query User{70636A32-12C0-41B6-B17E-1242DD7E7BE2}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [TCP Query User{6028BDB7-A07F-4A73-9B62-E2C646950A36}C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe] => (Allow) C:\program files (x86)\asbyte\syncing.net\bin\syncservice.exe
FirewallRules: [{3BDB3194-2C3D-40FC-8FE0-8F4BD16EF58F}] => (Allow) C:\Users\Michael\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{F637C381-EC8D-49C1-AC48-40A01140243E}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{69AD1F1D-1433-4C9F-8CB7-7CFD4C087F60}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{8645F218-6BE2-45E1-AFB5-56143EE0EB53}] => (Allow) C:\Users\Michael\AppData\Local\Chromium\Application\chrome.exe
FirewallRules: [{A93A9AA8-441C-40FF-9204-7430FCCBA788}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{28AC2A8C-9817-405E-9A30-1D1AF22F723E}] => (Allow) C:\Program Files (x86)\bttb\dtuser.exe
FirewallRules: [{95FD9745-60CE-4017-BFFC-1E2151FA6D32}] => (Allow) C:\Program Files (x86)\bttb\dtuser.exe
FirewallRules: [{479F7A60-924D-44C7-9E71-DF261B6308EE}] => (Allow) %systemroot%\system32\alg.exe
FirewallRules: [{5BE7C6BB-0550-4631-8A63-7E0221EE941D}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{ADF931F8-5D2B-4252-975A-2618BE453D8C}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{155BD362-1586-48F3-AFA3-88CF6ED492BC}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFAssist.exe
FirewallRules: [{2E8D5A38-EC37-446D-AB17-3B48A9F3BDB8}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFAssist.exe
FirewallRules: [{D5993C01-6AF4-4888-9EC9-43527F66A8AD}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe
FirewallRules: [{53D76232-E996-4329-BDBB-60DABAA0F9BC}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe
FirewallRules: [{4E9E6211-5CF3-47E2-BCC3-491EEAED669A}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NPDFCreate.exe
FirewallRules: [{8894AA2C-47D3-4FA5-A19B-5DC64453F9A5}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NPDFCreate.exe
FirewallRules: [{E5B16744-E4D7-4B94-8324-C183F5D386B5}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NuancePDF.exe
FirewallRules: [{9F7C15EF-DCB9-48FA-A89C-14AAC5D71130}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\bin\NuancePDF.exe
FirewallRules: [{659C9A16-E551-437B-BF24-A2EB576262BA}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\Ereg\Ereg.exe
FirewallRules: [{CF432F0F-E12C-45E1-A85A-D01AB4F7D225}] => (Allow) C:\Program Files (x86)\Nuance\Power PDF\Ereg\Ereg.exe

==================== Restore Points =========================

26-01-2017 10:48:27 Windows Update
06-02-2017 12:05:47 Scheduled Checkpoint
16-02-2017 14:37:28 Scheduled Checkpoint
19-02-2017 17:30:48 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/19/2017 06:41:37 PM) (Source: MsiInstaller) (EventID: 11706) (User: MICHAEL-PC)
Description: Product: Nuance Power PDF Standard -- Error 1706.No valid source could be found for product Nuance Power PDF Standard. The Windows Installer cannot continue.

Error: (02/19/2017 05:54:27 PM) (Source: nssm) (EventID: 1018) (User: )
Description: Failed to read registry value AppDirectory:
The operation completed successfully.

Error: (02/19/2017 05:39:22 PM) (Source: MsiInstaller) (EventID: 11706) (User: MICHAEL-PC)
Description: Product: Nuance Power PDF Standard -- Error 1706.No valid source could be found for product Nuance Power PDF Standard. The Windows Installer cannot continue.

Error: (02/19/2017 05:31:13 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (02/19/2017 05:27:28 PM) (Source: MsiInstaller) (EventID: 11706) (User: MICHAEL-PC)
Description: Product: Nuance Power PDF Standard -- Error 1706.No valid source could be found for product Nuance Power PDF Standard. The Windows Installer cannot continue.

Error: (02/19/2017 05:20:42 PM) (Source: nssm) (EventID: 1018) (User: )
Description: Failed to read registry value AppDirectory:
The operation completed successfully.

Error: (02/19/2017 05:09:19 PM) (Source: MsiInstaller) (EventID: 11706) (User: MICHAEL-PC)
Description: Product: Nuance Power PDF Standard -- Error 1706.No valid source could be found for product Nuance Power PDF Standard. The Windows Installer cannot continue.

Error: (02/19/2017 05:04:49 PM) (Source: nssm) (EventID: 1018) (User: )
Description: Failed to read registry value AppDirectory:
The operation completed successfully.

Error: (02/19/2017 03:14:32 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\Nuance\Power PDF\NPDFAssist.exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.

Error: (02/19/2017 03:14:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mbamservice.exe, version: 3.1.0.415, time stamp: 0x5881b7a1
Faulting module name: ntdll.dll, version: 10.0.14393.479, time stamp: 0x5825887f
Exception code: 0xc0000005
Fault offset: 0x0000000000035793
Faulting process ID: 0x3f40
Faulting application start time: 0x01d28ac2c2ef47be
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report ID: 4f1015b7-5bb8-4b9b-aeab-9331074eed83
Faulting package full name:
Faulting package-relative application ID:


System errors:
=============
Error: (02/19/2017 05:54:45 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (02/19/2017 05:54:45 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (02/19/2017 05:54:42 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (02/19/2017 05:54:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The pcCMService64 service failed to start due to the following error:
The system cannot find the file specified.

