Leftover grief from trojan Tiggre!rfn

Jean, please try the same fix again but in normal mode, not safe mode. When that is done, please post the results as well as fresh FRST logs.

Thanks!

Please do the following to provide fresh FRST logs:
  • Right click to run as administrator. When the tool opens click Yes to disclaimer.
  • Note: After FRST completes updating and the tool appears, check the box next to Addition.txt under the "Optional Scan" section
  • Press Scan button.
  • Please copy/paste both logs in your reply.
 
OK, ran FRST Fix in normal. Txt below.

However, on restart in normal - message "Win updates failed, restoring". Automatic shutdown, then same BSOD and restart completed into normal. MSE notifies Tiggre!rfn still present (removed).
P.S. Insight on Windows update failure: I'm assuming there is a .NET framework item in Updates - for months that has been failing to install, and I have given up and deselected it when I have installed others. (While I'm waiting, I'll manually select it out and retry this months Updates)

Back to scan logs requested:

Fix result of Farbar Recovery Scan Tool (x64) Version: 25.04.2018Ran by 2018Jean (29-04-2018 13:00:18) Run:6
Running from C:\Users\2018Jean\Desktop\Cooties\FRST scan
Loaded Profiles: 2018Jean (Available Profiles: 2018Jean & Administrator)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
CloseProcesses:
Unlock: C:\Windows\system32\drivers\dwrpswzc.sys
C:\Windows\system32\drivers\dwrpswzc.sys
Unlock: HKLM\SYSTEM\CurrentControlSet\Services\osvgw
Reg: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\osvgw" /f
EmptyTemp:


*****************


Restore point was successfully created.
Processes closed successfully.
"C:\Windows\system32\drivers\dwrpswzc.sys" => not found
"C:\Windows\system32\drivers\dwrpswzc.sys" => not found
"HKLM\SYSTEM\CurrentControlSet\Services\osvgw" => key could not be unlocked


========= reg delete "HKLM\SYSTEM\CurrentControlSet\Services\osvgw" /f =========


ERROR: The system was unable to find the specified registry key or value.




========= End of Reg: =========




=========== EmptyTemp: ==========


BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 3149032 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 7556583 B
Edge => 0 B
Chrome => 17342965 B
Firefox => 0 B
Opera => 0 B


Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
*****************************************************


