TechSpot

Virus found

By mom26gr8kids
Mar 19, 2015
  1. Trying to do some research on sling tv and streaming live sports I ended up at a bad website (I did not have web of trust on this computer--but I do now). Avast blocked it, but my computer started acting suspicious (website I regularly visit that are safe would cause avast to block it, etc). My computer is running fine, with the exception that occasionally Avast gives me the warning that it has blocked a bad script. However, my Avast scan found a threat:
    Win32:SoftPulse-DX[Adw]

    and SuperAntiSpyware found a PUP:
    Adware.DealPly/Variant

    both items have been quarantined, but I know the whole system will need to be cleaned. Thanks in advance for your help.
     
  2. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
    Ran by Home (administrator) on DAD on 19-03-2015 13:27:22
    Running from C:\Users\Home\Downloads
    Loaded Profiles: Home (Available profiles: Home)
    Platform: Windows 8.1 (X64) OS Language: English (United States)
    Internet Explorer Version 11 (Default browser: IE)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
    (Microsoft Corporation) C:\Windows\System32\dasHost.exe
    (Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
    () C:\Windows\jmesoft\Service.exe
    (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
    (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
    () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Corporation) C:\Windows\System32\rundll32.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
    () C:\Windows\SysWOW64\UMonit64.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
    (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
    (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
    (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
    (Lenovo) C:\Windows\jmesoft\hotkey.exe
    (Dropbox, Inc.) C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe
    () C:\Windows\jmesoft\JME_LOAD.exe
    (CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
    (CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
    (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
    (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
    (Microsoft Corporation) C:\Windows\System32\msiexec.exe
    (LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
    () C:\Program Files (x86)\Lenovo\Lenovo Messenger\NotificationsViewHost.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)
    HKLM-x32\...\Run: [jmekey] => C:\windows\jmesoft\hotkey.exe [118784 2013-07-24] (Lenovo)
    HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-08-16] ()
    HKLM-x32\...\Run: [LVT] => C:\Program Files\Lenovo\LVT\LJYZ.exe [886112 2011-11-24] (Lenovo)
    HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [95192 2013-03-08] (CyberLink Corp.)
    HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
    HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
    HKLM-x32\...\Run: [Lenovo App Shop] => C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\ismagent.exe [156000 2013-07-18] (Intel Corporation)
    HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-07-31] (AVAST Software)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
    HKLM-x32\...\Run: [] => [X]
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
    Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7767832 2014-11-07] (SUPERAntiSpyware)
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [26232152 2015-03-11] (Google)
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\MountPoints2: {cc8cb6f1-6aad-11e3-be6b-806e6f6e6963} - "C:\WINDOWS\system32\RunDLL32.EXE" Shell32.DLL,ShellExec_RunDLL E:\The_Mystery_of_History_Volume_III_Companion_Guide.pdf
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
    ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
    Startup: C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
    ShortcutTarget: Dropbox.lnk -> C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=AV01
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://home.lenovo.com
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://home.lenovo.com
    SearchScopes: HKLM-x32 -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
    SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
    SearchScopes: HKU\S-1-5-21-1634595136-4235292695-661162807-1001 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-06-14] (Oracle Corporation)
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-07-16] (AVAST Software)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-06-14] (Oracle Corporation)
    BHO-x32: No Name -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> No File
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-05] (Oracle Corporation)
    BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-07-16] (AVAST Software)
    BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-05] (Oracle Corporation)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

    FireFox:
    ========
    FF ProfilePath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\b89dudjq.default
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-05] ()
    FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-06-14] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-06-14] (Oracle Corporation)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] ()
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)
    FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-05] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-05] (Oracle Corporation)
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
    FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll [2013-08-17] (Nitro PDF)
    FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2014-07-03] (Pando Networks)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-1634595136-4235292695-661162807-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Home\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-02-20] (Unity Technologies ApS)
    FF Plugin HKU\S-1-5-21-1634595136-4235292695-661162807-1001: intel.com/AppUp -> C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp.dll [2013-07-18] (Intel)
    FF Plugin HKU\S-1-5-21-1634595136-4235292695-661162807-1001: intel.com/AppUpx64 -> C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp_x64.dll [2013-07-18] (Intel)
    FF Plugin HKU\S-1-5-21-1634595136-4235292695-661162807-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2014-07-03] (Pando Networks)
    FF Extension: WOT - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\b89dudjq.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-03-18]
    FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-30]
    FF HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

    Chrome:
    =======
    CHR HomePage: Default -> hxxp://www.google.com/
    CHR StartupUrls: Default -> "https://www.yahoo.com/?fr=hp-avast&type=agc511"
    CHR DefaultSearchKeyword: Default -> trovi.search
    CHR DefaultSearchURL: Default -> http://www.trovi.com/Results.aspx?g...-4D62-BCC5-2D55D80CEFBB&q={searchTerms}&SSPV=
    CHR DefaultSuggestURL: Default ->
    CHR Profile: C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Google Docs) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-29]
    CHR Extension: (Google Drive) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-29]
    CHR Extension: (WOT) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-05-01]
    CHR Extension: (YouTube) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-29]
    CHR Extension: (Google Search) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-29]
    CHR Extension: (Avast Online Security) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-30]
    CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
    CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2014-11-30]
    CHR Extension: (Google Wallet) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-29]
    CHR Extension: (Gmail) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-29]
    CHR HKU\S-1-5-21-1634595136-4235292695-661162807-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - http://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswwebrepchrome-sp.crx [2014-08-04]
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-16]

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-09-10] (SUPERAntiSpyware.com)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-16] (AVAST Software)
    R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [7618952 2015-01-30] (COMODO)
    S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2265304 2015-02-05] (COMODO)
    S3 EasyAntiCheat; C:\WINDOWS\SysWOW64\EasyAntiCheat.exe [237864 2015-03-02] (EasyAntiCheat Ltd)
    R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89352 2014-09-15] (Hewlett-Packard Company)
    R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
    S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
    R2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-08-16] () [File not signed]
    R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584632 2015-03-06] (LENOVO INCORPORATED.)
    S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [1663880 2014-05-06] ()
    R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-08-17] (Nitro PDF Software)
    R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2013-05-14] ()
    S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-03-10] (Microsoft Corporation)
    S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-03-10] (Microsoft Corporation)

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-16] ()
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-16] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-16] (AVAST Software)
    R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-16] ()
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-26] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-16] (AVAST Software)
    R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-16] (AVAST Software)
    R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-16] ()
    R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [20184 2015-01-30] (COMODO)
    R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [807568 2015-01-30] (COMODO)
    R1 cmdhlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [35080 2015-01-30] (COMODO)
    R3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [103656 2013-10-21] (GenesysLogic)
    R1 inspect; C:\Windows\system32\DRIVERS\inspect.sys [126208 2015-01-30] (COMODO)
    R0 MBI; C:\Windows\System32\drivers\MBI.sys [27904 2013-06-22] (Intel Corporation)
    R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
    S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-03-10] (Microsoft Corporation)
    S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
    S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-09-24] (Microsoft Corporation)

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-03-19 13:27 - 2015-03-19 13:27 - 00020390 _____ () C:\Users\Home\Downloads\FRST.txt
    2015-03-19 13:26 - 2015-03-19 13:27 - 00000000 ____D () C:\FRST
    2015-03-19 13:25 - 2015-03-19 13:25 - 02095616 _____ (Farbar) C:\Users\Home\Downloads\FRST64.exe
    2015-03-10 14:32 - 2015-03-10 14:32 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe
    2015-03-10 14:32 - 2015-03-10 14:32 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\calc.exe
    2015-03-10 14:32 - 2015-03-10 14:32 - 00723072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
    2015-03-10 14:32 - 2015-03-10 14:32 - 00560392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
    2015-03-10 14:32 - 2015-03-10 14:32 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
    2015-03-10 14:32 - 2015-03-10 14:32 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
    2015-03-10 14:32 - 2015-03-10 14:32 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
    2015-03-10 14:32 - 2015-03-10 14:32 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll
    2015-03-10 14:32 - 2015-03-10 14:32 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
    2015-03-10 14:31 - 2015-03-10 14:31 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\photowiz.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\photowiz.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\compstui.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\findnetprinters.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\printui.exe
    2015-03-10 14:31 - 2015-03-10 14:31 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\printui.exe
    2015-03-10 14:31 - 2015-03-10 14:31 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\findnetprinters.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll
    2015-03-10 14:31 - 2015-02-06 17:09 - 00396419 _____ () C:\WINDOWS\system32\ApnDatabase.xml
    2015-03-10 14:30 - 2015-03-10 14:30 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
    2015-03-10 14:30 - 2015-03-10 14:30 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01113920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
    2015-03-10 14:30 - 2015-03-10 14:30 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys
    2015-03-10 14:30 - 2015-03-10 14:30 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe
    2015-03-10 14:30 - 2015-03-10 14:30 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
    2015-03-10 14:30 - 2015-03-10 14:30 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll
    2015-03-10 14:30 - 2015-02-05 19:28 - 02257408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
    2015-03-10 14:29 - 2015-03-10 14:30 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
    2015-03-10 14:29 - 2015-03-10 14:29 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
    2015-03-10 14:29 - 2015-03-10 14:29 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappprxy.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe
    2015-03-10 14:29 - 2015-03-10 14:29 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rfxvmt.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00027456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys
    2015-03-10 14:29 - 2015-01-29 19:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll
    2015-03-10 14:28 - 2015-03-10 14:28 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
    2015-03-10 14:28 - 2015-03-10 14:28 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
    2015-03-10 14:28 - 2015-03-10 14:28 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
    2015-03-10 14:28 - 2015-01-20 23:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
    2015-03-10 14:27 - 2015-03-10 14:27 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
    2015-03-10 14:27 - 2015-03-10 14:27 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
    2015-03-10 14:25 - 2015-03-10 14:25 - 01090048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
    2015-03-10 14:25 - 2015-03-10 14:25 - 00791040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
    2015-03-09 20:46 - 2015-03-09 20:46 - 00000000 ____D () C:\ProgramData\HipSoft
    2015-03-06 00:07 - 2015-03-06 00:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
    2015-03-02 17:03 - 2015-03-02 17:00 - 00237864 _____ (EasyAntiCheat Ltd) C:\WINDOWS\SysWOW64\EasyAntiCheat.exe
    2015-03-02 16:55 - 2015-03-02 16:55 - 00000000 ____D () C:\Users\Home\AppData\Local\Steam
    2015-02-24 18:59 - 2015-02-24 18:59 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
    2015-02-24 18:59 - 2015-02-24 18:59 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
    2015-02-24 18:59 - 2015-02-24 18:59 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
    2015-02-24 18:59 - 2015-02-24 18:59 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
    2015-02-24 18:59 - 2014-12-13 15:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls
    2015-02-24 18:59 - 2014-12-13 15:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls
    2015-02-17 15:26 - 2015-02-17 15:26 - 01217184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FM20.DLL