Error: (02/19/2017 05:54:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The pcCMService service failed to start due to the following error:
The system cannot find the file specified.

Error: (02/19/2017 05:54:27 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Error: (02/19/2017 05:54:26 PM) (Source: BTHUSB) (EventID: 5) (User: )
Description: The Bluetooth driver expected an HCI event with a certain size but did not receive it.

Error: (02/19/2017 05:54:25 PM) (Source: BTHUSB) (EventID: 16) (User: )
Description: The mutual authentication between the local Bluetooth adapter and a device with Bluetooth adapter address (48:d7:05:60:08:25) failed.

Error: (02/19/2017 05:21:46 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (02/19/2017 05:21:46 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3 CPU M 380 @ 2.53GHz
Percentage of memory in use: 49%
Total physical RAM: 8047.43 MB
Available physical RAM: 4059.06 MB
Total Virtual: 16239.43 MB
Available Virtual: 12746.54 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:281 GB) (Free:195.99 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:15 GB) (Free:0 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.98 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 48E147D4)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=281 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)

==================== End of Addition.txt ============================

 

[Broni]

No. You posted same log.
FRST produces two logs, FRST.txt and Addition.txt
I still need first one (FRST.txt).

 

[mdp3157]

Sorry her's the other one
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-02-2017 01
Ran by Michael (administrator) on MICHAEL-PC (19-02-2017 18:44:13)
Running from C:\Users\Michael\Desktop
Loaded Profiles: Michael & (Available Profiles: Michael & DefaultAppPool)
Platform: Windows 10 Pro Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\avp.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
() C:\Program Files (x86)\ExpressVPN\bootstrap\AMD64\nssm.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
() C:\Program Files (x86)\ExpressVPN\xvpnd\xvpnd.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\avpui.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_71\bin\javaw.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.109.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [RtsCM] => C:\WINDOWS\RTSCM64.EXE [210688 2015-06-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-11-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\isuspm.exe [2075480 2013-06-24] (Flexera Software LLC.)
HKLM-x32\...\Run: [PowerPDF Registry Controller] => C:\Program Files (x86)\Nuance\Power PDF\RegistryController.exe [206288 2015-02-06] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [NuanPowerPdf1NPDFLM] => C:\Program Files (x86)\Nuance\Power PDF\NPDFLM.exe [3452456 2015-02-06] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [Nuance Power PDF Standard-reminder] => "C:\Program Files (x86)\Nuance\Power PDF\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\Power PDF Standard\Ereg\Ereg.ini"
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-12-22] (Oracle Corporation)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1314432 2016-03-11] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [438888 2014-01-15] (CANON INC.)
HKLM-x32\...\Run: [SilentCleanService] => C:\Program Files (x86)\iMobie\PhoneRescue\${CHECK_RUNSERVICE_NAME}
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [Translated.TAV] => C:\Program Files (x86)\TAV\TAV.exe [5394734 2014-07-16] (Translated)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [1987D95A86FCFAF5B82FFA7E9B4B7814763EFF83._service_run] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1120600 2017-02-15] (Google Inc.)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [PrinterProDesktop] => C:\Program Files (x86)\Printer Pro Desktop\PrinterProDesktop.exe [4056064 2015-11-04] ()
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2017-01-17] (Apple Inc.)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [67896 2017-01-17] (Apple Inc.)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [356664 2017-01-17] (Apple Inc.)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [Spotify Web Helper] => C:\Users\Michael\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1529456 2016-10-21] (Spotify Ltd)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [Spotify] => C:\Users\Michael\AppData\Roaming\Spotify\Spotify.exe [6795376 2016-10-21] (Spotify Ltd)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27427808 2017-02-08] (Skype Technologies S.A.)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\...\RunOnce: [Translated.TAV] => C:\Program Files (x86)\TAV\TAV.exe [5394734 2014-07-16] (Translated)
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [37376 2016-07-16] (Microsoft Corporation)
HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-02192017175440529\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2016-07-16] (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 212.159.13.49 212.159.13.50
Tcpip\..\Interfaces\{1fdc0269-e74d-4758-9420-27dce9e649fb}: [DhcpNameServer] 10.12.0.1
Tcpip\..\Interfaces\{c4431879-55d9-436b-a712-0e9d66579945}: [DhcpNameServer] 80.58.61.250 80.58.61.254
Tcpip\..\Interfaces\{edd1e0ee-9a3f-4f14-809c-e3205930f732}: [DhcpNameServer] 212.159.13.49 212.159.13.50