2018-04-25 17:21 - 2018-04-28 09:53 - 000300770 ____N C:\Windows\Minidump\042818-41839-01.dmp
2018-04-25 17:21 - 2018-04-28 09:05 - 000300770 ____N C:\Windows\Minidump\042818-41465-01.dmp
2018-04-25 17:21 - 2018-04-28 08:09 - 000300770 ____N C:\Windows\Minidump\042818-45365-01.dmp
2018-04-25 17:21 - 2018-04-27 13:37 - 000300770 ____N C:\Windows\Minidump\042718-49452-01.dmp
2018-04-25 17:21 - 2018-04-26 19:17 - 000300770 ____N C:\Windows\Minidump\042618-56472-01.dmp
2018-04-25 17:21 - 2018-04-26 17:10 - 000300898 ____N C:\Windows\Minidump\042618-63898-01.dmp
2018-04-25 16:02 - 2018-04-25 17:26 - 000000000 ___HD C:\$WINDOWS.~BT
2018-04-25 16:00 - 2018-04-29 13:21 - 000000000 ____D C:\Users\2018Jean\Desktop\Cooties
2018-04-25 15:55 - 2018-04-25 15:55 - 000000000 ____D C:\Users\2018Jean\AppData\Local\dsevumr
2018-04-25 15:05 - 2018-04-25 15:05 - 000000000 ____D C:\Users\2018Jean\AppData\Local\wmodzib
2018-04-25 13:37 - 2018-04-26 17:38 - 000192952 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2018-04-25 13:37 - 2018-04-25 13:37 - 000253664 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2018-04-25 13:37 - 2018-04-25 13:37 - 000093816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2018-04-25 13:37 - 2018-04-25 13:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-04-25 13:36 - 2018-04-25 13:36 - 000000000 ____D C:\Program Files\Malwarebytes
2018-04-25 13:36 - 2018-03-19 12:57 - 000076192 _____ C:\Windows\system32\Drivers\mbae64.sys
2018-04-25 12:28 - 2018-04-25 12:28 - 000003160 _____ C:\Windows\System32\Tasks\{19FA1E7F-C63E-4A46-97A3-3F34BC31D6C0}
2018-04-25 11:45 - 2018-04-25 11:31 - 017391963 ____N C:\EvtxAppDump.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 012564416 ____N C:\EvtxSysDump.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 001412796 ____N C:\MSInfo32.nfo
2018-04-25 11:45 - 2018-04-25 11:31 - 000300898 ____N C:\042318-80246-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300770 ____N C:\042318-58781-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300770 ____N C:\042318-33181-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300770 ____N C:\042318-32900-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300770 ____N C:\042218-79700-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300770 ____N C:\042218-52151-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300770 ____N C:\042218-154815-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300770 ____N C:\042218-148684-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300770 ____N C:\042118-40248-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300770 ____N C:\042118-32417-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300770 ____N C:\042118-30170-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300770 ____N C:\042118-28204-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300194 ____N C:\042318-43165-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000300194 ____N C:\042218-45037-01.dmp
2018-04-25 11:45 - 2018-04-25 11:31 - 000275160 ____N C:\WERProgramData
2018-04-25 11:45 - 2018-04-25 11:31 - 000259762 ____N C:\SysList.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000197556 ____N C:\WERALL.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000177720 ____N C:\TasklistSVCHOST.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000096382 ____N C:\NetstatJcgriff2
2018-04-25 11:45 - 2018-04-25 11:31 - 000066126 ____N C:\DriverqV.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000060895 ____N C:\HKLMSoftMSWinCVUninstall.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000052704 ____N C:\DxDiagx86.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000038738 ____N C:\DriverqFo.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000016195 ____N C:\WERLocalAppData
2018-04-25 11:45 - 2018-04-25 11:31 - 000015797 ____N C:\DriverqSi.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000015699 ____N C:\NetSHLAN1.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000014138 ____N C:\Jcgriff2Log.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000013802 ____N C:\SystemInfo.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000010024 ____N C:\RAMInfo.html
2018-04-25 11:45 - 2018-04-25 11:31 - 000009566 ____N C:\HKLMSoftMSA-SInstalledComponents.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000007607 ____N C:\IPconfigAll.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000003987 ____N C:\SetEnvironmentVar.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000002199 ____N C:\KernelDumpList.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000002047 ____N C:\Hosts.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000001338 ____N C:\WMICRecoveros.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000001278 ____N C:\BSODPostingInstructions.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000001213 ____N C:\Tracert.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000000002 ____N C:\HKCUSoftMSWinCVUninstall.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000000002 ____N C:\Autoruns.txt
2018-04-25 11:45 - 2018-04-25 11:31 - 000000000 ____N C:\NetstatJcgriff2.StdErr
2018-04-24 20:51 - 2018-04-26 15:01 - 000000000 ____D C:\Users\2018Jean\AppData\Local\sictnhk
2018-04-24 20:38 - 2018-04-27 18:00 - 000000000 ____D C:\Users\2018Jean\AppData\LocalLow\Mozilla
2018-04-24 20:38 - 2018-04-24 20:38 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\Mozilla
2018-04-24 20:38 - 2018-04-24 20:38 - 000000000 ____D C:\Users\2018Jean\AppData\Local\Mozilla
2018-04-24 16:27 - 2018-04-24 16:27 - 000001245 _____ C:\Users\2018Jean\AppData\Local\recently-used.xbel
2018-04-23 19:41 - 2018-04-23 19:41 - 000000000 ____D C:\Users\2018Jean\AppData\Local\vdewzng
2018-04-23 18:13 - 2018-04-23 18:14 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\PeaZip
2018-04-23 18:06 - 2018-04-23 18:06 - 000000000 ____D C:\ProgramData\UniqueId
2018-04-23 17:38 - 2018-04-23 18:53 - 000000140 _____ C:\Windows\Reimage.ini
2018-04-23 17:07 - 2018-04-23 17:07 - 000000000 ____D C:\SFCFix
2018-04-23 16:29 - 2018-04-23 19:48 - 000000000 ____D C:\Users\2018Jean\AppData\Local\niemiro
2018-04-23 16:18 - 2018-04-23 16:18 - 000000000 ____D C:\Users\2018Jean\AppData\Local\sbexiwt
2018-04-23 16:14 - 2018-04-29 13:13 - 002888704 _____ (TOSHIBA CORPORATION) C:\Windows\system32\sbalwomsvc.exe
2018-04-23 15:57 - 2018-04-23 16:10 - 000000000 ____D C:\ProgramData\SecTaskMan
2018-04-23 15:53 - 2018-04-23 15:53 - 000000000 ____D C:\Users\Administrator\AppData\Local\ElevatedDiagnostics
2018-04-23 15:51 - 2018-04-23 15:51 - 000000000 ___HD C:\$Windows.~WS
2018-04-23 15:45 - 2018-04-23 15:45 - 000000000 ____D C:\Users\Administrator\AppData\Local\cwclsuo
2018-04-23 15:15 - 2018-04-23 15:15 - 000000000 ____D C:\Users\New User\AppData\Local\NPE
2018-04-23 14:38 - 2018-04-23 14:43 - 000000000 ____D C:\Users\Administrator\AppData\Local\Smith Micro
2018-04-23 14:38 - 2018-04-23 14:38 - 000000000 ____D C:\Users\Administrator\Documents\My Archives
2018-04-23 14:33 - 2018-04-23 15:53 - 000000000 ____D C:\ESD
2018-04-23 14:28 - 2018-04-23 14:28 - 018617536 _____ (Microsoft Corporation) C:\Users\Administrator\Desktop\MediaCreationTool.exe
2018-04-23 13:57 - 2018-04-23 13:57 - 000000000 ____D C:\Users\Administrator\AppData\Local\avcskld
2018-04-23 11:44 - 2018-04-23 11:44 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2018-04-23 11:43 - 2018-04-23 11:43 - 000141864 _____ C:\Users\Administrator\Desktop\bluescreenview_setup.exe
2018-04-23 11:26 - 2018-04-23 11:26 - 000000476 _____ C:\Users\Administrator\Desktop\Local Disk.lnk
2018-04-23 10:38 - 2018-04-23 10:38 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
2018-04-23 09:57 - 2018-04-23 09:57 - 000001380 _____ C:\Users\Administrator\Desktop\NOT SEEN YET.lnk
2018-04-23 09:57 - 2018-04-20 10:07 - 000002162 _____ C:\Users\Administrator\Desktop\$$.lnk
2018-04-23 09:56 - 2018-04-23 09:56 - 000000000 ____D C:\Users\Administrator\AppData\Local\wmcagent
2018-04-23 09:56 - 2018-04-22 17:36 - 000002057 _____ C:\Users\Administrator\Desktop\Litter.lnk
2018-04-23 09:53 - 2018-04-23 09:53 - 000001160 _____ C:\Users\Administrator\Desktop\Jean Desktop.lnk
2018-04-22 20:43 - 2018-04-22 20:43 - 000000000 ____D C:\Users\2018Jean\AppData\Local\ElevatedDiagnostics
2018-04-22 20:20 - 2018-04-22 20:20 - 000000000 ____D C:\Users\2018Jean\Documents\My Archives
2018-04-22 17:36 - 2018-04-22 17:36 - 000002057 _____ C:\Users\2018Jean\Desktop\Litter.lnk
2018-04-22 08:06 - 2018-04-22 08:06 - 000002459 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Distiller 7.0.lnk
2018-04-22 08:06 - 2018-04-22 08:06 - 000002453 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Designer 7.0.lnk
2018-04-22 08:06 - 2018-04-22 08:06 - 000002447 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 7.0 Professional.lnk
2018-04-21 21:42 - 2018-04-29 10:32 - 002022378 _____ C:\Windows\ntbtlog.txt
2018-04-21 20:39 - 2018-04-21 21:21 - 000000000 ____D C:\Program Files (x86)\Zemana AntiMalware
2018-04-21 20:32 - 2018-04-21 20:32 - 000000000 ____D C:\Users\2018Jean\AppData\Local\Zemana
2018-04-21 20:02 - 2018-04-21 20:02 - 000000000 ____D C:\Users\2018Jean\AppData\Local\CEF
2018-04-21 20:01 - 2018-04-21 20:02 - 000000000 ____D C:\Users\2018Jean\AppData\Local\wmcagent
2018-04-21 20:01 - 2018-04-21 20:01 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\Macromedia
2018-04-21 19:55 - 2018-04-23 15:36 - 002888704 _____ C:\Windows\SysWOW64\sbalwomsvc.exe
2018-04-21 19:50 - 2018-04-21 20:01 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\AGData
2018-04-21 19:49 - 2018-04-21 20:45 - 000000000 ____D C:\Program Files (x86)\coordinator
2018-04-21 19:49 - 2018-04-21 19:49 - 000003882 _____ C:\Windows\System32\Tasks\nipples
2018-04-21 19:49 - 2018-04-21 19:49 - 000003740 _____ C:\Windows\System32\Tasks\Sanipplesnipples
2018-04-21 19:49 - 2018-04-21 19:49 - 000000012 _____ C:\Windows\b72651245
2018-04-21 19:49 - 2018-04-21 19:49 - 000000000 ___HD C:\Program Files (x86)\hinch
2018-04-21 19:49 - 2018-04-21 19:49 - 000000000 ___HD C:\Program Files (x86)\Eduard
2018-04-21 19:49 - 2018-04-21 19:49 - 000000000 ____D C:\Windows\SysWOW64\lsebtrx
2018-04-21 19:49 - 2018-04-21 19:49 - 000000000 ____D C:\Windows\system32\lsebtrx
2018-04-21 19:49 - 2018-04-21 19:49 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\et
2018-04-21 19:49 - 2018-04-21 19:49 - 000000000 ____D C:\Program Files (x86)\fighter
2018-04-21 19:49 - 2018-04-21 19:49 - 000000000 ____D C:\Program Files (x86)\Chalice
2018-04-21 19:48 - 2018-04-26 17:49 - 000000000 ____D C:\ProgramData\Arkei-{601A1EDD-2C55-4B67-98FF-D1B2BB6FD336}
2018-04-21 19:48 - 2018-04-26 16:04 - 000000000 ____D C:\Users\2018Jean\AppData\Local\CrashDumps
2018-04-21 17:02 - 2018-04-21 17:02 - 000051200 _____ C:\Windows\nuances.exe
2018-04-21 17:02 - 2018-04-21 17:02 - 000051200 _____ C:\Users\2018Jean\AppData\Local\undermining.exe
2018-04-21 17:02 - 2018-04-21 17:02 - 000051200 _____ C:\Users\2018Jean\AppData\Local\Slighting.exe
2018-04-21 10:03 - 2018-04-22 08:06 - 000000000 ____D C:\Users\Public\Documents\Adobe PDF
2018-04-17 16:28 - 2018-04-23 18:03 - 000000000 ____D C:\Users\2018Jean\AppData\Local\Smith Micro
2018-04-16 10:40 - 2018-04-16 10:40 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\AdobeUM
2018-04-14 14:39 - 2018-04-14 14:39 - 000000000 ____D C:\Users\2018Jean\AppData\LocalLow\Adobe
2018-04-13 15:18 - 2018-04-28 17:52 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\vlc
2018-04-13 13:38 - 2018-04-20 15:51 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\deluge
2018-04-13 12:47 - 2018-04-26 11:51 - 000002162 _____ C:\Users\2018Jean\Desktop\$$.lnk
2018-04-13 12:46 - 2018-04-13 12:19 - 000746554 _____ C:\Users\2018Jean\bookmarks_4_13_18.html
2018-04-13 12:45 - 2018-04-13 12:45 - 000001952 _____ C:\Users\2018Jean\Desktop\FileCabinet.lnk
2018-04-13 12:11 - 2018-04-13 12:11 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
2018-04-13 12:10 - 2018-04-13 12:10 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\Google
2018-04-13 12:06 - 2018-04-13 12:06 - 000003416 _____ C:\Users\2018Jean\Layout 1600 x 900 (32).dtr
2018-04-13 12:03 - 2018-04-27 12:07 - 000000000 ____D C:\Users\2018Jean\AppData\Local\VirtualStore
2018-04-13 11:51 - 2018-04-12 14:25 - 005767168 _____ C:\Users\2018Jean\ntuser (2).dat
2018-04-13 11:37 - 2014-06-25 12:28 - 000002286 ____H C:\Users\2018Jean\Documents\Default.rdp
2018-04-13 11:21 - 2018-04-22 17:36 - 000000000 ___RD C:\Users\2018Jean\FileCabinet
2018-04-13 11:21 - 2015-09-22 14:43 - 000000000 ____D C:\Users\2018Jean\DuOSShare
2018-04-13 10:58 - 2018-04-13 14:03 - 000000000 ____D C:\Users\2018Jean\.jbidwatcher
2018-04-13 10:58 - 2018-04-13 14:02 - 000000000 ____D C:\Users\2018Jean\.oracle_jre_usage
2018-04-13 10:58 - 2018-04-13 10:58 - 000000000 ____D C:\Users\2018Jean\Song Surgeon 4
2018-04-13 10:58 - 2018-04-13 10:58 - 000000000 ____D C:\Users\2018Jean\Prismatik
2018-04-13 10:58 - 2018-04-13 10:58 - 000000000 ____D C:\Users\2018Jean\.FBReader
2018-04-13 10:58 - 2018-04-13 10:58 - 000000000 ____D C:\Users\2018Jean\.cache
2018-04-13 10:58 - 2018-04-13 10:58 - 000000000 ____D C:\Users\2018Jean\.android
2018-04-13 10:58 - 2018-02-05 14:51 - 002080256 ___SH C:\Users\2018Jean\Desktop\Thumbs.db
2018-04-13 10:58 - 2018-01-24 15:13 - 000002298 _____ C:\Users\2018Jean\Desktop\Brian Desktop.lnk
2018-04-13 10:58 - 2017-08-13 11:31 - 000000476 _____ C:\Users\2018Jean\Desktop\Local Disk.lnk
2018-04-13 10:58 - 2017-07-01 20:05 - 000002303 _____ C:\Users\2018Jean\DesktopWin10Tool.txt
2018-04-13 10:58 - 2015-07-15 20:10 - 000000032 _____ C:\Users\2018Jean\.deskmetrics
2018-04-13 10:39 - 2018-04-13 12:05 - 000000000 ____D C:\Users\2018Jean\AppData\Local\NVIDIA Corporation
2018-04-13 10:38 - 2018-04-28 17:21 - 000000000 ____D C:\Users\2018Jean\AppData\Local\Adobe
2018-04-13 10:38 - 2018-04-22 08:31 - 000091136 _____ C:\Users\2018Jean\AppData\Local\GDIPFONTCACHEV1.DAT
2018-04-13 10:38 - 2018-04-13 10:38 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\Roxio
2018-04-13 10:38 - 2018-04-13 10:38 - 000000000 ____D C:\Users\2018Jean\AppData\Local\NVIDIA
2018-04-13 10:37 - 2018-04-25 18:29 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\Adobe
2018-04-13 10:37 - 2018-04-25 15:14 - 000000000 ____D C:\Users\2018Jean\AppData\Local\Google
2018-04-13 10:37 - 2018-04-23 09:53 - 000000000 ____D C:\Users\2018Jean
2018-04-13 10:37 - 2018-04-13 10:37 - 000001417 _____ C:\Users\2018Jean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2018-04-13 10:37 - 2018-04-13 10:37 - 000000020 ___SH C:\Users\2018Jean\ntuser.ini
2018-04-13 10:37 - 2018-04-13 10:37 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\Sony Corporation
2018-04-13 10:37 - 2009-07-14 03:44 - 000000000 ____D C:\Users\2018Jean\AppData\Roaming\Media Center Programs
2018-04-13 06:45 - 2018-04-13 06:45 - 004279968 _____ (NeoSoft Tools ) C:\Users\2018Jean\AppData\Roaming\ctask.exe
2018-04-12 19:06 - 2018-04-26 09:17 - 136971704 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2018-04-12 16:19 - 2018-04-13 09:13 - 000003634 _____ C:\Windows\System32\Tasks\WizMouse
2018-04-07 16:27 - 2018-04-07 16:27 - 000001409 _____ C:\Windows\QTFont.for