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-03-19 13:25 - 2014-07-16 15:50 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
    2015-03-19 13:24 - 2013-12-21 20:21 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Lenovo
    2015-03-19 13:21 - 2014-09-24 21:42 - 00000000 ___RD () C:\Users\Home\Google Drive
    2015-03-19 13:21 - 2014-04-30 12:08 - 00000000 ___RD () C:\Users\Home\Dropbox
    2015-03-19 13:21 - 2014-04-30 08:45 - 00000000 ____D () C:\Users\Home\AppData\Roaming\Dropbox
    2015-03-19 13:20 - 2014-04-29 23:03 - 00000910 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
    2015-03-19 13:20 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\system32\sru
    2015-03-19 11:33 - 2014-10-20 10:45 - 01449539 _____ () C:\WINDOWS\WindowsUpdate.log
    2015-03-19 11:33 - 2013-08-22 08:46 - 00342395 _____ () C:\WINDOWS\setupact.log
    2015-03-19 08:31 - 2014-04-29 23:03 - 00000914 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
    2015-03-18 11:40 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\rescache
    2015-03-18 11:02 - 2014-04-29 22:09 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1634595136-4235292695-661162807-1001
    2015-03-18 10:57 - 2014-09-24 01:15 - 01160678 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
    2015-03-18 10:50 - 2013-08-22 08:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
    2015-03-18 10:50 - 2013-08-22 07:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
    2015-03-18 10:13 - 2014-04-30 12:08 - 00001071 _____ () C:\Users\Home\Desktop\Dropbox.lnk
    2015-03-18 10:13 - 2014-04-30 08:48 - 00000000 ____D () C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
    2015-03-18 10:09 - 2014-09-24 01:03 - 00024486 _____ () C:\WINDOWS\PFRO.log
    2015-03-18 10:09 - 2014-06-02 11:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
    2015-03-18 10:09 - 2013-08-22 08:44 - 00422168 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ___RD () C:\WINDOWS\ToastData
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\WinStore
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ____D () C:\Program Files\Windows Defender
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
    2015-03-18 07:31 - 2014-05-08 08:57 - 00000000 ____D () C:\Users\Home\Desktop\Full Quiver Contracting
    2015-03-13 22:35 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
    2015-03-13 12:35 - 2014-04-29 23:15 - 00002214 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
    2015-03-11 16:34 - 2014-09-24 21:38 - 00002069 _____ () C:\Users\Public\Desktop\Google Slides.lnk
    2015-03-11 16:34 - 2014-09-24 21:38 - 00002067 _____ () C:\Users\Public\Desktop\Google Sheets.lnk
    2015-03-11 16:34 - 2014-09-24 21:38 - 00002057 _____ () C:\Users\Public\Desktop\Google Docs.lnk
    2015-03-11 16:34 - 2014-09-24 21:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
    2015-03-11 15:34 - 2014-07-03 17:36 - 00000000 ____D () C:\Users\Home\AppData\Local\PMB Files
    2015-03-11 15:34 - 2014-07-03 17:35 - 00000000 ____D () C:\ProgramData\PMB Files
    2015-03-10 15:16 - 2014-04-30 13:47 - 00000000 ____D () C:\ProgramData\Microsoft Help
    2015-03-10 15:16 - 2012-07-26 01:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
    2015-03-10 15:04 - 2014-04-30 02:17 - 00000000 ____D () C:\WINDOWS\system32\MRT
    2015-03-10 14:55 - 2014-04-30 02:17 - 122905848 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
    2015-03-10 14:29 - 2015-01-10 14:38 - 00792032 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
    2015-03-10 14:29 - 2015-01-10 14:38 - 00178144 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
    2015-03-10 10:51 - 2014-04-30 01:46 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
    2015-03-09 20:47 - 2013-12-21 20:30 - 00000000 ____D () C:\ProgramData\Temp
    2015-03-03 08:22 - 2014-10-20 10:23 - 00000000 ____D () C:\Users\Home
    2015-03-02 17:03 - 2014-08-10 18:14 - 00000000 ____D () C:\Program Files (x86)\Steam

    ==================== Files in the root of some directories =======

    2014-05-04 18:22 - 2014-05-17 00:22 - 0000034 _____ () C:\Users\Home\AppData\Roaming\WB.CFG
    2014-04-29 22:01 - 2014-06-05 09:53 - 0000193 _____ () C:\Users\Home\AppData\Local\RegisteredPackageInformation.xml
    2014-04-30 15:42 - 2014-04-30 15:42 - 0000057 _____ () C:\ProgramData\Ament.ini

    Some content of TEMP:
    ====================
    C:\Users\Home\AppData\Local\Temp\COMAP.EXE
    C:\Users\Home\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzdxesr.dll
    C:\Users\Home\AppData\Local\Temp\jre-8u40-windows-au.exe


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2015-03-18 11:02

    ==================== End Of Log ============================
     
  3. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
    Ran by Home at 2015-03-19 13:29:17
    Running from C:\Users\Home\Downloads
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    AS: Comodo Defense+ (Disabled - Up to date) {4BDD6856-AF0D-06BD-38AB-8A0FE39860CC}
    FW: COMODO Firewall (Enabled) {C8870897-C358-086B-2944-184866CC6D0A}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 16.0.0.245 - Adobe Systems Incorporated)
    Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
    Dependency Package Update (Version: 1.6.36.00 - Lenovo Inc.) Hidden
    Dependency Package Update (x32 Version: 1.6.32.00 - Lenovo Group Limited) Hidden
    Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve)
    Dropbox (HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\Dropbox) (Version: 3.2.9 - Dropbox, Inc.)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.89 - Google Inc.)
    Google Drive (HKLM-x32\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
    HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
    HP Support Solutions Framework (HKLM-x32\...\{44157EB3-D8D0-4BB1-B0F5-AD2C38814ED1}) (Version: 11.51.0027 - Hewlett-Packard Company)
    HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: - )
    HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
    Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
    Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
    Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
    Mozilla Firefox 36.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 en-US)) (Version: 36.0.1 - Mozilla)
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6743 - Realtek Semiconductor Corp.)
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
    Unity Web Player (HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\UnityWebPlayer) (Version: - Unity Technologies ApS)

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{9E506282-69D3-5ABA-9C1D-15994B37F4AC}\InprocServer32 -> C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp_x64.dll (Intel)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{9E506282-69D3-5ABA-9C1D-15994B37F4AD}\InprocServer32 -> C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp_x64.dll (Intel)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

    ==================== Restore Points =========================

    03-03-2015 11:15:36 Windows Update
    10-03-2015 14:46:30 Windows Update
    18-03-2015 11:35:10 Scheduled Checkpoint

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2012-07-25 23:26 - 2014-05-20 17:18 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
    127.0.0.1 localhost

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {038F647A-BEFC-4279-BE4D-A2D06B84B67E} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2014-05-06] (Lenovo)
    Task: {256E6778-4A49-423E-8B78-DD58D5832A4B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-29] (Google Inc.)
    Task: {467B75C1-52B1-47DE-8C22-C3ACCD6587D5} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-05] (COMODO)
    Task: {497A5723-69E9-44F8-AF71-CD08F85F073D} - System32\Tasks\UMonitor Task => C:\windows\SysWOW64\UMonit64.exe [2013-10-25] ()
    Task: {64C67887-7BBF-47A5-9492-07D77B173EE6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-16] (AVAST Software)
    Task: {9707D51D-67FD-45D2-AAA3-C7F5BCB03EA7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-29] (Google Inc.)
    Task: {9ADCB6B7-DDFC-4A7E-A851-ECFFCD9EEF47} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
    Task: {B2F0D9F0-C0EB-4F66-92FA-6210D2854E5C} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\iMController\AutoUpdate.exe [2015-03-06] ()
    Task: {D56BD20E-1A57-4134-89EA-63D31211EA88} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-03-10] (Microsoft Corporation)
    Task: {E139710C-737D-4EC3-9C9C-6C3811999D8B} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-05-06] ()
    Task: {E854EC01-66F4-4595-9ED5-E2AC3730A614} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-05] (COMODO)
    Task: {F17BFED7-7AF4-4BC5-BAA6-017FA950D1D4} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-02-05] (COMODO)
    Task: {F38486FB-4E2E-474B-B2A1-B03D26502F36} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-05-06] (Lenovo)
    Task: {F42DA099-19FB-4166-98C5-7FD899A99B2E} - System32\Tasks\Lenovo\StartLenovoMessenger => C:\Program Files (x86)\Lenovo\Lenovo Messenger\NotificationsViewHost.exe [2014-08-21] ()
    Task: {F90B3E08-4A55-4F51-8A4B-B7BD7F1C5949} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
    Task: {FA026FE9-9E3A-4EEE-8570-26FA781C113A} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-02-05] (COMODO)
    Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) ==============

    2013-12-21 20:18 - 2011-08-16 22:46 - 00032768 _____ () C:\Windows\jmesoft\Service.exe
    2013-12-21 20:39 - 2013-05-14 12:53 - 00390632 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
    2013-12-21 20:18 - 2013-10-25 03:23 - 00053248 _____ () C:\windows\SysWOW64\UMonit64.exe
    2013-12-21 20:18 - 2011-08-16 22:46 - 00024576 _____ () C:\Windows\jmesoft\JME_LOAD.exe
    2014-08-21 17:59 - 2014-08-21 17:59 - 00462592 _____ () C:\Program Files (x86)\Lenovo\Lenovo Messenger\NotificationsViewHost.exe
    2014-07-16 10:20 - 2014-07-16 10:20 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
    2015-03-18 10:10 - 2015-03-18 10:10 - 02922496 _____ () C:\Program Files\AVAST Software\Avast\defs\15031800\algo.dll
    2015-03-19 13:29 - 2015-03-19 13:29 - 02922496 _____ () C:\Program Files\AVAST Software\Avast\defs\15031900\algo.dll
    2015-03-19 13:21 - 2015-03-19 13:21 - 00098816 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32api.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00110080 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\pywintypes27.dll
    2015-03-19 13:21 - 2015-03-19 13:21 - 00364544 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\pythoncom27.dll
    2015-03-19 13:21 - 2015-03-19 13:21 - 00045568 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\_socket.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 01161216 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\_ssl.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00320512 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32com.shell.shell.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00713216 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\_hashlib.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 01175040 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\wx._core_.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00805888 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\wx._gdi_.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00811008 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\wx._windows_.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 01062400 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\wx._controls_.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00735232 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\wx._misc_.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00682496 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\pysqlite2._sqlite.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00128512 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\_elementtree.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00127488 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\pyexpat.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00087552 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\_ctypes.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00119808 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32file.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00108544 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32security.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00007168 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\hashobjs_ext.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00167936 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32gui.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00018432 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32event.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00038912 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32inet.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00011264 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32crypt.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00070656 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\wx._html2.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00027136 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\_multiprocessing.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00020480 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\_yappi.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00035840 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32process.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00686080 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\unicodedata.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00122368 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\wx._wizard.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00024064 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32pipe.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00010240 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\select.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00025600 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32pdh.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00525640 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\windows._lib_cacheinvalidation.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00017408 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32profile.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00022528 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\win32ts.pyd
    2015-03-19 13:21 - 2015-03-19 13:21 - 00078336 _____ () C:\Users\Home\AppData\Local\Temp\_MEI51522\wx._animate.pyd
    2015-03-04 16:08 - 2015-03-04 16:08 - 00750080 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\libGLESv2.dll
    2015-03-19 13:21 - 2015-03-19 13:21 - 00043008 _____ () c:\users\home\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzdxesr.dll
    2015-03-04 16:08 - 2015-03-04 16:08 - 00047616 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\libEGL.dll
    2015-03-04 16:08 - 2015-03-04 16:08 - 00865280 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
    2015-03-04 16:07 - 2015-03-04 16:07 - 00200704 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
    2013-12-21 20:18 - 2011-05-17 15:27 - 00028672 _____ () C:\Windows\jmesoft\hidhook.dll
    2009-12-04 18:59 - 2009-12-04 18:59 - 00619816 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
    2009-12-04 19:04 - 2009-12-04 19:04 - 00013096 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
    2014-07-16 10:20 - 2014-07-16 10:20 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