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-4a1eac3c
HKU\S-1-5-21-319729760-2674817846-3730761306-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=SL5M&ocid=SL5MDHP&osmkt=en-gb
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {6586d803-df30-46d3-a89a-4136c8571d45} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-4a1eac3c&q={searchTerms}
SearchScopes: HKLM -> {d4fee3d1-1014-4db8-a824-573bf9ab51c7} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-4a1eac3c&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-319729760-2674817846-3730761306-1000 -> DefaultScope {6586d803-df30-46d3-a89a-4136c8571d45} URL = hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-319729760-2674817846-3730761306-1000 -> {6586d803-df30-46d3-a89a-4136c8571d45} URL = hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-319729760-2674817846-3730761306-1000 -> {d4fee3d1-1014-4db8-a824-573bf9ab51c7} URL = hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q={searchTerms}&src=IE-SearchBox
BHO: Kaspersky Protection -> {03993315-5CE9-4F00-8790-D14A94F1D91A} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\x64\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2015-02-23] (CANON INC.)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)
BHO-x32: Kaspersky Protection -> {03993315-5CE9-4F00-8790-D14A94F1D91A} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2015-02-23] (CANON INC.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\ssv.dll [2016-01-25] (Oracle Corporation)
BHO-x32: Nuance PDF Toolbar Helper -> {940361F8-7F16-4498-AB43-2EFFE0235AFA} -> C:\Program Files (x86)\Nuance\Power PDF\Bin\SZeonIEFavClient.dll [2014-11-18] (Zeon Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\jp2ssv.dll [2016-01-25] (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.)
Toolbar: HKLM - Kaspersky Protection Toolbar - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\x64\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Nuance PDF - {BED78D9C-A025-4FE9-B3BA-27E6D376A3D5} - C:\Program Files (x86)\Nuance\Power PDF\Bin\SZeonIEFavClient.dll [2014-11-18] (Zeon Corporation)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.)
Toolbar: HKLM-x32 - Kaspersky Protection Toolbar - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: sv5layt6.default
FF ProfilePath: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default [2017-02-19]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\sv5layt6.default -> Bing
FF SearchEngineOrder.3: Mozilla\Firefox\Profiles\sv5layt6.default -> Bing
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\sv5layt6.default -> Bing
FF Keyword.URL: Mozilla\Firefox\Profiles\sv5layt6.default -> hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q=
FF Extension: (Bing Search) - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\Extensions\bingsearch.full@microsoft.com.xpi [2015-12-27]
FF Extension: (BT Toolbar) - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\Extensions\{aba8d0e6-0d4d-4cb8-836a-04d69824b108} [2015-11-09] [not signed]
FF Extension: (No Name) - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\magit@magit.com [not found]
FF Extension: (No Name) - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\avg@toolbar [not found]
FF Extension: (Nuance PDF Convert) - C:\Program Files (x86)\Nuance\Power PDF\FireFox [2015-09-28] [not signed]
FF Extension: (No Name) - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\extensions\veggy@veggyAddon.com [not found]
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sv5layt6.default\searchplugins\bing-.xml [2015-12-27]
FF Extension: (Motive Extension) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\mcciwbch@motive.com.xpi [2015-11-09] [not signed]
FF Extension: (Skype) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-01-06]
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_ACF0E80077C511E59DED005056C00008@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\FFExt\light_plugin_firefox\addon.xpi
FF Extension: (Kaspersky Protection) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\FFExt\light_plugin_firefox\addon.xpi [2016-12-02]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2015-10-29] (CANON INC.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.71.2 -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\dtplugin\npDeployJava1.dll [2016-01-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.71.2 -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\plugin2\npjp2.dll [2016-01-25] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-12-28] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-23] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-23] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\Power PDF\bin\nppdf.dll [2015-01-08] (Zeon Corporation)
StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.co.uk/
CHR StartupUrls: Default -> "hxxp://www.google.co.uk/","hxxp://www.bbc.co.uk/news"
CHR DefaultSearchKeyword: Default -> google.co.uk
CHR Profile: C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default [2017-02-19]
CHR Extension: (Google Slides) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-09-12]
CHR Extension: (Google Docs) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-16]
CHR Extension: (Google Drive) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (Freecell Solitaire) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\cabpjbpfakfhcfidnjahmdophhihafkh [2015-09-28]
CHR Extension: (Street Racers) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\cohkjfondhjjfehnehlpmjpljpihfhfc [2015-09-28]
CHR Extension: (Google Search) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Cordy) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgjbkahdllcckjbjijejpmcgkkjpnnfk [2015-09-28]
CHR Extension: (Realm of the Mad God) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhjfmaldpppkmjjgkmadddbanpabfflp [2015-09-28]
CHR Extension: (Solitaire) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkelcbhdkpcdiiancfjhjcpdinbbfolp [2015-09-28]
CHR Extension: (The Godfather: Five Families) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfkoljdeffeedleidebkmmamepgbnbl [2015-09-28]
CHR Extension: (Solitaire: Deck of Cods ) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\eefllalllgpmcjgpohamfcllldfafoac [2015-09-28]
CHR Extension: (Google Sheets) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-09-12]
CHR Extension: (Causality Games) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\femoooemgmjaebeodbbikbkmhlafenpl [2015-09-28]
CHR Extension: (Booking.com for Chrome™) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgkeilefmpmbamgcejhjpiecahcbipip [2016-03-07]
CHR Extension: (Winter Solitaire) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghajoocbdkpejimpioleoiacokncanpl [2015-09-28]
CHR Extension: (Google Docs Offline) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (Qbox - Wisdom of the Ages) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ikfnimbehfhlelledoaemompbeihbhfb [2015-09-28]
CHR Extension: (zoomWheel) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfgigbjonaniokmpfflpflkhahhbaej [2015-09-28]
CHR Extension: (Kaspersky Protection) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpeeaghdjmhlakojjcgfdhgcejdaefmi [2017-01-30]
CHR Extension: (Extreme Racing) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdapmkojdflkpldoldoccpobfeaononj [2016-05-18]
CHR Extension: (Google Mail Checker) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2015-09-28]
CHR Extension: (WGT Golf Game) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpedbpkelbhcbkdaglillalioeeekbpb [2015-09-28]
CHR Extension: (Office Online) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndjpnladcallmjemlbaebfadecfhkepb [2016-10-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-23]
CHR Extension: (GTT Automator for Translated.net) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbajcadkkdfbdhljmemgdccfalehmifo [2017-01-13]
CHR Extension: (WorldWar) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbjgfoejobpldjhcjlcijkekinoljank [2015-09-28]
CHR Extension: (World Clocks 2) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjgoijhajhaahklokegbfnohialajpej [2015-09-28]
CHR Extension: (Gmail) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-09-16]
CHR Extension: (Chrome Media Router) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-06]
CHR HKLM\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 AVP16.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\avp.exe [236928 2015-12-22] (AO Kaspersky Lab)
R2 BcmBtRSupport; C:\WINDOWS\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
S2 BT Help Wizard; C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.10\ma\bin\MAHostService.exe [321024 2014-04-09] (Alcatel-Lucent) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3699904 2016-12-28] (Microsoft Corporation)
R2 ExpressVpnService; C:\Program Files (x86)\ExpressVPN\bootstrap\AMD64\nssm.exe [331264 2016-03-09] () [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [24888 2015-07-26] (Hewlett-Packard Company)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [84616 2013-06-28] ()