==================== One Month Modified files and folders ========


(If an entry is included in the fixlist, the file/folder will be moved.)


2018-04-29 13:25 - 2009-07-13 22:34 - 021233664 _____ C:\Windows\system32\config\HARDWARE
2018-04-29 13:24 - 2009-07-14 00:45 - 000018928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-04-29 13:24 - 2009-07-14 00:45 - 000018928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-04-29 13:21 - 2009-07-14 01:13 - 000006878 _____ C:\Windows\system32\PerfStringBackup.INI
2018-04-29 13:20 - 2014-12-09 16:11 - 000000000 ____D C:\Program Files\SoftEther VPN Client
2018-04-29 13:20 - 2014-05-11 09:56 - 000000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2018-04-29 13:14 - 2009-07-14 00:45 - 005102016 _____ C:\Windows\system32\FNTCACHE.DAT
2018-04-29 13:13 - 2015-02-19 21:06 - 000000000 ____D C:\Windows\Minidump
2018-04-29 13:13 - 2009-07-14 01:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-04-29 13:12 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\inf
2018-04-29 13:11 - 2015-04-17 11:41 - 000000000 ____D C:\Windows\system32\appraiser
2018-04-29 13:10 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\SysWOW64\Setup
2018-04-29 13:10 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\system32\Setup
2018-04-28 08:13 - 2015-08-14 13:21 - 000000000 ____D C:\ProgramData\Sonic
2018-04-26 20:23 - 2017-02-02 17:13 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-04-26 20:23 - 2014-05-23 20:27 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-04-26 17:41 - 2014-05-21 23:15 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-04-26 17:08 - 2009-07-13 23:20 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2018-04-26 17:08 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\SysWOW64\GroupPolicy
2018-04-26 17:00 - 2014-05-26 14:10 - 000000000 ____D C:\Program Files (x86)\Java
2018-04-26 16:58 - 2014-05-11 09:56 - 000804864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-04-26 16:58 - 2014-05-11 09:56 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-04-26 16:58 - 2014-05-11 09:56 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-04-26 16:58 - 2014-05-11 09:56 - 000000000 ____D C:\Windows\system32\Macromed
2018-04-26 16:36 - 2014-05-22 10:47 - 000000000 ____D C:\Program Files (x86)\Adobe
2018-04-26 16:29 - 2014-05-22 10:47 - 000000000 ____D C:\ProgramData\Adobe
2018-04-26 11:52 - 2014-12-03 14:47 - 000000000 ____D C:\ProgramData\Package Cache
2018-04-26 09:15 - 2014-05-21 15:55 - 136971704 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2018-04-26 08:34 - 2014-07-19 19:27 - 000000000 ____D C:\ProgramData\Aimersoft Video Converter Ultimate
2018-04-26 08:27 - 2016-03-16 20:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluge
2018-04-26 08:27 - 2014-06-02 13:41 - 000000000 ____D C:\Program Files (x86)\Deluge
2018-04-25 17:29 - 2016-07-21 11:22 - 000001105 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk
2018-04-25 16:49 - 2016-07-02 14:01 - 000001908 _____ C:\Windows\diagwrn.xml
2018-04-25 16:49 - 2016-07-02 14:01 - 000001908 _____ C:\Windows\diagerr.xml
2018-04-25 16:28 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\registration
2018-04-25 16:18 - 2014-06-22 03:15 - 000000000 ____D C:\Users\Guest
2018-04-25 16:02 - 2014-05-11 01:07 - 000000000 ____D C:\Windows\Panther
2018-04-25 15:51 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042518-53586-01.dmp
2018-04-25 15:03 - 2014-05-11 00:08 - 000300898 ____N C:\Windows\Minidump\042518-50559-01.dmp
2018-04-25 14:18 - 2014-06-28 09:48 - 000000000 ____D C:\Program Files\AntiMalwareApps
2018-04-25 10:59 - 2014-05-22 21:27 - 000000000 ____D C:\Users\Administrator
2018-04-23 19:38 - 2014-05-11 00:08 - 000300898 ____N C:\Windows\Minidump\042318-80246-01.dmp
2018-04-23 18:53 - 2014-06-16 15:49 - 000000000 ____D C:\ProgramData\WinZip
2018-04-23 18:25 - 2009-07-13 19:29 - 008338432 _____ (Microsoft Corporation) C:\Windows\system32\spwizimg.dll
2018-04-23 18:13 - 2015-05-23 09:32 - 000000000 ____D C:\ProgramData\Unchecky
2018-04-23 18:13 - 2014-07-02 15:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeaZip
2018-04-23 18:13 - 2014-07-02 15:25 - 000000000 ____D C:\Program Files\PeaZip
2018-04-23 18:07 - 2009-07-13 22:34 - 000000477 _____ C:\Windows\win.ini
2018-04-23 15:36 - 2014-05-11 00:08 - 000300194 ____N C:\Windows\Minidump\042318-43165-01.dmp
2018-04-23 13:53 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042318-33181-01.dmp
2018-04-23 12:43 - 2014-05-11 00:17 - 000000000 ____D C:\Users\New User
2018-04-23 12:42 - 2016-12-26 13:58 - 000000000 ____D C:\Users\New User\AppData\Roaming\Kodi
2018-04-23 12:42 - 2014-05-11 09:58 - 000000000 ____D C:\Users\New User\AppData\Roaming\Adobe
2018-04-23 12:17 - 2009-07-14 00:57 - 000001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2018-04-23 12:10 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042318-58781-01.dmp
2018-04-23 10:57 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042318-32900-01.dmp
2018-04-23 09:49 - 2014-05-22 21:28 - 000091136 _____ C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2018-04-22 20:36 - 2014-05-11 00:08 - 000300194 ____N C:\Windows\Minidump\042218-45037-01.dmp
2018-04-22 19:54 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042218-52151-01.dmp
2018-04-22 18:50 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042218-154815-01.dmp
2018-04-22 07:22 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042218-79700-01.dmp
2018-04-22 07:02 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042218-148684-01.dmp
2018-04-21 22:13 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042118-30170-01.dmp
2018-04-21 22:09 - 2015-02-26 16:38 - 000000000 ____D C:\Windows\pss
2018-04-21 21:42 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042118-28204-01.dmp
2018-04-21 21:36 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042118-32417-01.dmp
2018-04-21 21:24 - 2014-05-11 00:08 - 000300770 ____N C:\Windows\Minidump\042118-40248-01.dmp
2018-04-21 20:52 - 2015-11-14 22:18 - 000054053 _____ C:\Windows\ZAM.krnl.trace
2018-04-21 20:52 - 2015-11-14 22:18 - 000053404 _____ C:\Windows\ZAM_Guard.krnl.trace
2018-04-14 16:14 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\rescache
2018-04-13 16:12 - 2014-05-24 17:41 - 000000000 ____D C:\Update
2018-04-13 14:45 - 2014-05-11 07:58 - 000000021 _____ C:\Windows\Model.txt
2018-04-13 14:34 - 2014-11-16 17:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JBidwatcher
2018-04-13 14:34 - 2014-11-16 17:58 - 000000000 ____D C:\Program Files (x86)\CyberFOX Software
2018-04-13 09:37 - 2014-05-22 21:28 - 000000000 ____D C:\Users\Administrator\AppData\Local\Google
2018-04-12 19:06 - 2014-05-21 15:55 - 000000000 ____D C:\Windows\system32\MRT
2018-04-12 16:55 - 2015-03-27 21:29 - 000028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2018-04-12 16:54 - 2015-03-27 21:29 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2018-04-12 16:18 - 2009-07-14 01:09 - 000000000 ____D C:\Windows\System32\Tasks\WPD
2018-04-07 16:27 - 2015-02-27 16:44 - 000054156 ____H C:\Windows\QTFont.qfn
2018-04-04 14:18 - 2014-05-31 09:31 - 000000564 _____ C:\Windows\WORDPAD.INI
2018-04-03 16:23 - 2015-01-24 17:40 - 000000000 ____D C:\Program Files (x86)\TurboTax
2018-04-01 10:39 - 2009-07-14 01:08 - 000032646 _____ C:\Windows\Tasks\SCHEDLGU.TXT