    AlternateDataStreams: C:\WINDOWS\explorer.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\actxprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\adtschema.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\aeinv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\aepdu.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\aepic.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\appinfo.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\appraiser.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\atlthunk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\atmfd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\atmlib.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\audiodg.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AudioEndpointBuilder.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AudioEng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AUDIOKSE.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AudioSes.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\audiosrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\authui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\calc.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\certcli.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ci.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\compstui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\consent.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\crypt32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_47.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\DafPrintProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dciman32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\DeviceSetupStatusProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\devinv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dpapisrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dxtmsft.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dxtrans.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eappcfg.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eappgnui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eapphost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eappprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\EncDump.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Faultrep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\findnetprinters.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\fontsub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\FXSAPI.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\FXSCOMEX.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\generaltel.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\GlobCollationHost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\hlink.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ie4uinit.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\IEAdvpack.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieapfltr.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iedkcs32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieetwcollector.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieetwproxystub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieframe.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iepeers.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iernonce.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iertutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iesetup.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iesysprep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieUnatt.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iexpress.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\imgutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\inetcomm.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\inetcpl.cpl:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\inseng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\invagent.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\JavaScriptCollectionAgent.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jscript9.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jscript9diag.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jsproxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\kerberos.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\licmgr10.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\localspl.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\LockScreenContentServer.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\lpk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\lsasrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mfc42.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mfc42u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\MFMediaEngine.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mfmp4srcsnk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\MrmCoreR.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msaudite.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msfeeds.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msfeedsbs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msfeedssync.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msftedit.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mshta.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mshtml.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\MshtmlDac.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mshtmled.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msihnd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msrating.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msxml3.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ncryptsslp.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ncsi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\nlaapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\nlasvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ntdll.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ntoskrnl.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ntvdm64.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\occache.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\oleaut32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\packager.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\photowiz.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\pku2u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\pngfilt.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\poqexec.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\printui.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\prnntfy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\profsvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\puiapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\puiobj.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\rdpcorets.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\rdpudd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\rfxvmt.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\scesrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\schannel.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\SHCore.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\shell32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\StorageContextHandler.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\tdc.ocx:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\TSWbPrxy.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\twinui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ubpm.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\untfs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\url.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\urlmon.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\user32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\vbscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\webcheck.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wer.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WerFault.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WerFaultSecure.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wermgr.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wextract.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\win32k.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\win32spl.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Windows.Globalization.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WindowsCodecs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wininet.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\winshfhc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WMPhoto.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wow64.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wow64cpu.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WSCollect.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WsmSvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WSReset.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WSShared.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\actxprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\adtschema.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\atlthunk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\atmfd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\atmlib.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioEng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\AUDIOKSE.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioSes.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\authui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\calc.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\certcli.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\compstui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\crypt32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_47.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\DafPrintProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dciman32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dwmcore.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtmsft.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtrans.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eapp3hst.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eappcfg.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eappgnui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eapphost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eappprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\explorer.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Faultrep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\findnetprinters.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerApp.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\fontsub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSAPI.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\GlobCollationHost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\hlink.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\IEAdvpack.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieapfltr.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iedkcs32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieetwproxystub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieframe.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iepeers.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iernonce.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iertutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iesetup.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iesysprep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieUnatt.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iexpress.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\imgutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcomm.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcpl.cpl:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\inseng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\instnm.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9diag.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jsproxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\kerberos.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\licmgr10.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\lpk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mfc42.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mfc42u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\MFMediaEngine.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\MrmCoreR.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msaudite.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msctf.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeeds.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeedsbs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeedssync.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msftedit.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mshta.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtml.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\MshtmlDac.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtmled.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msihnd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msrating.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msxml3.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ncryptsslp.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\nlaapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ntdll.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ntvdm64.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\occache.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\oleaut32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\packager.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\photowiz.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\pku2u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\pngfilt.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\poqexec.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\printui.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\prnntfy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\puiapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\puiobj.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\scesrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\schannel.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\setup16.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\SHCore.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\shell32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\StorageContextHandler.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\tdc.ocx:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\untfs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\url.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\urlmon.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\user.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\user32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\vbscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\webcheck.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wer.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFault.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFaultSecure.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wermgr.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wextract.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Globalization.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WindowsCodecs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wininet.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\winshfhc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WMPhoto.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wow32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmSvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WSShared.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\ahcache.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\cng.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\dumpsd.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidbth.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\intelpep.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksecpkg.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxdav.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndis.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\netio.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\pdc.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdpvideominiport.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdbus.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\tcpip.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\USBSTOR.SYS:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdBoot.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdFilter.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdNisDrv.sys:$CmdTcID
    AlternateDataStreams: C:\ProgramData\Temp:13AA281B
    AlternateDataStreams: C:\ProgramData\Temp:2CB9631F
    AlternateDataStreams: C:\ProgramData\Temp:C86B29EB
    AlternateDataStreams: C:\ProgramData\Temp:DDEB08FD
    AlternateDataStreams: C:\Users\Home\Desktop\TechnicLauncher.exe:$CmdTcID
    AlternateDataStreams: C:\Users\Home\Downloads\FRST64.exe:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\InfoGuideCentral-NorthCombo-2015-2016.pdf:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Jan 20 -2015 - Home School Day Registration Form.doc:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\KSP_demo_win.zip:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Running and Starting a Successful Book club.docx:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Running Record.docx:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Spring 2015 Audition Packet.pdf:$CmdZnID

    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


    ==================== EXE Association (whitelisted) ===============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Home\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
    DNS Servers: 192.168.1.1

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)


    ==================== Accounts: =============================

    Administrator (S-1-5-21-1634595136-4235292695-661162807-500 - Administrator - Disabled)
    Guest (S-1-5-21-1634595136-4235292695-661162807-501 - Limited - Disabled)
    Home (S-1-5-21-1634595136-4235292695-661162807-1001 - Administrator - Enabled) => C:\Users\Home
    HomeGroupUser$ (S-1-5-21-1634595136-4235292695-661162807-1005 - Limited - Enabled)

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (03/18/2015 10:47:47 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: plugin-container.exe, version: 36.0.1.5542, time stamp: 0x54f851c0
    Faulting module name: mozalloc.dll, version: 36.0.1.5542, time stamp: 0x54f8437e
    Exception code: 0x80000003
    Fault offset: 0x00001e02
    Faulting process id: 0x1020
    Faulting application start time: 0xplugin-container.exe0
    Faulting application path: plugin-container.exe1
    Faulting module path: plugin-container.exe2
    Report Id: plugin-container.exe3
    Faulting package full name: plugin-container.exe4
    Faulting package-relative application ID: plugin-container.exe5

    Error: (03/18/2015 10:09:58 AM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
    Description: Event provider ProtectionManagement attempted to register query "select * from MSFT_MpEvent" whose target class "MSFT_MpEvent" in //./root/microsoft/protectionManagement namespace does not exist. The query will be ignored.

    Error: (03/18/2015 10:09:58 AM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
    Description: Event provider attempted to register query "select * from MSFT_MpEvent" whose target class "MSFT_MpEvent" in //./root/microsoft/protectionManagement namespace does not exist. The query will be ignored.

    Error: (03/17/2015 11:36:26 AM) (Source: Perflib) (EventID: 1015) (User: )
    Description: PerfProcC:\WINDOWS\System32\perfproc.dll0

    Error: (03/13/2015 01:31:58 PM) (Source: Perflib) (EventID: 1015) (User: )
    Description: PerfProcC:\WINDOWS\System32\perfproc.dll0

    Error: (03/08/2015 05:55:34 PM) (Source: Perflib) (EventID: 1015) (User: )
    Description: PerfProcC:\WINDOWS\System32\perfproc.dll0

    Error: (03/03/2015 08:45:59 AM) (Source: Perflib) (EventID: 1015) (User: )
    Description: PerfProcC:\WINDOWS\System32\perfproc.dll0

    Error: (03/01/2015 04:21:56 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: FlashPlayerPlugin_16_0_0_305.exe, version: 16.0.0.305, time stamp: 0x54cff379
    Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
    Exception code: 0xc0000005
    Fault offset: 0x02867310
    Faulting process id: 0x3450
    Faulting application start time: 0xFlashPlayerPlugin_16_0_0_305.exe0
    Faulting application path: FlashPlayerPlugin_16_0_0_305.exe1
    Faulting module path: FlashPlayerPlugin_16_0_0_305.exe2
    Report Id: FlashPlayerPlugin_16_0_0_305.exe3
    Faulting package full name: FlashPlayerPlugin_16_0_0_305.exe4
    Faulting package-relative application ID: FlashPlayerPlugin_16_0_0_305.exe5

    Error: (02/28/2015 04:10:18 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: plugin-container.exe, version: 35.0.1.5500, time stamp: 0x54c1f9f3
    Faulting module name: mozalloc.dll, version: 35.0.1.5500, time stamp: 0x54c1f224
    Exception code: 0x80000003
    Fault offset: 0x00001425
    Faulting process id: 0xc0c
    Faulting application start time: 0xplugin-container.exe0
    Faulting application path: plugin-container.exe1
    Faulting module path: plugin-container.exe2
    Report Id: plugin-container.exe3
    Faulting package full name: plugin-container.exe4
    Faulting package-relative application ID: plugin-container.exe5

    Error: (02/28/2015 02:08:25 AM) (Source: Perflib) (EventID: 1015) (User: )
    Description: PerfProcC:\WINDOWS\System32\perfproc.dll0


    System errors:
    =============
    Error: (03/19/2015 01:24:39 PM) (Source: DCOM) (EventID: 10010) (User: Dad)
    Description: {CC6F4D12-8575-4CFF-9455-CF5774AEB13B}

    Error: (03/19/2015 01:24:08 PM) (Source: DCOM) (EventID: 10010) (User: Dad)
    Description: {CC6F4D12-8575-4CFF-9455-CF5774AEB13B}

    Error: (03/19/2015 01:23:37 PM) (Source: DCOM) (EventID: 10010) (User: Dad)
    Description: {CC6F4D12-8575-4CFF-9455-CF5774AEB13B}

    Error: (03/19/2015 01:23:06 PM) (Source: DCOM) (EventID: 10010) (User: Dad)
    Description: {CC6F4D12-8575-4CFF-9455-CF5774AEB13B}

    Error: (03/19/2015 08:32:10 AM) (Source: DCOM) (EventID: 10010) (User: Dad)
    Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

    Error: (03/19/2015 08:31:39 AM) (Source: DCOM) (EventID: 10010) (User: Dad)
    Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

    Error: (03/18/2015 11:03:31 AM) (Source: DCOM) (EventID: 10010) (User: Dad)
    Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

    Error: (03/18/2015 11:03:00 AM) (Source: DCOM) (EventID: 10010) (User: Dad)
    Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

    Error: (03/18/2015 10:50:32 AM) (Source: GeneStor) (EventID: 0) (User: )
    Description: GeneStor driver startedGeneStor driver started (2)

    Error: (03/18/2015 10:14:10 AM) (Source: DCOM) (EventID: 10010) (User: Dad)
    Description: {CC6F4D12-8575-4CFF-9455-CF5774AEB13B}


    Microsoft Office Sessions:
    =========================
    Error: (03/18/2015 10:47:47 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe36.0.1.554254f851c0mozalloc.dll36.0.1.554254f8437e8000000300001e02102001d061980515c5f9C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll8154e4e9-cd8e-11e4-beb2-c03fd533053c

    Error: (03/18/2015 10:09:58 AM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
    Description: ProtectionManagementselect * from MSFT_MpEventMSFT_MpEvent//./root/microsoft/protectionManagement

    Error: (03/18/2015 10:09:58 AM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
    Description: select * from MSFT_MpEventMSFT_MpEvent//./root/microsoft/protectionManagement

    Error: (03/17/2015 11:36:26 AM) (Source: Perflib) (EventID: 1015) (User: )
    Description: PerfProcC:\WINDOWS\System32\perfproc.dll0

    Error: (03/13/2015 01:31:58 PM) (Source: Perflib) (EventID: 1015) (User: )
    Description: PerfProcC:\WINDOWS\System32\perfproc.dll0

    Error: (03/08/2015 05:55:34 PM) (Source: Perflib) (EventID: 1015) (User: )
    Description: PerfProcC:\WINDOWS\System32\perfproc.dll0

    Error: (03/03/2015 08:45:59 AM) (Source: Perflib) (EventID: 1015) (User: )
    Description: PerfProcC:\WINDOWS\System32\perfproc.dll0

    Error: (03/01/2015 04:21:56 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: FlashPlayerPlugin_16_0_0_305.exe16.0.0.30554cff379unknown0.0.0.000000000c000000502867310345001d053a5dcc7e057C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exeunknownc928a053-bffc-11e4-beae-c03fd533053c

    Error: (02/28/2015 04:10:18 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f2248000000300001425c0c01d0521fb3d8db4bC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll93cc1bbe-bf96-11e4-beae-c03fd533053c

    Error: (02/28/2015 02:08:25 AM) (Source: Perflib) (EventID: 1015) (User: )
    Description: PerfProcC:\WINDOWS\System32\perfproc.dll0


    CodeIntegrity Errors:
    ===================================
    Date: 2015-03-18 22:39:22.964
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-03-18 10:52:27.397
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-03-18 10:14:42.143
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-03-18 07:33:31.460
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-03-17 20:20:15.628
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-03-17 18:38:22.383
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-03-17 14:58:59.849
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-03-17 14:38:03.824
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-03-17 11:22:22.381
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-03-16 10:31:10.328
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: Intel(R) Pentium(R) CPU J2850 @ 2.41GHz
    Percentage of memory in use: 41%
    Total physical RAM: 3973.38 MB
    Available physical RAM: 2318.09 MB
    Total Pagefile: 5061.38 MB
    Available Pagefile: 2752.06 MB
    Total Virtual: 131072 MB
    Available Virtual: 131071.8 MB

    ==================== Drives ================================

    Drive c: (Windows8_OS) (Fixed) (Total:904.81 GB) (Free:839.56 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    Drive e: (The Mystery of History Volume II) (CDROM) (Total:0.05 GB) (Free:0 GB) UDF

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 931.5 GB) (Disk ID: 156639CC)

    Partition: GPT Partition Type.