S3 klvssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\x64\vssbridge64.exe [152488 2015-12-22] (AO Kaspersky Lab)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7184144 2016-07-06] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S2 pcCMService; "C:\Program Files (x86)\Common Files\Motive\pcCMService.exe" [X]
S2 pcCMService64; "C:\Program Files\Common Files\Motive\pcCMService.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [102912 2015-05-28] (Advanced Micro Devices)
R3 bcbtums; C:\WINDOWS\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R0 cm_km; C:\WINDOWS\System32\DRIVERS\cm_km.sys [389816 2015-07-05] (Kaspersky Lab ZAO)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77416 2017-01-20] ()
S3 HtcVCom32; C:\WINDOWS\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-08] (QUALCOMM Incorporated)
R0 kl1; C:\WINDOWS\System32\DRIVERS\kl1.sys [478392 2015-09-11] (Kaspersky Lab ZAO)
R0 klbackupdisk; C:\WINDOWS\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO)
R1 klbackupflt; C:\WINDOWS\System32\DRIVERS\klbackupflt.sys [79752 2015-12-01] (AO Kaspersky Lab)
R2 kldisk; C:\WINDOWS\system32\DRIVERS\kldisk.sys [78200 2015-12-01] (AO Kaspersky Lab)
S0 klelam; C:\WINDOWS\System32\DRIVERS\klelam.sys [30328 2015-06-23] (Kaspersky Lab)
R3 klflt; C:\WINDOWS\system32\DRIVERS\klflt.sys [182664 2015-12-11] (AO Kaspersky Lab)
R1 klhk; C:\WINDOWS\System32\drivers\klhk.sys [237912 2016-12-02] (AO Kaspersky Lab)
R3 klids; C:\ProgramData\Kaspersky Lab\AVP16.0.1\Bases\klids.sys [182360 2016-10-05] (AO Kaspersky Lab)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [992600 2016-08-16] (AO Kaspersky Lab)
R1 KLIM6; C:\WINDOWS\system32\DRIVERS\klim6.sys [51288 2016-04-29] (AO Kaspersky Lab)
R3 klkbdflt; C:\WINDOWS\system32\DRIVERS\klkbdflt.sys [52608 2015-11-11] (AO Kaspersky Lab)
R3 klmouflt; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [41656 2015-06-06] (Kaspersky Lab ZAO)
R1 klpd; C:\WINDOWS\System32\DRIVERS\klpd.sys [45960 2015-12-07] (AO Kaspersky Lab)
R1 klwfp; C:\WINDOWS\system32\DRIVERS\klwfp.sys [87984 2016-08-16] (AO Kaspersky Lab)
R1 Klwtp; C:\WINDOWS\system32\DRIVERS\klwtp.sys [110424 2016-08-16] (AO Kaspersky Lab)
R1 kneps; C:\WINDOWS\system32\DRIVERS\kneps.sys [194440 2015-12-02] (AO Kaspersky Lab)
R2 MBAMChameleon; C:\WINDOWS\system32\drivers\MBAMChameleon.sys [176584 2017-02-19] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [110536 2017-02-19] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [43968 2017-02-19] (Malwarebytes)
R0 MBAMSwissArmy; C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [251848 2017-02-19] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [91584 2017-02-19] (Malwarebytes)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek )
R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [3068160 2015-06-16] (Realtek Semiconductor Corp.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
U3 idsvc; no ImagePath
S3 MREMP50; \??\C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [X]
S3 MREMP50a64; \??\C:\Program Files\Common Files\Motive\MREMP50a64.sys [X]
S3 MRESP50; \??\C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [X]
S3 MRESP50a64; \??\C:\Program Files\Common Files\Motive\MRESP50a64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-19 18:43 - 2017-02-19 18:43 - 00000000 ____D C:\Users\Michael\Desktop\FRST-OlderVersion
2017-02-19 17:36 - 2017-02-19 17:36 - 00001318 _____ C:\Users\Michael\Desktop\JRT.txt
2017-02-19 17:26 - 2017-02-19 17:30 - 01663040 _____ (Malwarebytes) C:\Users\Michael\Desktop\JRT.exe
2017-02-19 17:24 - 2017-02-19 17:24 - 00002811 _____ C:\Users\Michael\Desktop\AdwCleaner[S0].txt
2017-02-19 17:23 - 2017-02-19 17:23 - 00003178 _____ C:\Users\Michael\Desktop\AdwCleaner[C0].txt
2017-02-19 17:11 - 2017-02-19 17:23 - 00000000 ____D C:\AdwCleaner
2017-02-19 17:11 - 2017-02-19 17:11 - 00114159 _____ C:\Users\Michael\Desktop\Malwarebytes report.txt
2017-02-19 17:01 - 2017-02-19 17:08 - 00000258 __RSH C:\ProgramData\ntuser.pol
2017-02-19 16:39 - 2017-02-19 16:39 - 00251848 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\45916E60.sys
2017-02-19 15:18 - 2017-02-19 17:11 - 04015056 _____ C:\Users\Michael\Desktop\AdwCleaner.exe
2017-02-19 15:14 - 2017-02-19 17:54 - 00110536 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-02-19 15:14 - 2017-02-19 17:54 - 00091584 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-02-19 15:14 - 2017-02-19 17:54 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-02-19 15:14 - 2017-02-19 15:14 - 00176584 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-02-19 15:13 - 2017-02-19 17:54 - 00251848 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-02-19 15:13 - 2017-02-19 15:13 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-02-19 15:13 - 2017-02-19 15:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-02-19 15:13 - 2017-02-19 15:13 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-02-19 15:13 - 2017-02-19 15:13 - 00000000 ____D C:\Program Files\Malwarebytes
2017-02-19 15:13 - 2017-01-20 07:47 - 00077416 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-02-19 14:33 - 2017-02-19 15:13 - 55566792 _____ (Malwarebytes ) C:\Users\Michael\Desktop\mb3-setup-consumer-3.0.6.1469.exe
2017-02-19 14:27 - 2017-02-19 14:27 - 00051380 _____ C:\Users\Michael\Desktop\rk_770C.tmp.txt
2017-02-19 13:19 - 2017-02-19 18:20 - 00028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2017-02-19 13:19 - 2017-02-19 14:15 - 00000000 ____D C:\Users\Michael\AppData\Local\CrashDumps
2017-02-19 13:18 - 2017-02-19 17:02 - 00000000 ____D C:\ProgramData\RogueKiller
2017-02-19 13:18 - 2017-02-19 13:18 - 00000899 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2017-02-19 13:18 - 2017-02-19 13:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2017-02-19 13:18 - 2017-02-19 13:18 - 00000000 ____D C:\Program Files\RogueKiller
2017-02-19 13:03 - 2017-02-19 13:17 - 34801784 _____ (Adlice Software ) C:\Users\Michael\Desktop\setup.exe
2017-02-17 16:37 - 2017-02-17 17:29 - 61622268 _____ C:\Users\Michael\Desktop\PowerPDFStnd1.2uk.exe
2017-02-17 14:04 - 2017-02-17 14:04 - 00086108 _____ C:\Users\Michael\Desktop\CI0000536589-1216.pdf
2017-02-17 14:00 - 2017-02-17 14:00 - 00176185 _____ C:\Users\Michael\Desktop\FB0021069377.pdf
2017-02-17 10:24 - 2017-02-17 10:26 - 00043257 _____ C:\Users\Michael\Desktop\Addition.txt
2017-02-17 10:23 - 2017-02-19 18:44 - 00029636 _____ C:\Users\Michael\Desktop\FRST.txt
2017-02-17 10:22 - 2017-02-19 18:44 - 00000000 ____D C:\FRST
2017-02-17 10:19 - 2017-02-19 18:43 - 02422784 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2017-02-16 11:27 - 2017-02-16 11:27 - 01788434 _____ C:\Users\Michael\Downloads\16496448-18705888-rQGUePan_original.zip
2017-02-16 10:40 - 2017-02-16 10:40 - 00125502 _____ C:\Users\Michael\Downloads\16484677-18703920-iuwSgXcl_original.zip
2017-02-16 08:54 - 2017-02-16 08:54 - 00053502 _____ C:\Users\Michael\Downloads\Use Classes - April 2014.pdf
2017-02-16 08:33 - 2017-02-16 08:33 - 00016363 _____ C:\Users\Michael\Downloads\Copy_of_17-02-14_DE-Grundtexte-in de-en.xlsx
2017-02-16 08:32 - 2017-02-16 08:32 - 00013866 _____ C:\Users\Michael\Downloads\Copy_of_17-02-14_DE-Grundtexte-in.xlsx
2017-02-16 08:10 - 2017-02-16 08:10 - 00110229 _____ C:\Users\Michael\Downloads\16398908-18702626-UJFNPJfh_original.zip
2017-02-16 07:57 - 2017-02-16 07:57 - 00032763 _____ C:\Users\Michael\Downloads\16480612-18698854-FTotNzAa_original.zip
2017-02-15 14:30 - 2017-02-15 14:30 - 00097362 _____ C:\Users\Michael\Desktop\NetFlorist Order No.pdf
2017-02-15 11:30 - 2017-02-15 11:30 - 01090101 _____ C:\Users\Michael\Downloads\16485331-18691420-TxLcnCLp_original.zip
2017-02-14 16:32 - 2017-02-14 16:32 - 00002221 _____ C:\Users\Public\Desktop\Google Earth.lnk
2017-02-14 16:32 - 2017-02-14 16:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
2017-02-14 14:51 - 2017-02-14 14:51 - 00000787 _____ C:\Users\Michael\Downloads\16478014-18680263-QXhsPeMR_original.zip
2017-02-14 14:40 - 2017-02-14 14:40 - 00000745 _____ C:\Users\Michael\Downloads\16477968-18680826-ZijXdLGf_original.zip
2017-02-14 11:45 - 2017-02-14 11:45 - 00010992 _____ C:\Users\Michael\Downloads\16475205-18678433-LIFSjGlh_original.zip
2017-02-09 13:38 - 2017-02-09 13:38 - 00004609 _____ C:\Users\Michael\Downloads\16436849-18631142-OgJugniq_original.zip
2017-02-08 09:05 - 2017-02-14 13:07 - 00029220 _____ C:\Users\Michael\Documents\Perkins Short-term lending - cashflow PL 311216 mdp.xlsx
2017-02-08 08:00 - 2017-02-08 08:00 - 27439058 _____ C:\Users\Michael\Downloads\wetransfer-b9ba66.zip
2017-02-06 09:45 - 2017-02-06 09:45 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-02-06 09:45 - 2017-02-06 09:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-02-06 09:44 - 2017-02-06 09:45 - 00000000 ____D C:\Program Files\iTunes
2017-02-06 09:44 - 2017-02-06 09:44 - 00000000 ____D C:\Program Files\iPod
2017-02-06 09:36 - 2017-02-06 09:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2017-01-31 11:24 - 2017-01-31 11:25 - 07791277 _____ C:\Users\Michael\Downloads\16341510-18520336-BnyVmyDu_original.zip
2017-01-26 09:49 - 2016-12-21 07:08 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2017-01-26 09:49 - 2016-12-21 04:44 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2017-01-20 14:13 - 2017-01-20 14:14 - 00000000 ____D C:\Users\Michael\Documents\Retired