==================== Files in the root of some directories =======


2018-04-13 11:51 - 2018-04-12 14:25 - 005767168 _____ () C:\Users\2018Jean\ntuser (2).dat
2014-05-30 23:00 - 2014-05-30 23:00 - 000001705 _____ () C:\Program Files\Add-Take-Ownership-Option.zip
2015-03-07 17:48 - 2015-03-07 17:49 - 002913497 _____ (Saru Software®) C:\Program Files\Clock.exe
2014-05-22 18:47 - 2008-03-27 19:45 - 000480768 _____ (Pablo Software Solutions) C:\Program Files\FTPWanderer.exe
2015-02-26 16:51 - 2015-02-02 14:13 - 001388274 _____ (Thisisu) C:\Program Files\JRT_NEW.exe
2008-08-10 13:09 - 2008-08-10 13:09 - 001083904 _____ (Squared 5) C:\Program Files\MPEG_Streamclip.exe
2014-09-24 16:15 - 2007-04-20 00:35 - 000118784 _____ (Jeff Key) C:\Program Files\Ruler.exe
2013-08-26 11:55 - 2013-08-26 11:55 - 007665437 _____ (SerialBox Windows) C:\Program Files\SerialBox Windows V0.1.5 Portable.exe
2014-05-22 19:35 - 2014-06-02 13:19 - 000000481 _____ () C:\Program Files\sites.xml
2015-10-25 12:11 - 2015-10-25 12:11 - 000000900 _____ () C:\Program Files (x86)\Adobe Spare dll file - Shortcut.lnk
2012-08-19 12:35 - 2012-08-19 12:35 - 000899584 _____ (Squared 5) C:\Program Files (x86)\MPEG_Streamclip.exe
2016-07-08 12:09 - 2016-07-08 16:17 - 021737496 _____ (LastPass) C:\Program Files (x86)\Common Files\lpuninstall.exe
2018-04-13 06:45 - 2018-04-13 06:45 - 004279968 _____ (NeoSoft Tools ) C:\Users\2018Jean\AppData\Roaming\ctask.exe
2018-04-25 18:30 - 2018-04-25 18:30 - 000001456 _____ () C:\Users\2018Jean\AppData\Local\Adobe Save for Web 13.0 Prefs
2018-04-24 16:27 - 2018-04-24 16:27 - 000001245 _____ () C:\Users\2018Jean\AppData\Local\recently-used.xbel
2018-04-21 17:02 - 2018-04-21 17:02 - 000051200 _____ () C:\Users\2018Jean\AppData\Local\Slighting.exe
2018-04-21 17:02 - 2018-04-21 17:02 - 000051200 _____ () C:\Users\2018Jean\AppData\Local\undermining.exe


==================== Bamital & volsnap ======================


(There is no automatic fix for files that do not pass verification.)


C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
C:\Windows\system32\drivers\dwrzcfjm.sys -> Access Denied <======= ATTENTION


LastRegBack: 2018-04-28 19:06


==================== End of FRST.txt ==========

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25.04.2018
Ran by 2018Jean (29-04-2018 13:26:34)
Running from C:\Users\2018Jean\Desktop\Cooties\FRST
Windows 7 Home Premium Service Pack 1 (X64) (2014-05-11 04:17:47)
Boot Mode: Normal
==========================================================




==================== Accounts: =============================


2018Jean (S-1-5-21-4256033146-2562541644-1532691662-1006 - Administrator - Enabled) => C:\Users\2018Jean
Administrator (S-1-5-21-4256033146-2562541644-1532691662-500 - Administrator - Enabled) => C:\Users\Administrator
Guest (S-1-5-21-4256033146-2562541644-1532691662-501 - Administrator - Enabled)


==================== Security Center ========================


(If an entry is included in the fixlist, it will be removed.)


AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


==================== Installed Programs ======================


(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)


AC3Filter (remove only) (HKLM-x32\...\AC3Filter) (Version: - )
ACID Pro 7.0 (HKLM-x32\...\{BFA5441E-B7E6-46F5-A15D-1B74707AE93A}) (Version: 7.0.641 - Sony)
Acronis Drive Monitor (HKLM-x32\...\{706AE61D-40A4-4F50-8359-FE8F6F7FA461}) (Version: 1.0.566 - Acronis)
Adobe Acrobat 7.0 Professional - English, Français, Deutsch (HKLM-x32\...\Adobe Acrobat 7.0 Professional - English, Français, Deutsch - V) (Version: 7.0.0 - Adobe Systems)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.011.20038 - Adobe Systems Incorporated)
Adobe Flash Player 29 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 29.0.0.140 - Adobe Systems Incorporated)
Adobe Flash Player 29 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 29.0.0.140 - Adobe Systems Incorporated)
Adobe Flash Player 29 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 29.0.0.140 - Adobe Systems Incorporated)
Adobe GoLive CS2 English (HKLM-x32\...\Adobe GoLive CS2 English) (Version: 8.0 - Adobe Systems)
Adobe InDesign CS2 (HKLM-x32\...\Adobe InDesign CS2 - {7F4C8163-F259-49A0-A018-2857A90578BC}) (Version: 004.000.000 - Adobe Systems Incorporated)
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe SVG Viewer 3.0 (HKLM-x32\...\Adobe SVG Viewer) (Version: 3.0 - Adobe Systems, Inc.)
Aimersoft Video Converter Ultimate(Build 6.2.0.0) (HKLM-x32\...\Aimersoft Video Converter Ultimate_is1) (Version: 6.2.0.0 - Aimersoft Software)
Airfoil (HKLM-x32\...\Airfoil) (Version: 3.5.0 - Rogue Amoeba)
Alps Pointing-device for VAIO (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: - ALPS ELECTRIC CO., LTD.)
ArcSoft WebCam Companion 3 (HKLM-x32\...\{DE8AAC73-6D8D-483E-96EA-CAEDDADB9079}) (Version: 3.0.21.390 - ArcSoft)
ASIO Bridge and Hi-Fi Cable (HKLM-x32\...\VB:ASIOBridge {17359A74-1236-5467}) (Version: - VB-Audio Software)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Avidemux 2.6 - 64bits (HKLM-x32\...\Avidemux 2.6 - 64bits (64-bit)) (Version: 2.6.8.9046 - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Callcentric Softphone (HKLM-x32\...\{CEA83C20-AFCB-426C-89ED-0AC90015F04B}) (Version: 2.0.4 - Callcentric)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: - Canon Inc.)
Canon MG2500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2500_series) (Version: 1.02 - Canon Inc.)
Canon MG2500 series On-screen Manual (HKLM-x32\...\Canon MG2500 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon MG2500 series User Registration (HKLM-x32\...\Canon MG2500 series User Registration) (Version: - *Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Core Temp 1.1 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.1 - Alcpu)
CrystalDiskInfo 7.6.0 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 7.6.0 - Crystal Dew World)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Desktop Restore version 1.6.4 (HKLM\...\{DBD4F07A-7607-4A4F-A46C-6AA399E06E38}_is1) (Version: 1.6.4 - Jamie O'Connell)
DLNow 1.2 (HKLM-x32\...\DLNow) (Version: 1.2 - Logixoft)
DNS Leak Fix for OpenVPN version 1.2 (HKLM-x32\...\{8CFA1D01-AECD-4913-9FB8-1E8A82F47824}_is1) (Version: 1.2 - dnsleaktest.com)
Doxillion Document Converter (HKLM-x32\...\Doxillion) (Version: 2.71 - NCH Software)
Dream Aquarium (HKLM-x32\...\Dream Aquarium) (Version: - )
DVD Audio Extractor 7.2.0 (HKLM-x32\...\DVD Audio Extractor_is1) (Version: - Computer Application Studio)
DVD Decrypter (Remove Only) (HKLM-x32\...\DVD Decrypter) (Version: - )
Express Burn Disc Burning Software (HKLM-x32\...\ExpressBurn) (Version: 6.09 - NCH Software)
Fast Duplicate File Finder 4.1.0.1 (HKLM-x32\...\{AFECFED6-0A43-488F-8511-1DC6B52F31C3}_is1) (Version: 4.1.0.1 - MindGems, Inc.)
FBReader for Windows (HKLM-x32\...\FBReader for Windows) (Version: - )
FileZilla Client 3.14.0 (HKLM-x32\...\FileZilla Client) (Version: 3.14.0 - Tim Kosse)
Folder Colorizer version 1.3.3 (HKLM\...\{A133E9CD-2879-4F30-87D4-1604AFD5C5CC}_is1) (Version: 1.3.3 - Softorino)
Folder Size 3.4.0.0 (HKLM-x32\...\{2DFA85ED-588F-4CE3-A175-29E52C3804A8}_is1) (Version: 3.4.0.0 - MindGems, Inc.)
Gihosoft Free Youtube Downloader version 1.2.7.0 (HKLM-x32\...\{222ECA2E-17A6-4914-922A-BABE02869072}_is1) (Version: 1.2.7.0 - HONGKONG JIHO CO., LIMITED)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 66.0.3359.139 - Google Inc.)
Google Drive (HKLM-x32\...\{9BC95947-92FD-438B-A168-C01F9A5B7292}) (Version: 2.34.7529.6838 - Google, Inc.)
Google Talk Plugin (HKLM-x32\...\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
InstallShield Tuner 7.0 for Adobe Acrobat (HKLM-x32\...\{E32FC3D8-D106-425E-9F9E-8BE6E2E79AC9}) (Version: 7.0 - Adobe)
IObit Unlocker (HKLM-x32\...\IObit Unlocker_is1) (Version: 1.1 - IObit)
ISO Opener (HKLM-x32\...\{CE235F00-F8CD-41AF-83D5-236D90E33BFB}_is1) (Version: - ISO Opener)
JBidwatcher 2.5.6 (HKLM-x32\...\JBidwatcher_0) (Version: 2.5.6 - CyberFOX Software, Inc)
JBidwatcher 2.5.6 (HKLM-x32\...\JBidwatcher_1) (Version: 2.5.6 - CyberFOX Software, Inc)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
LightScribe System Software (HKLM-x32\...\{F132000C-1CBA-458F-BF2F-FD43D59410F9}) (Version: 1.18.27.10 - LightScribe)
LightScribe Template Designs - Expressions (HKLM-x32\...\{A5CC4D86-371A-4044-A7F3-C6CFCC4CA813}) (Version: 1.18.8.111 - LightScribe)
LightScribe Template Designs - Music Pack 1 (HKLM-x32\...\{4ECA4128-8B48-44A0-90E8-B93C6A69CE4B}) (Version: 1.15.0.0 - LightScribe)
LightScribe Template Labeler (HKLM-x32\...\{8A03241E-7A3C-401D-B0CE-B3096F50AE6F}) (Version: 1.18.27.10 - LightScribe)
Loan*Calculator! Plus v3.0 (HKLM-x32\...\{D1A42E6B-7D3D-4B46-AA82-659FF905CA40}_is1) (Version: 3.0 - Pine Grove Software, LLC)
Malwarebytes version 3.4.5.2467 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.4.5.2467 - Malwarebytes)
Mediatek RT2870 Wireless LAN Card (HKLM-x32\...\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.38.101 - MediatekWiFi)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{CA8A885F-E95B-3FC6-BB91-F4D9377C7686}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Motorola Device Manager (HKLM-x32\...\{28DB8373-C1BB-444F-A427-A55585A12ED7}) (Version: 2.5.4 - Motorola Mobility)
Movie Maker (HKLM-x32\...\{38F03569-A636-4CF3-BDDE-032C8C251304}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 59.0.2 (x64 en-US) (HKLM\...\Mozilla Firefox 59.0.2 (x64 en-US)) (Version: 59.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 59.0.2 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 2015 (HKLM-x32\...\{763EF8DC-4CC0-47CA-BE1C-BDE731462250}) (Version: 16.0.02900 - Nero AG)
Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 16.0.1003 - Nero AG)
NETGEAR Genie (HKLM-x32\...\NETGEAR Genie) (Version: 2.4.12.00 - NETGEAR Inc.)
NexusFont 2.5 (ver 2.5.8.1582) (HKLM-x32\...\{EFEDD205-43FE-4208-B682-0937E803E19E}_is1) (Version: - xiles)
NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version: - )
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Graphics Driver 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
OpenOffice 4.1.0 (HKLM-x32\...\{C87EF11D-36E9-479D-9898-7541EA1E8A6A}) (Version: 4.10.9764 - Apache Software Foundation)