    ==================== End Of Log ============================
     
  4. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Just an update, shortly after I posted the logs the home page on my computer changed.
     
  5. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ==================================

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
    NOTE. If you already have MBAM 2.0 installed scroll down.

    • Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to the following:
      • Launch Malwarebytes Anti-Malware
      • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
    • Click Finish.
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.


    If you already have MBAM 2.0 installed:

    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.

    How to get logs:
    (Export log to save as txt)


    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Export'.
    • Click 'Text file (*.txt)'
    • In the Save File dialog box which appears, click on Desktop.
    • In the File name: box type a name for your scan log.
    • A message box named 'File Saved' should appear stating "Your file has been successfully exported".
    • Click Ok
    • Attach that saved log to your next reply.


    (Copy to clipboard for pasting into forum replies or tickets)

    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Copy to Clipboard'
    • Paste the contents of the clipboard into your reply.

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
     
  6. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    RogueKiller V10.5.6.0 [Mar 21 2015] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 8.1 (6.3.9200 ) 64 bits version
    Started in : Normal mode
    User : Home [Administrator]
    Started from : C:\Users\Home\Downloads\RogueKiller.exe
    Mode : Delete -- Date : 03/21/2015 18:13:14

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 8 ¤¤¤
    [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 -> Not selected
    [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{178A4648-72B6-4DB3-A9E9-EEA62875D728} | DhcpNameServer : 192.168.0.1 205.171.2.25 [UNITED STATES (US)] -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{178A4648-72B6-4DB3-A9E9-EEA62875D728} | DhcpNameServer : 192.168.0.1 205.171.2.25 [UNITED STATES (US)] -> Not selected
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 1 ¤¤¤
    [C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

    ¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: WDC WD10EZEX-08M2NA0 +++++
    --- User ---
    [MBR] a2b3f77455cfd29ccccbd3f5529e7b92
    [BSP] 3945368544f779505ca971688a5e94be : Empty MBR Code
    Partition table:
    0 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 2048 | Size: 1000 MB
    1 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2050048 | Size: 260 MB
    2 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 2582528 | Size: 500 MB
    3 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 3606528 | Size: 128 MB
    4 - Basic data partition | Offset (sectors): 3868672 | Size: 926530 MB
    5 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 1901402112 | Size: 450 MB
    6 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 1902323712 | Size: 25000 MB
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive1: HP Officejet 6700 USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )


    ============================================
    RKreport_SCN_03212015_180834.log
     
  7. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 3/21/2015
    Scan Time: 7:21:54 PM
    Logfile:
    Administrator: Yes

    Version: 2.01.4.1018
    Malware Database: v2015.03.22.01
    Rootkit Database: v2015.02.25.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 8.1
    CPU: x64
    File System: NTFS
    User: Home

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 377054
    Time Elapsed: 19 min, 15 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 2
    PUP.Optional.InstallCore.A, HKU\S-1-5-21-1634595136-4235292695-661162807-1001\SOFTWARE\INSTALLCORE\1I1T1Q1S, Quarantined, [3356b593ff8bec4a2bb608faf11314ec],
    PUP.Optional.InstallCore.A, HKU\S-1-5-21-1634595136-4235292695-661162807-1001\SOFTWARE\INSTALLCORE, Quarantined, [3b4e52f68406ae881aa022f6f1142fd1],

    Registry Values: 1
    PUP.Optional.InstallCore.A, HKU\S-1-5-21-1634595136-4235292695-661162807-1001\SOFTWARE\INSTALLCORE|tb, 0X1L1C1C1J2Z, Quarantined, [3b4e52f68406ae881aa022f6f1142fd1]

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 5
    PUP.Optional.InstallCore, C:\Users\Home\Downloads\adobe_flash_setup(1).exe, Quarantined, [9cedf1575d2d0c2af7da9e399075dc24],
    PUP.Optional.InstallCore, C:\Users\Home\Downloads\adobe_flash_setup.exe, Quarantined, [6d1ca7a1c3c732044b867b5c1bea20e0],
    PUP.Optional.Downware, C:\Users\Home\Downloads\Setup_ODM.exe, Quarantined, [75144dfbfc8ec86ec43ad3fe71902bd5],
    PUP.Optional.AZLyrics.A, C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage, Quarantined, [8801b1971f6b2c0ab6f61ba8b0534eb2],
    PUP.Optional.AZLyrics.A, C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage-journal, Quarantined, [0d7c1038a6e4ec4a7d2fc4ff61a224dc],

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
  8. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    # AdwCleaner v4.112 - Logfile created 21/03/2015 at 20:21:50
    # Updated 09/03/2015 by Xplode
    # Database : 2015-03-21.2 [Server]
    # Operating system : Windows 8.1 (x64)
    # Username : Home - DAD
    # Running from : C:\Users\Home\Downloads\adwcleaner_4.112.exe
    # Option : Cleaning

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    Folder Deleted : C:\Program Files (x86)\Amazon\ABB
    File Deleted : C:\WINDOWS\DtcInstall.log
    File Deleted : C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-devtools_devtools_0.localstorage
    File Deleted : C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-devtools_devtools_0.localstorage-journal
    File Deleted : C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pafkbggdmjlpgkdkcbjmhmfcdpncadgh_0.localstorage
    File Deleted : C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pafkbggdmjlpgkdkcbjmhmfcdpncadgh_0.localstorage-journal

    ***** [ Scheduled tasks ] *****


    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
    Key Deleted : HKCU\Software\CoinisRS
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

    ***** [ Web browsers ] *****

    -\\ Internet Explorer v11.0.9600.17416


    -\\ Mozilla Firefox v36.0.1 (x86 en-US)


    -\\ Google Chrome v41.0.2272.101


    *************************

    AdwCleaner[R0].txt - [1792 bytes] - [21/03/2015 20:07:32]
    AdwCleaner[S0].txt - [1697 bytes] - [21/03/2015 20:21:50]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1756 bytes] ##########
     
  9. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.4.5 (03.17.2015:1)
    OS: Windows 8.1 x64
    Ran by Home on Sat 03/21/2015 at 20:30:26.20
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys

    Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}
    Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}
    Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}
    Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}



    ~~~ Files



    ~~~ Folders

    Successfully deleted: [Folder] "C:\ai_recyclebin"
    Successfully deleted: [Folder] "C:\WINDOWS\syswow64\ai_recyclebin"



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Sat 03/21/2015 at 22:35:19.33
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  10. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Re-run Farbar Recovery Scan Tool (FRST) you ran at the very beginning of this topic.

    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Make sure you checkmark Addition.txt box.
    • Press Scan button.
    • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.
     
  11. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
    Ran by Home (administrator) on DAD on 23-03-2015 10:04:01
    Running from C:\Users\Home\Downloads
    Loaded Profiles: Home (Available profiles: Home)
    Platform: Windows 8.1 (X64) OS Language: English (United States)
    Internet Explorer Version 11 (Default browser: IE)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
    (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
    (Microsoft Corporation) C:\Windows\System32\dasHost.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
    (Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
    (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
    (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
    () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
    () C:\Windows\SysWOW64\UMonit64.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
    (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
    (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
    (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
    (Lenovo) C:\Windows\jmesoft\hotkey.exe
    (Dropbox, Inc.) C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe
    () C:\Windows\jmesoft\JME_LOAD.exe
    (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
    (CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
    (CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
    (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
    () C:\Program Files (x86)\Lenovo\Lenovo Messenger\NotificationsViewHost.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
    (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe
    (Microsoft Corporation) C:\Windows\System32\rundll32.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)
    HKLM-x32\...\Run: [jmekey] => C:\windows\jmesoft\hotkey.exe [118784 2013-07-24] (Lenovo)
    HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-08-16] ()
    HKLM-x32\...\Run: [LVT] => C:\Program Files\Lenovo\LVT\LJYZ.exe [886112 2011-11-24] (Lenovo)
    HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [95192 2013-03-08] (CyberLink Corp.)
    HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
    HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
    HKLM-x32\...\Run: [Lenovo App Shop] => C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\ismagent.exe [156000 2013-07-18] (Intel Corporation)
    HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-07-31] (AVAST Software)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
    HKLM-x32\...\Run: [] => [X]
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
    Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7767832 2014-11-07] (SUPERAntiSpyware)
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [26232152 2015-03-11] (Google)
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\MountPoints2: {cc8cb6f1-6aad-11e3-be6b-806e6f6e6963} - "C:\WINDOWS\system32\RunDLL32.EXE" Shell32.DLL,ShellExec_RunDLL E:\The_Mystery_of_History_Volume_III_Companion_Guide.pdf
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
    ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
    Startup: C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
    ShortcutTarget: Dropbox.lnk -> C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=AV01
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://home.lenovo.com
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://home.lenovo.com
    SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
    SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-1634595136-4235292695-661162807-1001 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-06-14] (Oracle Corporation)
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-07-16] (AVAST Software)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-06-14] (Oracle Corporation)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-05] (Oracle Corporation)
    BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-07-16] (AVAST Software)
    BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-05] (Oracle Corporation)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

    FireFox:
    ========
    FF ProfilePath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\b89dudjq.default
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-05] ()
    FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-06-14] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-06-14] (Oracle Corporation)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] ()
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)
    FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-05] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-05] (Oracle Corporation)
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
    FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll [2013-08-17] (Nitro PDF)
    FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2014-07-03] (Pando Networks)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-1634595136-4235292695-661162807-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Home\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-02-20] (Unity Technologies ApS)
    FF Plugin HKU\S-1-5-21-1634595136-4235292695-661162807-1001: intel.com/AppUp -> C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp.dll [2013-07-18] (Intel)
    FF Plugin HKU\S-1-5-21-1634595136-4235292695-661162807-1001: intel.com/AppUpx64 -> C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp_x64.dll [2013-07-18] (Intel)
    FF Plugin HKU\S-1-5-21-1634595136-4235292695-661162807-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2014-07-03] (Pando Networks)
    FF Extension: WOT - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\b89dudjq.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-03-18]
    FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-30]
    FF HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

    Chrome:
    =======
    CHR HomePage: Default -> hxxp://www.google.com/
    CHR StartupUrls: Default -> "https://www.yahoo.com/?fr=hp-avast&type=agc511"
    CHR DefaultSearchKeyword: Default -> trovi.search
    CHR DefaultSearchURL: Default -> http://www.trovi.com/Results.aspx?g...-4D62-BCC5-2D55D80CEFBB&q={searchTerms}&SSPV=
    CHR DefaultSuggestURL: Default ->
    CHR Profile: C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Google Docs) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-29]
    CHR Extension: (Google Drive) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-29]
    CHR Extension: (WOT) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-05-01]
    CHR Extension: (YouTube) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-29]
    CHR Extension: (Google Search) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-29]
    CHR Extension: (Avast Online Security) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-30]
    CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
    CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2014-11-30]
    CHR Extension: (Google Wallet) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-29]
    CHR Extension: (Gmail) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-29]
    CHR HKU\S-1-5-21-1634595136-4235292695-661162807-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-16]