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-19 18:43 - 2015-09-24 09:55 - 00000000 ____D C:\Users\Michael\AppData\Roaming\Skype
2017-02-19 18:42 - 2016-08-31 21:56 - 00000000 ____D C:\Users\Michael
2017-02-19 18:41 - 2015-09-28 10:15 - 00000000 ____D C:\ProgramData\TEMP
2017-02-19 18:38 - 2016-08-31 21:46 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-19 18:16 - 2015-09-23 16:52 - 00000000 ____D C:\Users\Michael\Documents\Outlook Files
2017-02-19 18:09 - 2015-10-22 08:54 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2017-02-19 17:56 - 2015-09-12 15:09 - 00000000 ___RD C:\Users\Michael\OneDrive
2017-02-19 17:54 - 2016-08-31 22:18 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-19 17:53 - 2016-07-16 06:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2017-02-19 09:48 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-18 09:54 - 2015-12-10 14:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-02-18 09:54 - 2015-09-24 09:54 - 00002640 _____ C:\Users\Public\Desktop\Skype.lnk
2017-02-18 09:54 - 2015-09-24 09:54 - 00000000 ____D C:\ProgramData\Skype
2017-02-18 03:44 - 2016-07-16 11:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-17 16:36 - 2015-10-27 17:06 - 00000000 ____D C:\Users\Michael\AppData\Local\Packages
2017-02-15 22:37 - 2016-05-23 08:37 - 00002272 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-02-15 22:37 - 2016-05-23 08:37 - 00002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-02-14 16:32 - 2015-09-12 11:57 - 00000000 ____D C:\Program Files (x86)\Google
2017-02-14 15:45 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-02-13 09:20 - 2015-09-24 09:54 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-02-06 09:44 - 2015-10-04 11:10 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-01-26 10:51 - 2016-07-16 11:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-01-26 09:39 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-01-23 08:09 - 2016-09-26 15:52 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