PeaZip 6.5.1 (WIN64) (HKLM\...\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version: 6.5.1 - Giorgio Tani)
Perfect Resize 7.0.1 Professional Edition (HKLM-x32\...\{FCADA4FF-142C-42A8-B73C-0A54A7F83345}) (Version: 7.0.1 - onOne Software)
Pismo File Mount Audit Package (HKLM\...\PismoFileMountAuditPackage) (Version: - )
Prerequisite installer (HKLM-x32\...\{799AFA36-4EA5-4323-8689-74C06645A26B}) (Version: 16.0.0000 - Nero AG) Hidden
Prism Video File Converter (HKLM-x32\...\Prism) (Version: - NCH Software)
Prismatik (remove only) (HKLM-x32\...\{2175EE1B-0160-4862-9096-C522B1B99042}_is1) (Version: 5.11.1 - Woodenshark LLC)
PVSonyDll (HKLM\...\{3D3E663D-4E7E-4577-A560-7ECDDD45548A}) (Version: 1.00.0001 - NVIDIA Corporation) Hidden
QuickGamma 2.0.0.3 (HKLM-x32\...\QuickGamma_is1) (Version: - Eberhard Werle)
QuickTime Alternative 1.81 (HKLM-x32\...\QuicktimeAlt_is1) (Version: 1.81 - )
RBVirtualFolder64Inst (HKLM\...\{9D6DFAD6-09E5-445E-A4B5-A388FEEBD90D}) (Version: 1.00.0000 - Roxio, Inc.) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6098 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver and Utility (HKLM-x32\...\{9C049509-055C-4CFF-A116-1D12312225EB}) (Version: 1.00.0199 - REALTEK Semiconductor Corp.)
Remote Keyboard (HKLM-x32\...\{25AF1025-095C-4AA9-A3FD-29710D3C3AE5}) (Version: 1.1.1.07060 - Sony Corporation) Hidden
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.4.1 - Renesas Electronics Corporation) Hidden
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.4.1 - Renesas Electronics Corporation)
River Past Audio Converter Pro (HKLM\...\Audio Converter Pro) (Version: 7.7.1 - River Past)
Roxio Creator 2011 Content (HKLM-x32\...\{9F717571-FEE8-45CD-8B03-5B2D06AD28F7}) (Version: 13.0.098 - Roxio)
Roxio Creator 2011 Pro (HKLM-x32\...\{4433FF9E-AF21-4E41-B296-4E13BF4D52F5}) (Version: 13.0 - Roxio)
Roxio PhotoShow (HKLM-x32\...\Roxio PhotoShow) (Version: 6.0 - Sonic Solutions)
Serviio (HKLM\...\Serviio) (Version: - )
SHIELD Streaming (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv) (Version: 3.1.100 - NVIDIA Corporation) Hidden
SmartSound Common Data (HKLM-x32\...\{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}) (Version: 1.1.0 - SmartSound Software Inc.) Hidden
SmartSound Common Data (HKLM-x32\...\InstallShield_{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}) (Version: 1.1.0 - SmartSound Software Inc.)
SmartSound Quicktracks 5 (HKLM-x32\...\{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}) (Version: 5.1.7 - SmartSound Software Inc.) Hidden
SmartSound Quicktracks 5 (HKLM-x32\...\InstallShield_{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}) (Version: 5.1.7 - SmartSound Software Inc.)
SmartWi Connection Utility (HKLM-x32\...\{9B5F85CA-90D4-4AFC-BB37-32477FD0D2B9}) (Version: 4.8.4.20090902.2130 - Sony)
SoftEther VPN Client (HKLM\...\softether_sevpnclient) (Version: 4.12.9514 - SoftEther VPN Project)
Song Surgeon 4.0.2.3 (HKLM-x32\...\{03853A8E-10F5-463D-8888-4D69C7C5VD1Z}_is1) (Version: - Todd, Michael & James, Inc.)
Sony Home Network Library (HKLM-x32\...\{9E39EA0D-38CD-4739-9E28-DEA4A1155522}) (Version: 2.0.0.07280 - Sony Corporation) Hidden
Sony Home Network Library (HKLM-x32\...\{D03D02D8-AB64-4785-A48E-5AA8B0FB8C14}) (Version: 2.0.0.07280 - Sony Corporation)
SoundLeech 1.0.3275.20306 (HKLM\...\{B5213A55-2258-4C85-B19E-5E5CA0B36F40}_is1) (Version: - MiLo Software)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
SQLite_3_7_8_x64 (HKLM\...\{DD54C205-43D6-4959-B97A-E52DB4A199C7}) (Version: 3.7.8.0 - Sony Corporation) Hidden
StartupMonitor (HKLM-x32\...\{76EFAC4F-1712-401F-B2AE-590B170C9BCE}) (Version: 1.0.2.0 - Mike Lin)
StuffIt 2009 (HKLM-x32\...\{7204C956-B01F-4344-9F10-67485DBE7D15}) (Version: 13.0.0 - Smith Micro)
StuffIt Expander 2011 (HKLM\...\{6B62B973-49F5-4C51-B738-93B56A963417}) (Version: 15.0.7.2518 - Smith Micro Software, Inc.)
Switch Sound File Converter (HKLM-x32\...\Switch) (Version: 4.79 - NCH Software)
Unchecky v1.2 (HKLM-x32\...\Unchecky) (Version: 1.2 - Reason Software Company Inc.)
VAIO - Remote Keyboard (HKLM-x32\...\{7396FB15-9AB4-4B78-BDD8-24A9C15D2C65}) (Version: 1.1.0.07060 - Sony Corporation)
VAIO - Xperia Link (HKLM-x32\...\{D91558BF-D1F3-411F-AEFE-8774CB406512}) (Version: 1.4.0.15030 - Sony Corporation)
VAIO Care (HKLM\...\{6EEC3E9C-3479-42EB-B93C-E7DF7927DD82}) (Version: 8.4.4.09181 - Sony Corporation)
VAIO Care (HKLM-x32\...\{00B03993-F5A1-47B1-9C54-EC8FBDDDE17E}) (Version: 6.4.2.11150 - Sony Corporation) Hidden
VAIO Care Recovery (HKLM\...\{6ED1750E-F44F-4635-8F0D-B76B9262B7FB}) (Version: 1.1.1.13230 - Sony Corporation)
VAIO Control Center (HKLM-x32\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 4.3.0.05310 - Sony Corporation)
VAIO Health Report (HKLM-x32\...\VAIO Health Report1.0) (Version: 1.0 - Sony Electronics)
VAIO Media plus (HKLM-x32\...\{8DE50158-80AA-4FF2-9E9F-0A7C46F71FCD}) (Version: 2.0.0.07280 - Sony Corporation)
VAIO Media plus Opening Movie (HKLM-x32\...\{6BF03C88-C06A-48DC-B9A1-FE72B24E5FA9}) (Version: 2.0.0.07030 - Sony Corporation)
VAIO Platform Update Program (HKLM-x32\...\{69DABBAD-F800-4060-9730-CCA6FFDC2D23}) (Version: 1.1.0.12290 - Sony Corporation)
VAIO Update (HKLM-x32\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 7.2.0.16270 - Sony Corporation)
VBCABLE, The Virtual Audio Cable (HKLM\...\VB:VBCABLE {87459874-1236-4469}) (Version: - VB-Audio Software)
VD64Inst (HKLM\...\{DB9C43F7-0B0F-4E43-9E6B-F945C71C469E}) (Version: 1.00.0000 - Roxio, Inc.) Hidden
Vegas Movie Studio HD Platinum 10.0 (HKLM-x32\...\{40AE01BE-A290-4FFB-8DAB-C624C17DC87E}) (Version: 10.0.179 - Sony)
Vegas Pro 10.0 (64-bit) (HKLM\...\{C616FD4F-11F5-11E0-A38F-0013D3D69929}) (Version: 10.0.470 - Sony)
VideoPad Video Editor (HKLM-x32\...\VideoPad) (Version: 3.24 - NCH Software)
Virtual Account Numbers (HKLM-x32\...\{0134662F-5B97-4D60-9A24-B81B6A56DEF7}) (Version: 1.0.6.0 - Citi) Hidden
Virtual Account Numbers (HKLM-x32\...\{DE700910-58F7-4D2E-B7E6-3BA2DA1B6806}) (Version: 4.0.0.2260 - Citi)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.6 - VideoLAN)
VUx64 (HKLM\...\{A0A2BE14-D3FF-41C8-9545-4B130E3FE9A4}) (Version: 1.2.0 - Sony Corporation) Hidden
VUx86 (HKLM-x32\...\{D04F1D22-4A47-42C6-A2B9-094A7B844D9B}) (Version: 1.2.0 - Sony Corporation) Hidden
Windows Driver Package - Atheros Communications Inc. (athr) Net (02/12/2010 9.0.0.125) (HKLM\...\62D2521666DCF9EBEC983E0344A3DEE15CF2C6D3) (Version: 02/12/2010 9.0.0.125 - Atheros Communications Inc.)
Windows Driver Package - Ricoh Company MS Host Controller (04/27/2010 6.13.03.03) (HKLM\...\329BC6C693EDBAE5D333838328DDCBF99FE39773) (Version: 04/27/2010 6.13.03.03 - Ricoh Company)
Windows Driver Package - Sony Corporation (SFEP) HIDClass (11/27/2009 8.0.1.2) (HKLM\...\4E827A70BAA738C408DBDD024BCACE5085D946F1) (Version: 11/27/2009 8.0.1.2 - Sony Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WizMouse v1.7.0.3 (HKLM-x32\...\WizMouse_is1) (Version: - Antibody Software)
Xiph.Org Open Codecs 0.85.17777 (HKLM-x32\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)
XperiaLinkx86 (HKLM-x32\...\{EE402ACB-8269-4E44-9CA1-D81FDC4B4545}) (Version: 1.0.0 - Sony Corporation) Hidden