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-09-10] (SUPERAntiSpyware.com)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-16] (AVAST Software)
    R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [7618952 2015-01-30] (COMODO)
    S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2265304 2015-02-05] (COMODO)
    S3 EasyAntiCheat; C:\WINDOWS\SysWOW64\EasyAntiCheat.exe [237864 2015-03-02] (EasyAntiCheat Ltd)
    R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89352 2014-09-15] (Hewlett-Packard Company)
    R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
    S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
    S2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-08-16] () [File not signed]
    R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584632 2015-03-21] (LENOVO INCORPORATED.)
    S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [1663880 2014-05-06] ()
    S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-21] (Malwarebytes Corporation)
    R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-08-17] (Nitro PDF Software)
    R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2013-05-14] ()
    S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-03-10] (Microsoft Corporation)
    S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-03-10] (Microsoft Corporation)

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-16] ()
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-16] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-16] (AVAST Software)
    R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-16] ()
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-26] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-16] (AVAST Software)
    R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-16] (AVAST Software)
    R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-16] ()
    R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [20184 2015-01-30] (COMODO)
    R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [807568 2015-01-30] (COMODO)
    R1 cmdhlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [35080 2015-01-30] (COMODO)
    R3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [103656 2013-10-21] (GenesysLogic)
    R1 inspect; C:\Windows\system32\DRIVERS\inspect.sys [126208 2015-01-30] (COMODO)
    R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-03-21] (Malwarebytes Corporation)
    S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-03-21] (Malwarebytes Corporation)
    R0 MBI; C:\Windows\System32\drivers\MBI.sys [27904 2013-06-22] (Intel Corporation)
    R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-03-21] ()
    R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
    S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-03-10] (Microsoft Corporation)
    S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
    S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-09-24] (Microsoft Corporation)

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-03-21 22:35 - 2015-03-21 22:35 - 00001334 _____ () C:\Users\Home\Desktop\JRT.txt
    2015-03-21 20:28 - 2015-03-21 20:28 - 01388672 _____ (Thisisu) C:\Users\Home\Downloads\JRT.exe
    2015-03-21 20:07 - 2015-03-21 20:21 - 00000000 ____D () C:\AdwCleaner
    2015-03-21 20:04 - 2015-03-21 20:04 - 02171392 _____ () C:\Users\Home\Downloads\adwcleaner_4.112.exe
    2015-03-21 19:17 - 2015-03-21 19:17 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Home\Downloads\mbam-setup-2.1.4.1018.exe
    2015-03-21 18:16 - 2015-03-21 18:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
    2015-03-21 17:58 - 2015-03-21 19:16 - 00000000 ____D () C:\ProgramData\RogueKiller
    2015-03-21 17:58 - 2015-03-21 17:58 - 16660056 _____ () C:\Users\Home\Downloads\RogueKiller.exe
    2015-03-21 17:58 - 2015-03-21 17:58 - 00035064 _____ () C:\WINDOWS\system32\Drivers\TrueSight.sys
    2015-03-19 13:29 - 2015-03-19 13:30 - 00050527 _____ () C:\Users\Home\Downloads\Addition.txt
    2015-03-19 13:27 - 2015-03-23 10:04 - 00020289 _____ () C:\Users\Home\Downloads\FRST.txt
    2015-03-19 13:26 - 2015-03-23 10:04 - 00000000 ____D () C:\FRST
    2015-03-19 13:25 - 2015-03-19 13:25 - 02095616 _____ (Farbar) C:\Users\Home\Downloads\FRST64.exe
    2015-03-10 14:32 - 2015-03-10 14:32 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe
    2015-03-10 14:32 - 2015-03-10 14:32 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\calc.exe
    2015-03-10 14:32 - 2015-03-10 14:32 - 00723072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
    2015-03-10 14:32 - 2015-03-10 14:32 - 00560392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
    2015-03-10 14:32 - 2015-03-10 14:32 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
    2015-03-10 14:32 - 2015-03-10 14:32 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
    2015-03-10 14:32 - 2015-03-10 14:32 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
    2015-03-10 14:32 - 2015-03-10 14:32 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll
    2015-03-10 14:32 - 2015-03-10 14:32 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
    2015-03-10 14:31 - 2015-03-10 14:31 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\photowiz.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\photowiz.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\compstui.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\findnetprinters.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\printui.exe
    2015-03-10 14:31 - 2015-03-10 14:31 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\printui.exe
    2015-03-10 14:31 - 2015-03-10 14:31 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\findnetprinters.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll
    2015-03-10 14:31 - 2015-03-10 14:31 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll
    2015-03-10 14:31 - 2015-02-06 17:09 - 00396419 _____ () C:\WINDOWS\system32\ApnDatabase.xml
    2015-03-10 14:30 - 2015-03-10 14:30 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
    2015-03-10 14:30 - 2015-03-10 14:30 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 01113920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
    2015-03-10 14:30 - 2015-03-10 14:30 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00097792 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys
    2015-03-10 14:30 - 2015-03-10 14:30 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe
    2015-03-10 14:30 - 2015-03-10 14:30 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
    2015-03-10 14:30 - 2015-03-10 14:30 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll
    2015-03-10 14:30 - 2015-03-10 14:30 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll
    2015-03-10 14:30 - 2015-02-05 19:28 - 02257408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
    2015-03-10 14:29 - 2015-03-10 14:30 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
    2015-03-10 14:29 - 2015-03-10 14:29 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
    2015-03-10 14:29 - 2015-03-10 14:29 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappprxy.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe
    2015-03-10 14:29 - 2015-03-10 14:29 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rfxvmt.dll
    2015-03-10 14:29 - 2015-03-10 14:29 - 00027456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys
    2015-03-10 14:29 - 2015-01-29 19:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll
    2015-03-10 14:28 - 2015-03-10 14:28 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
    2015-03-10 14:28 - 2015-03-10 14:28 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
    2015-03-10 14:28 - 2015-03-10 14:28 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
    2015-03-10 14:28 - 2015-01-20 23:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
    2015-03-10 14:27 - 2015-03-10 14:27 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
    2015-03-10 14:27 - 2015-03-10 14:27 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
    2015-03-10 14:25 - 2015-03-10 14:25 - 01090048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
    2015-03-10 14:25 - 2015-03-10 14:25 - 00791040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
    2015-03-09 20:46 - 2015-03-09 20:46 - 00000000 ____D () C:\ProgramData\HipSoft
    2015-03-02 17:03 - 2015-03-02 17:00 - 00237864 _____ (EasyAntiCheat Ltd) C:\WINDOWS\SysWOW64\EasyAntiCheat.exe
    2015-03-02 16:55 - 2015-03-02 16:55 - 00000000 ____D () C:\Users\Home\AppData\Local\Steam
    2015-02-24 18:59 - 2015-02-24 18:59 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
    2015-02-24 18:59 - 2015-02-24 18:59 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
    2015-02-24 18:59 - 2015-02-24 18:59 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
    2015-02-24 18:59 - 2015-02-24 18:59 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
    2015-02-24 18:59 - 2014-12-13 15:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls
    2015-02-24 18:59 - 2014-12-13 15:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-03-23 10:02 - 2013-08-22 08:46 - 00343443 _____ () C:\WINDOWS\setupact.log
    2015-03-23 10:01 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\system32\sru
    2015-03-21 23:45 - 2014-10-20 10:45 - 01772786 _____ () C:\WINDOWS\WindowsUpdate.log
    2015-03-21 23:31 - 2014-04-29 23:03 - 00000914 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
    2015-03-21 23:25 - 2014-07-16 15:50 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
    2015-03-21 23:00 - 2014-06-02 11:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
    2015-03-21 20:32 - 2013-12-21 20:21 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Lenovo
    2015-03-21 20:28 - 2014-09-24 01:15 - 01160678 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
    2015-03-21 20:23 - 2014-09-24 21:42 - 00000000 ___RD () C:\Users\Home\Google Drive
    2015-03-21 20:23 - 2014-04-30 12:08 - 00000000 ___RD () C:\Users\Home\Dropbox
    2015-03-21 20:23 - 2014-04-30 08:45 - 00000000 ____D () C:\Users\Home\AppData\Roaming\Dropbox
    2015-03-21 20:23 - 2014-04-29 23:03 - 00000910 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
    2015-03-21 20:22 - 2014-09-24 01:03 - 00026372 _____ () C:\WINDOWS\PFRO.log
    2015-03-21 20:22 - 2013-08-22 08:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
    2015-03-21 20:21 - 2013-12-21 20:30 - 00000000 ____D () C:\Program Files (x86)\Amazon
    2015-03-21 20:02 - 2014-05-17 11:07 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
    2015-03-21 19:59 - 2013-08-22 09:36 - 00000000 __RSD () C:\WINDOWS\Media
    2015-03-21 19:51 - 2014-04-29 22:09 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1634595136-4235292695-661162807-1001
    2015-03-21 19:19 - 2014-05-17 11:06 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
    2015-03-21 19:19 - 2014-05-17 11:06 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
    2015-03-21 19:19 - 2014-05-17 11:06 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
    2015-03-21 19:19 - 2014-05-17 11:06 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2015-03-21 19:19 - 2014-05-17 11:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2015-03-21 19:19 - 2014-05-17 11:06 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2015-03-21 10:34 - 2014-04-29 23:15 - 00002214 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
    2015-03-20 07:33 - 2014-05-08 08:57 - 00000000 ____D () C:\Users\Home\Desktop\Full Quiver Contracting
    2015-03-18 11:40 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\rescache
    2015-03-18 10:50 - 2013-08-22 07:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
    2015-03-18 10:13 - 2014-04-30 12:08 - 00001071 _____ () C:\Users\Home\Desktop\Dropbox.lnk
    2015-03-18 10:13 - 2014-04-30 08:48 - 00000000 ____D () C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
    2015-03-18 10:09 - 2013-08-22 08:44 - 00422168 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ___RD () C:\WINDOWS\ToastData
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\WinStore
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ____D () C:\Program Files\Windows Defender
    2015-03-18 07:46 - 2013-08-22 09:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
    2015-03-13 22:35 - 2013-08-22 09:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
    2015-03-11 16:34 - 2014-09-24 21:38 - 00002069 _____ () C:\Users\Public\Desktop\Google Slides.lnk
    2015-03-11 16:34 - 2014-09-24 21:38 - 00002067 _____ () C:\Users\Public\Desktop\Google Sheets.lnk
    2015-03-11 16:34 - 2014-09-24 21:38 - 00002057 _____ () C:\Users\Public\Desktop\Google Docs.lnk
    2015-03-11 16:34 - 2014-09-24 21:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
    2015-03-11 15:34 - 2014-07-03 17:36 - 00000000 ____D () C:\Users\Home\AppData\Local\PMB Files
    2015-03-11 15:34 - 2014-07-03 17:35 - 00000000 ____D () C:\ProgramData\PMB Files
    2015-03-10 15:16 - 2014-04-30 13:47 - 00000000 ____D () C:\ProgramData\Microsoft Help
    2015-03-10 15:16 - 2012-07-26 01:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
    2015-03-10 15:04 - 2014-04-30 02:17 - 00000000 ____D () C:\WINDOWS\system32\MRT
    2015-03-10 14:55 - 2014-04-30 02:17 - 122905848 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
    2015-03-10 14:29 - 2015-01-10 14:38 - 00792032 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
    2015-03-10 14:29 - 2015-01-10 14:38 - 00178144 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
    2015-03-10 10:51 - 2014-04-30 01:46 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
    2015-03-09 20:47 - 2013-12-21 20:30 - 00000000 ____D () C:\ProgramData\Temp
    2015-03-03 08:22 - 2014-10-20 10:23 - 00000000 ____D () C:\Users\Home
    2015-03-02 17:03 - 2014-08-10 18:14 - 00000000 ____D () C:\Program Files (x86)\Steam

    ==================== Files in the root of some directories =======

    2014-05-04 18:22 - 2014-05-17 00:22 - 0000034 _____ () C:\Users\Home\AppData\Roaming\WB.CFG
    2014-04-29 22:01 - 2014-06-05 09:53 - 0000193 _____ () C:\Users\Home\AppData\Local\RegisteredPackageInformation.xml
    2014-04-30 15:42 - 2014-04-30 15:42 - 0000057 _____ () C:\ProgramData\Ament.ini

    Some content of TEMP:
    ====================
    C:\Users\Home\AppData\Local\Temp\COMAP.EXE
    C:\Users\Home\AppData\Local\Temp\dllnt_dump.dll
    C:\Users\Home\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6ii86q.dll
    C:\Users\Home\AppData\Local\Temp\jre-8u40-windows-au.exe
    C:\Users\Home\AppData\Local\Temp\sqlite3.dll


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2015-03-18 11:02

    ==================== End Of Log ============================
     
  12. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    I still need Addition.txt log.
     