==================== Files in the root of some directories =======

2015-09-12 12:56 - 2015-09-12 12:56 - 0000045 _____ () C:\Users\Michael\AppData\Roaming\WB.CFG

Some files in TEMP:
====================
2017-02-19 13:19 - 2016-11-11 10:13 - 1886344 _____ (Microsoft Corporation) C:\Users\Michael\AppData\Local\Temp\dllnt_dump.dll
2016-11-14 07:55 - 2016-11-14 07:55 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_1502316955798436089.dll
2017-01-13 10:50 - 2017-01-13 10:50 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_1946860896116147787.dll
2016-11-09 14:23 - 2016-11-09 14:23 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_2955224762791562019.dll
2017-02-19 17:55 - 2017-02-19 17:55 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_2993282669555816622.dll
2016-12-12 10:33 - 2016-12-12 10:33 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3595117338664693598.dll
2016-11-16 12:07 - 2016-11-16 12:07 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3620258490207969899.dll
2017-01-04 10:59 - 2017-01-04 10:59 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3749789912587404521.dll
2016-12-30 09:04 - 2016-12-30 09:04 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3938284259698373481.dll
2016-11-28 10:36 - 2016-11-28 10:36 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_4095180269104634827.dll
2016-11-21 09:40 - 2016-11-21 09:40 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_4339129235026392215.dll
2017-02-19 17:07 - 2017-02-19 17:07 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_4350576498279731953.dll
2017-02-06 09:29 - 2017-02-06 09:29 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_4888964238262517217.dll
2017-02-06 10:05 - 2017-02-06 10:05 - 0056510 ____N () C:\Users\Michael\AppData\Local\Temp\JNativeHook_5413159699755573671.dll
2016-11-12 08:35 - 2016-11-12 08:35 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_550169103972929519.dll
2016-11-02 07:19 - 2016-11-02 07:19 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6011582628790491166.dll
2016-12-02 07:57 - 2016-12-02 07:57 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6092676241025119789.dll
2017-01-26 09:36 - 2017-01-26 09:36 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6252253867785136471.dll
2017-01-15 11:16 - 2017-01-15 11:16 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6554549432069762015.dll
2016-12-21 15:50 - 2016-12-21 15:50 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6946857114823685689.dll
2016-11-23 11:24 - 2016-11-23 11:24 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_7074007406412860798.dll
2016-11-02 09:37 - 2016-11-02 09:37 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_7549312695266535886.dll
2016-12-23 08:36 - 2016-12-23 08:36 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_843542465262485620.dll
2017-01-27 11:21 - 2017-01-27 11:21 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_8453525500427162863.dll
2016-11-09 15:01 - 2016-11-09 15:01 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_9161306123345145982.dll
2017-02-19 17:22 - 2017-02-19 17:22 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_9219597263256377622.dll
2017-02-06 09:29 - 2017-02-19 17:55 - 0266240 ____N (Hyperic, Inc.) C:\Users\Michael\AppData\Local\Temp\sigar-x86-winnt.dll
2016-11-22 07:44 - 2017-02-13 09:18 - 44048864 _____ (Skype Technologies S.A.) C:\Users\Michael\AppData\Local\Temp\SkypeSetup.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-02-13 11:06