==================== Custom CLSID (Whitelisted): ==========================


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-10] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-10] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-10] (Google)
ShellIconOverlayIdentifiers: [0WinSecurityProvider] -> {F76FA5C2-3B6A-451E-8CA5-34C8D0AE0637} => -> No File
ShellIconOverlayIdentifiers: [{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}] -> {4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B} => C:\Windows\system32\pfmshx_A1C.dll [2014-07-11] (Pismo Technic Inc.)
ShellIconOverlayIdentifiers-x32: [{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}] -> {4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B} => C:\Windows\system32\pfmshx_A1C.dll [2014-07-11] (Pismo Technic Inc.)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers1-x32: [Adobe.Acrobat.ContextMenu] -> {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} => C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll [2004-12-14] (Adobe Systems Inc.)
ContextMenuHandlers1-x32: [AimersoftVideoConverterFileOpreation] -> {1AACB93E-AA97-47F1-BD02-8D2AF2815436} => C:\Windows\SysWOW64\AiCM64.dll [2013-08-23] ()
ContextMenuHandlers1-x32: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2015-04-30] (Microsoft Corporation)
ContextMenuHandlers1-x32: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-11-10] (Google)
ContextMenuHandlers1-x32-x32: [StuffItContextMenuHandler] -> {8B2B7A32-7D7B-48AB-838D-70AAC410985F} => C:\Program Files (x86)\Stuffit\SxShellExtEN.dll [2008-12-19] (Smith Micro Software, Inc.)
ContextMenuHandlers1-x32-x32: [UnLockerMenu] -> {410BF280-86EF-4E0F-8279-EC5848546AD3} => C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll [2014-03-04] (IObit)
ContextMenuHandlers1-x32-x32: [{4BBAAAE9-0001-4A1C-9AA5-1BBD98C86E9B}] -> {4BBAAAE9-0001-4A1C-9AA5-1BBD98C86E9B} => C:\Windows\system32\pfmshx_A1C.dll [2014-07-11] (Pismo Technic Inc.)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2015-04-30] (Microsoft Corporation)
ContextMenuHandlers2: [{4BBAAAE9-0002-4A1C-9AA5-1BBD98C86E9B}] -> {4BBAAAE9-0002-4A1C-9AA5-1BBD98C86E9B} => C:\Windows\system32\pfmshx_A1C.dll [2014-07-11] (Pismo Technic Inc.)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-27] (Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2015-04-30] (Microsoft Corporation)
ContextMenuHandlers4: [FolderColorize] -> {3443FE61-F294-403D-A4A6-53E034FC9B3F} => C:\Program Files\Folder Colorizer\FolderColorShlExt.dll [2014-06-10] ()
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-11-10] (Google)
ContextMenuHandlers4-x32: [StuffItContextMenuHandler] -> {8B2B7A32-7D7B-48AB-838D-70AAC410985F} => C:\Program Files (x86)\Stuffit\SxShellExtEN.dll [2008-12-19] (Smith Micro Software, Inc.)
ContextMenuHandlers4-x32: [UnLockerMenu] -> {410BF280-86EF-4E0F-8279-EC5848546AD3} => C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll [2014-03-04] (IObit)
ContextMenuHandlers5: [DeskMenu] -> {7E74422F-2393-11D4-98E0-444553540000} => C:\Program Files\Desktop Restore\dkticnsr.dll [2014-07-14] (Jamie O'Connell)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2014-05-19] (NVIDIA Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-27] (Malwarebytes)
ContextMenuHandlers6: [UnLockerMenu] -> {410BF280-86EF-4E0F-8279-EC5848546AD3} => C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll [2014-03-04] (IObit)
ContextMenuHandlers6: [{4BBAAAE9-0002-4A1C-9AA5-1BBD98C86E9B}] -> {4BBAAAE9-0002-4A1C-9AA5-1BBD98C86E9B} => C:\Windows\system32\pfmshx_A1C.dll [2014-07-11] (Pismo Technic Inc.)