  13. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
    Ran by Home at 2015-03-23 10:10:42
    Running from C:\Users\Home\Downloads
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    AS: Comodo Defense+ (Disabled - Up to date) {4BDD6856-AF0D-06BD-38AB-8A0FE39860CC}
    FW: COMODO Firewall (Enabled) {C8870897-C358-086B-2944-184866CC6D0A}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 16.0.0.245 - Adobe Systems Incorporated)
    Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
    Dependency Package Update (Version: 1.6.36.00 - Lenovo Inc.) Hidden
    Dependency Package Update (x32 Version: 1.6.32.00 - Lenovo Group Limited) Hidden
    Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve)
    Dropbox (HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\Dropbox) (Version: 3.2.9 - Dropbox, Inc.)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.101 - Google Inc.)
    Google Drive (HKLM-x32\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
    Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
    HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
    HP Support Solutions Framework (HKLM-x32\...\{44157EB3-D8D0-4BB1-B0F5-AD2C38814ED1}) (Version: 11.51.0027 - Hewlett-Packard Company)
    HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: - )
    HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
    Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
    Malwarebytes Anti-Malware version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
    Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
    Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
    Mozilla Firefox 36.0.4 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 36.0.4 (x86 en-US)) (Version: 36.0.4 - Mozilla)
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6743 - Realtek Semiconductor Corp.)
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
    Unity Web Player (HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\UnityWebPlayer) (Version: - Unity Technologies ApS)

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{9E506282-69D3-5ABA-9C1D-15994B37F4AC}\InprocServer32 -> C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp_x64.dll (Intel)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{9E506282-69D3-5ABA-9C1D-15994B37F4AD}\InprocServer32 -> C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp_x64.dll (Intel)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1634595136-4235292695-661162807-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

    ==================== Restore Points =========================

    03-03-2015 11:15:36 Windows Update
    10-03-2015 14:46:30 Windows Update
    18-03-2015 11:35:10 Scheduled Checkpoint

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2012-07-25 23:26 - 2014-05-20 17:18 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
    127.0.0.1 localhost

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {038F647A-BEFC-4279-BE4D-A2D06B84B67E} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2014-05-06] (Lenovo)
    Task: {256E6778-4A49-423E-8B78-DD58D5832A4B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-29] (Google Inc.)
    Task: {467B75C1-52B1-47DE-8C22-C3ACCD6587D5} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-05] (COMODO)
    Task: {497A5723-69E9-44F8-AF71-CD08F85F073D} - System32\Tasks\UMonitor Task => C:\windows\SysWOW64\UMonit64.exe [2013-10-25] ()
    Task: {5072D832-8D78-4D6A-9D9C-B1A39FA6CF37} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\iMController\AutoUpdate.exe [2015-03-21] ()
    Task: {64C67887-7BBF-47A5-9492-07D77B173EE6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-16] (AVAST Software)
    Task: {9707D51D-67FD-45D2-AAA3-C7F5BCB03EA7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-29] (Google Inc.)
    Task: {9ADCB6B7-DDFC-4A7E-A851-ECFFCD9EEF47} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
    Task: {E139710C-737D-4EC3-9C9C-6C3811999D8B} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-05-06] ()
    Task: {E854EC01-66F4-4595-9ED5-E2AC3730A614} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-05] (COMODO)
    Task: {F17BFED7-7AF4-4BC5-BAA6-017FA950D1D4} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-02-05] (COMODO)
    Task: {F38486FB-4E2E-474B-B2A1-B03D26502F36} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-05-06] (Lenovo)
    Task: {F3A795C6-8633-4324-80E6-4D5C4E985768} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-03-10] (Microsoft Corporation)
    Task: {F90B3E08-4A55-4F51-8A4B-B7BD7F1C5949} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
    Task: {FA026FE9-9E3A-4EEE-8570-26FA781C113A} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-02-05] (COMODO)
    Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) ==============

    2013-12-21 20:39 - 2013-05-14 12:53 - 00390632 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
    2013-12-21 20:18 - 2013-10-25 03:23 - 00053248 _____ () C:\windows\SysWOW64\UMonit64.exe
    2013-12-21 20:18 - 2011-08-16 22:46 - 00024576 _____ () C:\Windows\jmesoft\JME_LOAD.exe
    2014-08-21 17:59 - 2014-08-21 17:59 - 00462592 _____ () C:\Program Files (x86)\Lenovo\Lenovo Messenger\NotificationsViewHost.exe
    2014-07-16 10:20 - 2014-07-16 10:20 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
    2015-03-21 18:05 - 2015-03-21 18:05 - 02922496 _____ () C:\Program Files\AVAST Software\Avast\defs\15032101\algo.dll
    2015-03-21 20:23 - 2015-03-21 20:23 - 00098816 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32api.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00110080 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\pywintypes27.dll
    2015-03-21 20:23 - 2015-03-21 20:23 - 00364544 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\pythoncom27.dll
    2015-03-21 20:23 - 2015-03-21 20:23 - 00045568 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\_socket.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 01161216 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\_ssl.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00320512 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32com.shell.shell.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00713216 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\_hashlib.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 01175040 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\wx._core_.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00805888 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\wx._gdi_.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00811008 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\wx._windows_.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 01062400 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\wx._controls_.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00735232 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\wx._misc_.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00682496 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\pysqlite2._sqlite.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00128512 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\_elementtree.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00127488 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\pyexpat.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00087552 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\_ctypes.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00119808 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32file.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00108544 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32security.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00007168 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\hashobjs_ext.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00167936 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32gui.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00018432 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32event.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00038912 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32inet.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00011264 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32crypt.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00070656 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\wx._html2.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00027136 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\_multiprocessing.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00020480 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\_yappi.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00035840 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32process.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00686080 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\unicodedata.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00122368 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\wx._wizard.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00024064 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32pipe.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00010240 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\select.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00025600 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32pdh.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00525640 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\windows._lib_cacheinvalidation.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00017408 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32profile.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00022528 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\win32ts.pyd
    2015-03-21 20:23 - 2015-03-21 20:23 - 00078336 _____ () C:\Users\Home\AppData\Local\Temp\_MEI49962\wx._animate.pyd
    2015-03-04 16:08 - 2015-03-04 16:08 - 00750080 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\libGLESv2.dll
    2015-03-21 20:23 - 2015-03-21 20:23 - 00043008 _____ () c:\users\home\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6ii86q.dll
    2015-03-04 16:08 - 2015-03-04 16:08 - 00047616 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\libEGL.dll
    2015-03-04 16:08 - 2015-03-04 16:08 - 00865280 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
    2015-03-04 16:07 - 2015-03-04 16:07 - 00200704 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
    2013-12-21 20:18 - 2011-05-17 15:27 - 00028672 _____ () C:\Windows\jmesoft\hidhook.dll
    2009-12-04 18:59 - 2009-12-04 18:59 - 00619816 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
    2009-12-04 19:04 - 2009-12-04 19:04 - 00013096 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
    2014-07-16 10:20 - 2014-07-16 10:20 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

    AlternateDataStreams: C:\WINDOWS\explorer.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\actxprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\adtschema.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\aeinv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\aepdu.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\aepic.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\appinfo.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\appraiser.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\atlthunk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\atmfd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\atmlib.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\audiodg.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AudioEndpointBuilder.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AudioEng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AUDIOKSE.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AudioSes.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\audiosrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\authui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\calc.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\certcli.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ci.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\compstui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\consent.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\crypt32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_47.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\DafPrintProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dciman32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\DeviceSetupStatusProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\devinv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dpapisrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dxtmsft.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dxtrans.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eappcfg.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eappgnui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eapphost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eappprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\EncDump.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Faultrep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\findnetprinters.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\fontsub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\FXSAPI.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\FXSCOMEX.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\generaltel.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\GlobCollationHost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\hlink.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ie4uinit.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\IEAdvpack.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieapfltr.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iedkcs32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieetwcollector.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieetwproxystub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieframe.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iepeers.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iernonce.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iertutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iesetup.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iesysprep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieUnatt.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iexpress.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\imgutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\inetcomm.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\inetcpl.cpl:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\inseng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\invagent.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\JavaScriptCollectionAgent.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jscript9.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jscript9diag.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jsproxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\kerberos.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\licmgr10.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\localspl.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\LockScreenContentServer.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\lpk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\lsasrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mfc42.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mfc42u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\MFMediaEngine.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mfmp4srcsnk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\MrmCoreR.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msaudite.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msfeeds.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msfeedsbs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msfeedssync.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msftedit.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mshta.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mshtml.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\MshtmlDac.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mshtmled.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msihnd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msrating.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msxml3.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ncryptsslp.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ncsi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\nlaapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\nlasvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ntdll.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ntoskrnl.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ntvdm64.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\occache.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\oleaut32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\packager.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\photowiz.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\pku2u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\pngfilt.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\poqexec.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\printui.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\prnntfy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\profsvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\puiapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\puiobj.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\rdpcorets.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\rdpudd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\rfxvmt.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\scesrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\schannel.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\SHCore.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\shell32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\StorageContextHandler.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\tdc.ocx:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\TSWbPrxy.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\twinui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ubpm.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\untfs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\url.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\urlmon.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\user32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\vbscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\webcheck.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wer.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WerFault.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WerFaultSecure.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wermgr.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wextract.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\win32k.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\win32spl.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Windows.Globalization.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WindowsCodecs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wininet.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\winshfhc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WMPhoto.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wow64.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wow64cpu.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WSCollect.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WsmSvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WSReset.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WSShared.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\actxprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\adtschema.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\atlthunk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\atmfd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\atmlib.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioEng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\AUDIOKSE.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioSes.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\authui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\calc.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\certcli.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\compstui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\crypt32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_47.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\DafPrintProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dciman32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dwmcore.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtmsft.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtrans.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eapp3hst.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eappcfg.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eappgnui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eapphost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eappprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\explorer.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Faultrep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\findnetprinters.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerApp.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\fontsub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSAPI.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\GlobCollationHost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\hlink.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\IEAdvpack.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieapfltr.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iedkcs32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieetwproxystub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieframe.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iepeers.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iernonce.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iertutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iesetup.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iesysprep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieUnatt.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iexpress.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\imgutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcomm.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcpl.cpl:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\inseng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\instnm.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9diag.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jsproxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\kerberos.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\licmgr10.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\lpk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mfc42.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mfc42u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\MFMediaEngine.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\MrmCoreR.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msaudite.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msctf.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeeds.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeedsbs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeedssync.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msftedit.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mshta.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtml.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\MshtmlDac.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtmled.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msihnd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msrating.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msxml3.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ncryptsslp.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\nlaapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ntdll.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ntvdm64.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\occache.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\oleaut32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\packager.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\photowiz.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\pku2u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\pngfilt.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\poqexec.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\printui.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\prnntfy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\puiapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\puiobj.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\scesrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\schannel.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\setup16.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\SHCore.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\shell32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\StorageContextHandler.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\tdc.ocx:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\untfs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\url.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\urlmon.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\user.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\user32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\vbscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\webcheck.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wer.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFault.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFaultSecure.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wermgr.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wextract.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Globalization.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WindowsCodecs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wininet.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\winshfhc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WMPhoto.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wow32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmSvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WSShared.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\ahcache.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\cng.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\dumpsd.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidbth.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\intelpep.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksecpkg.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\mbam.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\mbamchameleon.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxdav.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\mwac.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndis.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\netio.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\pdc.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdpvideominiport.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdbus.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\tcpip.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\USBSTOR.SYS:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdBoot.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdFilter.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdNisDrv.sys:$CmdTcID
    AlternateDataStreams: C:\ProgramData\Temp:13AA281B
    AlternateDataStreams: C:\ProgramData\Temp:2CB9631F
    AlternateDataStreams: C:\ProgramData\Temp:C86B29EB
    AlternateDataStreams: C:\ProgramData\Temp:DDEB08FD
    AlternateDataStreams: C:\Users\Home\Desktop\TechnicLauncher.exe:$CmdTcID
    AlternateDataStreams: C:\Users\Home\Downloads\adwcleaner_4.112.exe:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\FRST64.exe:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\InfoGuideCentral-NorthCombo-2015-2016.pdf:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Jan 20 -2015 - Home School Day Registration Form.doc:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\JRT.exe:$CmdTcID
    AlternateDataStreams: C:\Users\Home\Downloads\JRT.exe:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\KSP_demo_win.zip:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\mbam-setup-2.1.4.1018.exe:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\RogueKiller.exe:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Running and Starting a Successful Book club.docx:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Running Record.docx:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Spring 2015 Audition Packet.pdf:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Updated Rehearsal 3.13 -3.21.pdf:$CmdZnID