==================== End of FRST.txt ============================

 

[mdp3157]

Hi

On reboot I get the following message:

RegistryController.exe
The program can't start because mfc100u.dll is missing from your computer. Try reinstalling the program to fix this problem.

 

[Broni]

It looks like part of Nuance Power PDF Standard.
Reinstall it.

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST(FRST64) and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

[mdp3157]

Fix result of Farbar Recovery Scan Tool (x64) Version: 19-02-2017
Ran by Michael (22-02-2017 10:16:41) Run:2
Running from C:\Users\Michael\Desktop
Loaded Profiles: Michael & (Available Profiles: Michael & DefaultAppPool)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Task: {42FAD1EE-A0B3-4E00-A35D-8A2887E2316D} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {4963C22B-AB51-4E41-A785-5E6B0275A942} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {765E2CEF-EC61-42C5-9488-4653E2D3AE28} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {8D3EDFFE-81E2-4EDA-8B55-C8A3C4DE8455} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {A5AD278C-7896-4206-A5EA-1EABBD516B23} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {A95047BC-F9CA-43C1-804A-DF813A9CE7AF} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {C906019E-88B0-49D7-A496-C567D0182F75} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {D198FD40-7FF6-4A81-9CFA-C59EDE6617D5} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {E3DCE4D5-772C-45A4-803F-0CC4C4910674} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {E83B7A34-7727-472E-B6C6-3B3555CB9C47} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {F8532A59-D33A-4B41-AC65-564506137E64} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {FA478953-3D15-4498-ABFC-049D2E7C5D75} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
S2 pcCMService; "C:\Program Files (x86)\Common Files\Motive\pcCMService.exe" [X]
S2 pcCMService64; "C:\Program Files\Common Files\Motive\pcCMService.exe" [X]
U3 idsvc; no ImagePath
S3 MREMP50; \??\C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [X]
S3 MREMP50a64; \??\C:\Program Files\Common Files\Motive\MREMP50a64.sys [X]
S3 MRESP50; \??\C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [X]
S3 MRESP50a64; \??\C:\Program Files\Common Files\Motive\MRESP50a64.sys [X]
2015-09-12 12:56 - 2015-09-12 12:56 - 0000045 _____ () C:\Users\Michael\AppData\Roaming\WB.CFG
2017-02-19 13:19 - 2016-11-11 10:13 - 1886344 _____ (Microsoft Corporation) C:\Users\Michael\AppData\Local\Temp\dllnt_dump.dll
2016-11-14 07:55 - 2016-11-14 07:55 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_1502316955798436089.dll
2017-01-13 10:50 - 2017-01-13 10:50 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_1946860896116147787.dll
2016-11-09 14:23 - 2016-11-09 14:23 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_2955224762791562019.dll
2017-02-19 17:55 - 2017-02-19 17:55 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_2993282669555816622.dll
2016-12-12 10:33 - 2016-12-12 10:33 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3595117338664693598.dll
2016-11-16 12:07 - 2016-11-16 12:07 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3620258490207969899.dll
2017-01-04 10:59 - 2017-01-04 10:59 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3749789912587404521.dll
2016-12-30 09:04 - 2016-12-30 09:04 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_3938284259698373481.dll
2016-11-28 10:36 - 2016-11-28 10:36 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_4095180269104634827.dll
2016-11-21 09:40 - 2016-11-21 09:40 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_4339129235026392215.dll
2017-02-19 17:07 - 2017-02-19 17:07 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_4350576498279731953.dll
2017-02-06 09:29 - 2017-02-06 09:29 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_4888964238262517217.dll
2017-02-06 10:05 - 2017-02-06 10:05 - 0056510 ____N () C:\Users\Michael\AppData\Local\Temp\JNativeHook_5413159699755573671.dll
2016-11-12 08:35 - 2016-11-12 08:35 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_550169103972929519.dll
2016-11-02 07:19 - 2016-11-02 07:19 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6011582628790491166.dll
2016-12-02 07:57 - 2016-12-02 07:57 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6092676241025119789.dll
2017-01-26 09:36 - 2017-01-26 09:36 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6252253867785136471.dll
2017-01-15 11:16 - 2017-01-15 11:16 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6554549432069762015.dll
2016-12-21 15:50 - 2016-12-21 15:50 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_6946857114823685689.dll
2016-11-23 11:24 - 2016-11-23 11:24 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_7074007406412860798.dll
2016-11-02 09:37 - 2016-11-02 09:37 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_7549312695266535886.dll
2016-12-23 08:36 - 2016-12-23 08:36 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_843542465262485620.dll
2017-01-27 11:21 - 2017-01-27 11:21 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_8453525500427162863.dll
2016-11-09 15:01 - 2016-11-09 15:01 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_9161306123345145982.dll
2017-02-19 17:22 - 2017-02-19 17:22 - 0056510 _____ () C:\Users\Michael\AppData\Local\Temp\JNativeHook_9219597263256377622.dll
2017-02-06 09:29 - 2017-02-19 17:55 - 0266240 ____N (Hyperic, Inc.) C:\Users\Michael\AppData\Local\Temp\sigar-x86-winnt.dll
2016-11-22 07:44 - 2017-02-13 09:18 - 44048864 _____ (Skype Technologies S.A.) C:\Users\Michael\AppData\Local\Temp\SkypeSetup.exe

*****************

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{42FAD1EE-A0B3-4E00-A35D-8A2887E2316D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{42FAD1EE-A0B3-4E00-A35D-8A2887E2316D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4963C22B-AB51-4E41-A785-5E6B0275A942} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4963C22B-AB51-4E41-A785-5E6B0275A942} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{765E2CEF-EC61-42C5-9488-4653E2D3AE28} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{765E2CEF-EC61-42C5-9488-4653E2D3AE28} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8D3EDFFE-81E2-4EDA-8B55-C8A3C4DE8455} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8D3EDFFE-81E2-4EDA-8B55-C8A3C4DE8455} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A5AD278C-7896-4206-A5EA-1EABBD516B23} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A5AD278C-7896-4206-A5EA-1EABBD516B23} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A95047BC-F9CA-43C1-804A-DF813A9CE7AF} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A95047BC-F9CA-43C1-804A-DF813A9CE7AF} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C906019E-88B0-49D7-A496-C567D0182F75} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C906019E-88B0-49D7-A496-C567D0182F75} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D198FD40-7FF6-4A81-9CFA-C59EDE6617D5} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D198FD40-7FF6-4A81-9CFA-C59EDE6617D5} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E3DCE4D5-772C-45A4-803F-0CC4C4910674} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E3DCE4D5-772C-45A4-803F-0CC4C4910674} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E83B7A34-7727-472E-B6C6-3B3555CB9C47} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E83B7A34-7727-472E-B6C6-3B3555CB9C47} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F8532A59-D33A-4B41-AC65-564506137E64} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F8532A59-D33A-4B41-AC65-564506137E64} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OfficeSoftwareProtectionPlatform\SvcRestartTask => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{FA478953-3D15-4498-ABFC-049D2E7C5D75} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA478953-3D15-4498-ABFC-049D2E7C5D75} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess => key removed successfully
HKLM\SOFTWARE\Policies\Google => key removed successfully
HKLM\System\CurrentControlSet\Services\pcCMService => key removed successfully
pcCMService => service removed successfully
HKLM\System\CurrentControlSet\Services\pcCMService64 => key removed successfully
pcCMService64 => service removed successfully
HKLM\System\CurrentControlSet\Services\idsvc => key removed successfully
idsvc => service removed successfully
HKLM\System\CurrentControlSet\Services\MREMP50 => key removed successfully
MREMP50 => service removed successfully
HKLM\System\CurrentControlSet\Services\MREMP50a64 => key removed successfully
MREMP50a64 => service removed successfully
HKLM\System\CurrentControlSet\Services\MRESP50 => key removed successfully
MRESP50 => service removed successfully
HKLM\System\CurrentControlSet\Services\MRESP50a64 => key removed successfully
MRESP50a64 => service removed successfully
C:\Users\Michael\AppData\Roaming\WB.CFG => moved successfully
C:\Users\Michael\AppData\Local\Temp\dllnt_dump.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_1502316955798436089.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_1946860896116147787.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_2955224762791562019.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_2993282669555816622.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_3595117338664693598.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_3620258490207969899.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_3749789912587404521.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_3938284259698373481.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_4095180269104634827.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_4339129235026392215.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_4350576498279731953.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_4888964238262517217.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_5413159699755573671.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_550169103972929519.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_6011582628790491166.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_6092676241025119789.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_6252253867785136471.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_6554549432069762015.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_6946857114823685689.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_7074007406412860798.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_7549312695266535886.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_843542465262485620.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_8453525500427162863.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_9161306123345145982.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\JNativeHook_9219597263256377622.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\sigar-x86-winnt.dll => moved successfully
C:\Users\Michael\AppData\Local\Temp\SkypeSetup.exe => moved successfully

==== End of Fixlog 10:16:48 ====

 

[Broni]

Last scans...

Download Security Check from here or here and save it to your Desktop.

• Double-click SecurityCheck.exe
• Follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
Make sure the following options are checked:

• Internet Services
• Windows Firewall
• System Restore
• Security Center
• Windows Update
• Windows Defender
• Other Services

Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

• Double click on TFC.exe to run the program.
• Click on Start button to begin cleaning process.
• TFC will close all running programs, and it may ask you to restart computer.

Download Sophos Free Virus Removal Tool and save it to your desktop.

• Double click the icon and select Run
• Click Next
• Select I accept the terms in this license agreement, then click Next twice
• Click Install
• Click Finish to launch the program
• Once the virus database has been updated click Start Scanning
• If any threats are found click Details, then View log file... (bottom left hand corner)
• Copy and paste the results in your reply
• Close the Notepad document, close the Threat Details screen, then click Start cleanup
• Click Exit to close the program