    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


    ==================== EXE Association (whitelisted) ===============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Home\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
    DNS Servers: 192.168.1.1

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)


    ==================== Accounts: =============================

    Administrator (S-1-5-21-1634595136-4235292695-661162807-500 - Administrator - Disabled)
    Guest (S-1-5-21-1634595136-4235292695-661162807-501 - Limited - Disabled)
    Home (S-1-5-21-1634595136-4235292695-661162807-1001 - Administrator - Enabled) => C:\Users\Home
    HomeGroupUser$ (S-1-5-21-1634595136-4235292695-661162807-1005 - Limited - Enabled)

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (03/23/2015 10:03:39 AM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT AUTHORITY)
    Description: There was an error with the Windows Location Provider database


    System errors:
    =============

    Microsoft Office Sessions:
    =========================
    Error: (03/23/2015 10:03:39 AM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT AUTHORITY)
    Description: -2147024883


    CodeIntegrity Errors:
    ===================================
    Date: 2015-03-23 10:07:13.729
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2015-03-21 23:02:23.874
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: Intel(R) Pentium(R) CPU J2850 @ 2.41GHz
    Percentage of memory in use: 35%
    Total physical RAM: 3973.38 MB
    Available physical RAM: 2576.04 MB
    Total Pagefile: 5061.38 MB
    Available Pagefile: 3076.61 MB
    Total Virtual: 131072 MB
    Available Virtual: 131071.84 MB

    ==================== Drives ================================

    Drive c: (Windows8_OS) (Fixed) (Total:904.81 GB) (Free:839.6 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    Drive e: (The Mystery of History Volume II) (CDROM) (Total:0.05 GB) (Free:0 GB) UDF

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 931.5 GB) (Disk ID: 156639CC)

    Partition: GPT Partition Type.

    ==================== End Of Log ============================
     
  14. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    [​IMG] Uninstall McAfee Security Scan, typical foistware.

    [​IMG]
    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  15. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
    Ran by Home at 2015-03-25 21:54:50 Run:1
    Running from C:\Users\Home\Desktop
    Loaded Profiles: Home (Available profiles: Home)
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    HKLM-x32\...\Run: [] => [X]
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\...\MountPoints2: {cc8cb6f1-6aad-11e3-be6b-806e6f6e6963} - "C:\WINDOWS\system32\RunDLL32.EXE" Shell32.DLL,ShellExec_RunDLL E:\The_Mystery_of_History_Volume_III_Companion_Guide.pdf
    HKU\S-1-5-21-1634595136-4235292695-661162807-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    CHR DefaultSearchKeyword: Default -> trovi.search
    CHR DefaultSearchURL: Default -> http://www.trovi.com/Results.aspx?g...-4D62-BCC5-2D55D80CEFBB&q={searchTerms}&SSPV=
    2014-05-04 18:22 - 2014-05-17 00:22 - 0000034 _____ () C:\Users\Home\AppData\Roaming\WB.CFG
    2014-04-29 22:01 - 2014-06-05 09:53 - 0000193 _____ () C:\Users\Home\AppData\Local\RegisteredPackageInformation.xml
    2014-04-30 15:42 - 2014-04-30 15:42 - 0000057 _____ () C:\ProgramData\Ament.ini
    C:\Users\Home\AppData\Local\Temp\COMAP.EXE
    C:\Users\Home\AppData\Local\Temp\dllnt_dump.dll
    C:\Users\Home\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6ii86q.dll
    C:\Users\Home\AppData\Local\Temp\jre-8u40-windows-au.exe
    C:\Users\Home\AppData\Local\Temp\sqlite3.dll
    AlternateDataStreams: C:\WINDOWS\explorer.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\actxprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\adtschema.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\aeinv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\aepdu.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\aepic.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\appinfo.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\appraiser.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\atlthunk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\atmfd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\atmlib.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\audiodg.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AudioEndpointBuilder.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AudioEng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AUDIOKSE.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\AudioSes.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\audiosrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\authui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\calc.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\certcli.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ci.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\compstui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\consent.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\crypt32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_47.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\DafPrintProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dciman32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\DeviceSetupStatusProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\devinv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dpapisrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dxtmsft.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\dxtrans.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eappcfg.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eappgnui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eapphost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\eappprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\EncDump.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Faultrep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\findnetprinters.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\fontsub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\FXSAPI.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\FXSCOMEX.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\generaltel.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\GlobCollationHost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\hlink.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ie4uinit.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\IEAdvpack.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieapfltr.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iedkcs32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieetwcollector.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieetwproxystub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieframe.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iepeers.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iernonce.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iertutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iesetup.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iesysprep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ieUnatt.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\iexpress.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\imgutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\inetcomm.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\inetcpl.cpl:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\inseng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\invagent.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\JavaScriptCollectionAgent.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jscript9.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jscript9diag.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\jsproxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\kerberos.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\licmgr10.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\localspl.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\LockScreenContentServer.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\lpk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\lsasrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mfc42.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mfc42u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\MFMediaEngine.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mfmp4srcsnk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\MrmCoreR.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msaudite.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msfeeds.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msfeedsbs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msfeedssync.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msftedit.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mshta.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mshtml.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\MshtmlDac.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\mshtmled.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msihnd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msrating.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\msxml3.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ncryptsslp.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ncsi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\nlaapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\nlasvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ntdll.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ntoskrnl.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ntvdm64.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\occache.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\oleaut32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\packager.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\photowiz.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\pku2u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\pngfilt.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\poqexec.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\printui.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\prnntfy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\profsvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\puiapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\puiobj.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\rdpcorets.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\rdpudd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\rfxvmt.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\scesrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\schannel.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\SHCore.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\shell32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\StorageContextHandler.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\tdc.ocx:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\TSWbPrxy.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\twinui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\ubpm.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\untfs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\url.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\urlmon.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\user32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\vbscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\webcheck.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wer.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WerFault.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WerFaultSecure.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wermgr.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wextract.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\win32k.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\win32spl.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Windows.Globalization.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WindowsCodecs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wininet.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\winshfhc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WMPhoto.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wow64.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\wow64cpu.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WSCollect.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WsmSvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WSReset.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\WSShared.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\actxprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\adtschema.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\atlthunk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\atmfd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\atmlib.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioEng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\AUDIOKSE.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioSes.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\authui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\calc.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\certcli.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\compstui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\crypt32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_47.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\DafPrintProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dciman32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dwmcore.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtmsft.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtrans.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eapp3hst.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eappcfg.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eappgnui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eapphost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\eappprxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\explorer.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Faultrep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\findnetprinters.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerApp.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\fontsub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\FXSAPI.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\GlobCollationHost.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\hlink.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\IEAdvpack.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieapfltr.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iedkcs32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieetwproxystub.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieframe.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iepeers.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iernonce.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iertutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iesetup.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iesysprep.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ieUnatt.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\iexpress.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\imgutil.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcomm.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcpl.cpl:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\inseng.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\instnm.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9diag.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\jsproxy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\kerberos.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\licmgr10.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\lpk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mfc42.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mfc42u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\MFMediaEngine.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\MrmCoreR.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msaudite.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msctf.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeeds.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeedsbs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeedssync.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msftedit.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mshta.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtml.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\MshtmlDac.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtmled.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msihnd.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msrating.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\msxml3.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ncryptsslp.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\nlaapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ntdll.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\ntvdm64.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\occache.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\oleaut32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\packager.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\photowiz.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\pku2u.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\pngfilt.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\poqexec.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\printui.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\prnntfy.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\puiapi.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\puiobj.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\scesrv.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\schannel.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\setup16.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\SHCore.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\shell32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\StorageContextHandler.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\tdc.ocx:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\untfs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\url.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\urlmon.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\user.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\user32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\vbscript.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\webcheck.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wer.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFault.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFaultSecure.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wermgr.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wextract.exe:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Globalization.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WindowsCodecs.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wininet.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\winshfhc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WMPhoto.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\wow32.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmSvc.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\SysWOW64\WSShared.dll:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\ahcache.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\cng.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\dumpsd.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidbth.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\intelpep.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksecpkg.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\mbam.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\mbamchameleon.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxdav.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\mwac.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndis.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\netio.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\pdc.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdpvideominiport.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdbus.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\tcpip.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\USBSTOR.SYS:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdBoot.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdFilter.sys:$CmdTcID
    AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdNisDrv.sys:$CmdTcID
    AlternateDataStreams: C:\ProgramData\Temp:13AA281B
    AlternateDataStreams: C:\ProgramData\Temp:2CB9631F
    AlternateDataStreams: C:\ProgramData\Temp:C86B29EB
    AlternateDataStreams: C:\ProgramData\Temp:DDEB08FD
    AlternateDataStreams: C:\Users\Home\Desktop\TechnicLauncher.exe:$CmdTcID
    AlternateDataStreams: C:\Users\Home\Downloads\adwcleaner_4.112.exe:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\FRST64.exe:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\InfoGuideCentral-NorthCombo-2015-2016.pdf:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Jan 20 -2015 - Home School Day Registration Form.doc:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\JRT.exe:$CmdTcID
    AlternateDataStreams: C:\Users\Home\Downloads\JRT.exe:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\KSP_demo_win.zip:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\mbam-setup-2.1.4.1018.exe:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\RogueKiller.exe:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Running and Starting a Successful Book club.docx:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Running Record.docx:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Spring 2015 Audition Packet.pdf:$CmdZnID
    AlternateDataStreams: C:\Users\Home\Downloads\Updated Rehearsal 3.13 -3.21.pdf:$CmdZnID

    *****************

    HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
    "HKU\S-1-5-21-1634595136-4235292695-661162807-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc8cb6f1-6aad-11e3-be6b-806e6f6e6963}" => Key deleted successfully.
    HKCR\CLSID\{cc8cb6f1-6aad-11e3-be6b-806e6f6e6963} => Key not found.
    "HKU\S-1-5-21-1634595136-4235292695-661162807-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
    Chrome DefaultSearchKeyword deleted successfully.
    Chrome DefaultSearchURL deleted successfully.
    C:\Users\Home\AppData\Roaming\WB.CFG => Moved successfully.
    C:\Users\Home\AppData\Local\RegisteredPackageInformation.xml => Moved successfully.
    C:\ProgramData\Ament.ini => Moved successfully.
    C:\Users\Home\AppData\Local\Temp\COMAP.EXE => Moved successfully.
    C:\Users\Home\AppData\Local\Temp\dllnt_dump.dll => Moved successfully.
    "C:\Users\Home\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6ii86q.dll" => File/Directory not found.
    C:\Users\Home\AppData\Local\Temp\jre-8u40-windows-au.exe => Moved successfully.
    C:\Users\Home\AppData\Local\Temp\sqlite3.dll => Moved successfully.
    "C:\WINDOWS\explorer.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\actxprxy.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\adtschema.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\aeinv.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\aepdu.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\aepic.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\appinfo.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\appraiser.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\atlthunk.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\atmfd.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\atmlib.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\audiodg.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\AudioEndpointBuilder.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\AudioEng.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\AUDIOKSE.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\AudioSes.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\audiosrv.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\authui.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\calc.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\certcli.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ci.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\compstui.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\consent.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\crypt32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\D3DCompiler_47.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\DafPrintProvider.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\dciman32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\DeviceSetupStatusProvider.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\devinv.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\dpapisrv.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\dxtmsft.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\dxtrans.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\eappcfg.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\eappgnui.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\eapphost.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\eappprxy.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\EncDump.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Faultrep.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\findnetprinters.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\fontsub.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\FXSAPI.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\FXSCOMEX.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\generaltel.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\GlobCollationHost.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\hlink.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ie4uinit.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\IEAdvpack.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ieapfltr.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\iedkcs32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ieetwcollector.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ieetwproxystub.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ieframe.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\iepeers.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\iernonce.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\iertutil.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\iesetup.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\iesysprep.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ieui.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ieUnatt.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\iexpress.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\imgutil.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\inetcomm.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\inetcpl.cpl" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\inseng.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\invagent.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\JavaScriptCollectionAgent.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\jscript.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\jscript9.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\jscript9diag.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\jsproxy.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\kerberos.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\licmgr10.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\localspl.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\LockScreenContentServer.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\lpk.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\lsasrv.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\mfc42.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\mfc42u.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\MFMediaEngine.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\mfmp4srcsnk.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\MrmCoreR.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\msaudite.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\msfeeds.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\msfeedsbs.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\msfeedssync.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\msftedit.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\mshta.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\mshtml.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\MshtmlDac.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\mshtmled.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\msi.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\msihnd.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\msrating.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\msxml3.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ncryptsslp.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ncsi.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\nlaapi.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\nlasvc.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ntdll.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ntoskrnl.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ntvdm64.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\occache.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\oleaut32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\packager.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\photowiz.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\pku2u.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\pngfilt.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\poqexec.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\printui.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\prnntfy.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\profsvc.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\puiapi.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\puiobj.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\rdpcorets.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\rdpudd.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\rfxvmt.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\scesrv.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\schannel.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\SettingsHandlers.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\SHCore.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\shell32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\StorageContextHandler.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\tdc.ocx" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\TSWbPrxy.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\twinui.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\ubpm.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\untfs.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\url.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\urlmon.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\user32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\vbscript.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\webcheck.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\wer.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\werdiagcontroller.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\WerFault.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\WerFaultSecure.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\wermgr.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\wextract.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\win32k.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\win32spl.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Windows.Globalization.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\WindowsCodecs.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\wininet.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\winshfhc.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\WMPhoto.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\wow64.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\wow64cpu.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\WSCollect.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\WsmSvc.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\WSReset.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\WSShared.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\actxprxy.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\adtschema.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\atlthunk.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\atmfd.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\atmlib.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\AudioEng.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\AUDIOKSE.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\AudioSes.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\authui.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\calc.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\certcli.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\compstui.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\crypt32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\D3DCompiler_47.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\DafPrintProvider.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\dciman32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\dwmcore.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\dxtmsft.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\dxtrans.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\eapp3hst.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\eappcfg.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\eappgnui.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\eapphost.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\eappprxy.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\explorer.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\Faultrep.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\findnetprinters.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\FlashPlayerApp.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\fontsub.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\FXSAPI.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\GlobCollationHost.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\hlink.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\IEAdvpack.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\ieapfltr.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\iedkcs32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\ieetwproxystub.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\ieframe.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\iepeers.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\iernonce.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\iertutil.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\iesetup.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\iesysprep.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\ieui.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\ieUnatt.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\iexpress.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\imgutil.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\inetcomm.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\inetcpl.cpl" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\inseng.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\instnm.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\jscript.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\jscript9.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\jscript9diag.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\jsproxy.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\kerberos.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\licmgr10.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\lpk.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\mfc42.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\mfc42u.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\MFMediaEngine.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\MrmCoreR.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\msaudite.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\msctf.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\msfeeds.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\msfeedsbs.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\msfeedssync.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\msftedit.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\mshta.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\mshtml.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\MshtmlDac.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\mshtmled.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\msi.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\msihnd.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\msrating.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\msxml3.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\ncryptsslp.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\nlaapi.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\ntdll.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\ntvdm64.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\occache.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\oleaut32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\packager.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\photowiz.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\pku2u.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\pngfilt.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\poqexec.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\printui.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\prnntfy.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\puiapi.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\puiobj.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\scesrv.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\schannel.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\setup16.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\SHCore.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\shell32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\StorageContextHandler.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\tdc.ocx" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\twinui.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\untfs.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\url.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\urlmon.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\user.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\user32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\vbscript.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\webcheck.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\wer.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\werdiagcontroller.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\WerFault.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\WerFaultSecure.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\wermgr.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\wextract.exe" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\Windows.Globalization.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\WindowsCodecs.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\wininet.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\winshfhc.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\WMPhoto.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\wow32.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\WsmSvc.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\SysWOW64\WSShared.dll" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\ahcache.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\cng.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\dumpsd.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\hidbth.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\intelpep.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\ksecpkg.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\mbam.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\mbamchameleon.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\mrxdav.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\mwac.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\ndis.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\netio.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\pdc.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\rdpvideominiport.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\sdbus.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\tcpip.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\USBSTOR.SYS" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\WdBoot.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\WdFilter.sys" => ":$CmdTcID" ADS not found.
    "C:\WINDOWS\system32\Drivers\WdNisDrv.sys" => ":$CmdTcID" ADS not found.
    C:\ProgramData\Temp => ":13AA281B" ADS removed successfully.
    C:\ProgramData\Temp => ":2CB9631F" ADS removed successfully.
    C:\ProgramData\Temp => ":C86B29EB" ADS removed successfully.
    C:\ProgramData\Temp => ":DDEB08FD" ADS removed successfully.
    "C:\Users\Home\Desktop\TechnicLauncher.exe" => ":$CmdTcID" ADS not found.
    C:\Users\Home\Downloads\adwcleaner_4.112.exe => ":$CmdZnID" ADS removed successfully.
    "C:\Users\Home\Downloads\FRST64.exe" => ":$CmdZnID" ADS not found.
    C:\Users\Home\Downloads\InfoGuideCentral-NorthCombo-2015-2016.pdf => ":$CmdZnID" ADS removed successfully.
    "C:\Users\Home\Downloads\Jan 20 -2015 - Home School Day Registration Form.doc" => ":$CmdZnID" ADS not found.
    "C:\Users\Home\Downloads\JRT.exe" => ":$CmdTcID" ADS not found.
    C:\Users\Home\Downloads\JRT.exe => ":$CmdZnID" ADS removed successfully.
    C:\Users\Home\Downloads\KSP_demo_win.zip => ":$CmdZnID" ADS removed successfully.
    C:\Users\Home\Downloads\mbam-setup-2.1.4.1018.exe => ":$CmdZnID" ADS removed successfully.
    C:\Users\Home\Downloads\RogueKiller.exe => ":$CmdZnID" ADS removed successfully.
    C:\Users\Home\Downloads\Running and Starting a Successful Book club.docx => ":$CmdZnID" ADS removed successfully.
    C:\Users\Home\Downloads\Running Record.docx => ":$CmdZnID" ADS removed successfully.
    C:\Users\Home\Downloads\Spring 2015 Audition Packet.pdf => ":$CmdZnID" ADS removed successfully.
    C:\Users\Home\Downloads\Updated Rehearsal 3.13 -3.21.pdf => ":$CmdZnID" ADS removed successfully.

    ==== End of Fixlog 21:54:54 ====
     
  16. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Mozilla home page back to normal. Google chrome still has the wrong home page
     
  17. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

  18. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Can you switch to whatever page you want manually?
    ..or...

    Reset Chrome...
    Click on "Customize and control Google Chrome":
    [​IMG]
    Click "Settings" then "Show advanced settings" at the bottom of the screen.
    Click "Reset browser settings" button.
    Restart Chrome.

    If the above didn't help....

    Reinstall Chrome...
    If you want to save your bookmarks...
    How to Backup Bookmarks in Google Chrome
    If you want to save your passwords as well see here: http://www.intowindows.com/how-to-backup-saved-passwords-in-google-chrome-browser/
    • Close all Chrome windows and tabs.
    • Go to the Start menu > Control Panel. (Windows 8 users: Learn how to access the Control Panel)
    • Click Programs and Features.
    • Double-click Google Chrome.
    • Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, by selecting the "Also delete your browsing data" checkbox.
    Install fresh copy.

    Last scans....

    [​IMG] Download Security Check from here or here and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
    NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


    [​IMG] Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
      • Other Services
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.

    [​IMG] Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.

    [​IMG] Download Sophos Free Virus Removal Tool and save it to your desktop.
    • Double click the icon and select Run
    • Click Next
    • Select I accept the terms in this license agreement, then click Next twice
    • Click Install
    • Click Finish to launch the program
    • Once the virus database has been updated click Start Scanning
    • If any threats are found click Details, then View log file... (bottom left hand corner)
    • Copy and paste the results in your reply
    • Close the Notepad document, close the Threat Details screen, then click Start cleanup
    • Click Exit to close the program
     
  19. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Still with me?
     
  20. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Sorry, have been trying to take care of some tax stuff this week. Took up more time than I wanted. Getting this stuff done right now.
     
  21. Broni

    Broni Malware Annihilator Posts: 52,904   +344

  22. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Results of screen317's Security Check version 0.99.99
    x64 (UAC is enabled)
    Internet Explorer 11
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    Windows Firewall Disabled!
    Windows Defender
    avast! Antivirus
    Antivirus up to date!
    `````````Anti-malware/Other Utilities Check:`````````
    Java 8 Update 25
    Java version 32-bit out of Date!
    Adobe Flash Player 16.0.0.305 Flash Player out of Date!
    Adobe Reader XI
    Mozilla Firefox (36.0.4)
    Google Chrome (41.0.2272.101)
    Google Chrome (41.0.2272.89)
    ````````Process Check: objlist.exe by Laurent````````
    Comodo Firewall cmdagent.exe
    AVAST Software Avast AvastSvc.exe
    AVAST Software Avast avastui.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: %
    ````````````````````End of Log``````````````````````
     
  23. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Farbar Service Scanner Version: 17-01-2015
    Ran by Home (administrator) on 30-03-2015 at 20:58:44
    Running from "C:\Users\Home\Downloads"
    Microsoft Windows 8.1 (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall"=DWORD:0


    System Restore:
    ============

    System Restore Policy:
    ========================


    Action Center:
    ============


    Windows Update:
    ============
    wuauserv Service is not running. Checking service configuration:
    The start type of wuauserv service is set to Demand. The default start type is Auto.
    The ImagePath of wuauserv service is OK.
    The ServiceDll of wuauserv service is OK.


    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend: ""%ProgramFiles%\Windows Defender\MsMpEng.exe"".


    Windows Defender Disabled Policy:
    ==========================
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1


    Other Services:
    ==============


    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => File is digitally signed
    C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
    C:\Windows\System32\dhcpcore.dll => File is digitally signed
    C:\Windows\System32\drivers\afd.sys => File is digitally signed
    C:\Windows\System32\drivers\tdx.sys => File is digitally signed
    C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
    C:\Windows\System32\dnsrslvr.dll => File is digitally signed
    C:\Windows\System32\mpssvc.dll => File is digitally signed
    C:\Windows\System32\bfe.dll => File is digitally signed
    C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
    C:\Windows\System32\wscsvc.dll => File is digitally signed
    C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
    C:\Windows\System32\wuaueng.dll => File is digitally signed
    C:\Windows\System32\qmgr.dll => File is digitally signed
    C:\Windows\System32\es.dll => File is digitally signed
    C:\Windows\System32\cryptsvc.dll => File is digitally signed
    C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
    C:\Program Files\Windows Defender\MsMpEng.exe => File is digitally signed
    C:\Windows\System32\ipnathlp.dll => File is digitally signed
    C:\Windows\System32\iphlpsvc.dll => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed


    **** End of log ****
     
  24. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Sophos scan is taking a while, will post soon
     
  25. mom26gr8kids

    mom26gr8kids TS Guru Topic Starter Posts: 452

    Sophos found no threats
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...