==================== Scheduled Tasks (Whitelisted) =============


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


Task: {00F7D842-030F-48FE-8D06-8D1A8EC0DFAC} - System32\Tasks\Sanipplesnipples => C:\Program Files (x86)\coordinator\coordinator.exe
Task: {02F2E36D-CE54-461C-A711-83D7C6A526A2} - System32\Tasks\SONY\SUS-BCF\Level4Daily => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2010-07-26] (Sony Corporation)
Task: {12909958-B0B1-4E3A-A143-388DAD924286} - System32\Tasks\Sony Corporation\VAIO Care\GetPOTInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)
Task: {1389A02B-E9F7-4625-8452-29315733282E} - System32\Tasks\Sony Corporation\VAIO Care\UploadPOT => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)
Task: {172C0947-0AB8-4CBB-A502-468E6D8E4112} - System32\Tasks\Sony Corporation\VAIO Care\UpdateSolution => C:\Program Files\Sony\VAIO Care\Solution.Updater.exe [2015-07-23] (Sony Corporation)
Task: {1C0D1E3A-C3E3-4827-8115-7BD8BB778650} - System32\Tasks\Sony Corporation\VAIO Care\ActiveStatusCollect => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)
Task: {3111D1B9-B867-4FF2-BCCD-6FA05999E5C2} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2011-02-16] (Sony Corporation)
Task: {3484F857-6831-4992-AD27-B62DAEA9911C} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2016-04-25] (Sony Corporation)
Task: {36CFE37E-9401-4318-90D2-4EC5FAEE387F} - System32\Tasks\Sony Corporation\VAIO Care\DeployCRMflag => C:\Program Files\Sony\VAIO Care\DeployCRMflag.exe [2015-02-04] (Sony Corporation)
Task: {45BADC05-BF63-4EA7-B530-5B196060609F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4256033146-2562541644-1532691662-1000Core1d1ab1c50e3feb1 => C:\Users\New User\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {46A8BA8B-1CE2-49F1-88A7-AFEFD8DD1072} - System32\Tasks\GoogleUpdateTaskMachineCore1d1e99a24383211 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {4715A3F3-DA5C-4314-B0E6-AEE7B4002171} - System32\Tasks\Motorola Device Manager Initial Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2014-10-30] ()
Task: {56E4ED33-FD67-4111-AD2E-69432965D13C} - System32\Tasks\{E14845C5-AD07-455E-8AF1-87FDF860E69C} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma.cpl" -c Adobe Gamma
Task: {5759A3CC-052E-4072-B357-5EE5C9AA1DC2} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_29_0_0_140_pepper.exe [2018-04-26] (Adobe Systems Incorporated)
Task: {5896892F-6738-4626-9A26-98F4AA20F245} - System32\Tasks\VAIO Health Report => C:\Program Files (x86)\Sony\VAIO Health Report\VAIOHealthReport.exe [2013-06-20] (Sony Electronics)
Task: {5942F092-08C3-41C9-8568-F7010BD67E6B} - System32\Tasks\Sony Corporation\VAIO Update\Launch Application => C:\Program Files\SONY\VAIO Update\ShellExeProxy.exe [2016-03-31] (Sony Corporation)
Task: {5AF6E9AE-CB01-4CCD-A50E-25A10080E439} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_29_0_0_140_Plugin.exe [2018-04-26] (Adobe Systems Incorporated)
Task: {5C1FD1BA-43C9-4FFB-B90D-DA7274C2101E} - System32\Tasks\Sony Corporation\VAIO Care\CheckSystemInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)
Task: {5CE22FDF-C337-4FF1-9589-1D174EF6BA8E} - \Speedial -> No File <==== ATTENTION
Task: {633FE891-475B-499C-B85E-F3C6BEB45993} - System32\Tasks\USER_ESRV_SVC => "C:\Windows\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Sony\VAIO Care\ESRV\task.vbs"
Task: {79DC2A95-1F93-417E-A28F-B99128B2DE38} - System32\Tasks\Core Temp Autostart Guest => C:\Program Files\Core Temp\Core Temp.exe [2016-06-05] ()
Task: {7A0844AA-1700-4006-B982-8FB6D0AC37EB} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIolo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)
Task: {7EFD4D10-58C8-43AA-9467-9C5F5DF65A3E} - System32\Tasks\DLNowUpdateTask => C:\Program Files (x86)\DLNow\bin\youtube-dl.exe [2018-04-25] ()
Task: {8232939B-86BF-4759-94DA-6CFAF7332CA2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-04-26] (Adobe Systems Incorporated)
Task: {9255924D-D507-4E08-A7A4-F494A3A78200} - System32\Tasks\{19FA1E7F-C63E-4A46-97A3-3F34BC31D6C0} => C:\Windows\system32\pcalua.exe -a C:\Users\2018Jean\Desktop\dft32_v416_b00.EXE -d C:\Users\2018Jean\Desktop
Task: {96247089-FA26-44E2-A435-C81629491635} - System32\Tasks\Motorola Device Manager Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2014-10-30] ()
Task: {9B66F097-A61A-4505-97F4-D136CAF3DC42} - System32\Tasks\WizMouse => C:\Program Files (x86)\WizMouse\WizMouseLaunch.exe [2013-09-22] ()
Task: {A9DC085E-8031-42FC-9286-2DC168612277} - System32\Tasks\Sony Corporation\VAIO Care\VCSelfHeal => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)
Task: {AF252B0B-E42B-4D00-BCDB-8087257A2F0B} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCOneClick.exe [2011-02-16] (Sony Corporation)
Task: {B6A45865-55DB-4260-8D17-9BAD8B97876F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {BE7E516B-E50A-4280-96C6-AFE1968AE5EF} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-02-09] (Adobe Systems Incorporated)
Task: {C1F04433-F138-496F-A132-861EA809CBE6} - System32\Tasks\Sony Corporation\VAIO Care\VCMetrics => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)
Task: {C4E2C798-680B-487D-B008-7809887D2534} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2016-03-31] (Sony Corporation)
Task: {CF664104-E476-4498-8903-5DC6BB8CBFC7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {CFEFD686-64CA-4CB6-8B24-A9BC74A06F8B} - System32\Tasks\SONY\SUS-BCF\Level4Month => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2010-07-26] (Sony Corporation)
Task: {D1983ABB-C6BA-45ED-8684-92D2239F2B29} - System32\Tasks\Core Temp Autostart New User => C:\Program Files\Core Temp\Core Temp.exe [2016-06-05] ()
Task: {D1DC2A75-83A9-4B63-A3FD-5000634057BD} - System32\Tasks\{B2B6C2B3-3D98-4570-9059-8CAE5C80B819} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\QuickTime Alternative\QTSystem\quicktime.cpl"
Task: {D3079176-915D-4916-9D59-44E9ACC6EE7D} - System32\Tasks\{E662A73C-AEC1-4F01-98FD-6B3B7D095BEA} => C:\Windows\system32\pcalua.exe -a C:\Users\2018Jean\Desktop\Setup.exe -d C:\Users\2018Jean\Desktop
Task: {E0781AF7-ACCE-4AD7-BE9C-6A9E065CD550} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4256033146-2562541644-1532691662-1000UA => C:\Users\New User\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {E17FC308-0BBA-4584-B370-6CF6A9D7A881} - System32\Tasks\Sony Corporation\Xperia Link\Xperia Link Logon Start => C:\Program Files (x86)\Sony\Xperia Link\Xperia Link.exe [2016-03-04] (Sony Corporation)
Task: {F38A7085-3FF2-497A-BF8B-A4DF91339F0F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {F70FE2A2-D569-48A5-BBFA-53AEC4C1DF0A} - System32\Tasks\nipples => C:\Program Files (x86)\coordinator\coordinator.exe
Task: {F8CB3FC4-A45A-4D7D-918D-452AD83D7E94} - System32\Tasks\Sony Corporation\VAIO Care\VCRLog => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)


(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cfefa3f2c4ad03.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0001ea16c3dbf.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d04271c398541a.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d09037628ad6c3.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0bfebbe8ed6e2.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0e18bf9f2edac.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0ef4ea319fbef.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d12d0428a12f73.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d15cfba1559c9f.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d1636af991dfb9.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d1ab1afe70b3f7.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4256033146-2562541644-1532691662-1000Core.job => C:\Users\New User\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4256033146-2562541644-1532691662-1000Core1d0efb33f722634.job => C:\Users\New User\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4256033146-2562541644-1532691662-1000Core1d12eecce9d9c72.job => C:\Users\New User\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4256033146-2562541644-1532691662-1000Core1d15dc7972a45f8.job => C:\Users\New User\AppData\Local\Google\Update\GoogleUpdate.exe


==================== Shortcuts & WMI ========================


(The entries could be listed to be restored or removed.)




Shortcut: C:\Users\2018Jean\Favorites\NCH Software Download Site.lnk -> hxxp://www.nchsoftware.com/index.htm


ShortcutWithArgument: C:\Users\2018Jean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Chrome Remote Desktop.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=gbchcmhmhahfdphkhkmpfmihenigjmpp
ShortcutWithArgument: C:\Users\2018Jean\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\5d696d521de238c3\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default


==================== Loaded Modules (Whitelisted) ==============


2010-07-14 04:00 - 2010-07-14 04:00 - 000032240 _____ () C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe
2015-03-21 04:54 - 2015-03-21 04:54 - 000327680 _____ () C:\Program Files\Serviio\bin\ServiioService.exe
2014-05-26 17:01 - 2014-05-19 21:25 - 000116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-07-19 19:27 - 2013-08-23 13:36 - 000721263 _____ () C:\Windows\SysWOW64\AiCM64.dll
2015-09-16 08:12 - 2015-09-16 08:12 - 000043480 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-07-13 21:23 - 2010-07-13 21:23 - 000084464 _____ () C:\Program Files (x86)\Roxio 2011\5.0\CPMonitor.exe
2014-05-21 18:34 - 2009-08-26 17:11 - 000017408 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe
2014-05-21 18:34 - 2009-08-26 17:11 - 000017920 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe
2014-05-21 18:34 - 2009-08-26 17:11 - 000033792 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe
2016-07-01 10:51 - 2016-06-05 00:56 - 000893488 _____ () C:\Program Files\Core Temp\Core Temp.exe
2018-04-28 08:55 - 2018-04-25 23:14 - 004443992 _____ () C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.139\libglesv2.dll
2018-04-28 08:55 - 2018-04-25 23:14 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.139\libegl.dll
2018-03-22 15:00 - 2018-03-22 15:00 - 003406336 _____ () C:\Users\2018Jean\AppData\Local\wmcagent\wmcagent.exe
2010-07-14 04:00 - 2010-07-14 04:00 - 001587696 _____ () C:\Program Files (x86)\Roxio\BackOnTrack\App\BEngine.dll
2010-07-14 04:00 - 2010-07-14 04:00 - 000107504 _____ () C:\Program Files (x86)\Roxio\BackOnTrack\App\Logging.dll
2013-07-20 15:13 - 2013-07-20 15:13 - 000165480 _____ () C:\Windows\SysWOW64\AirfoilInject3.dll
2014-06-25 20:33 - 2010-05-31 19:18 - 000013824 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESBasePS.dll
2014-06-25 20:33 - 2010-05-31 19:18 - 000013312 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSubPS.dll
2015-09-22 12:48 - 2012-11-06 09:47 - 000114688 _____ () C:\Program Files (x86)\Realtek\USB Wireless LAN Utility\EnumDevLib.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000120320 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\SonyCommonLib.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000007680 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\DebugMsg.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000009728 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\Resources.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000015360 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\SharedInterfaces.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000018944 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\DictionaryLookup.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000011264 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\MessageXML.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000005120 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.ThirdPartyApp.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000023040 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.Generic.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000027648 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.BtPower.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000005120 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.Generic.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000015360 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.NativeWifiThirdPartyApp.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000011264 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.TosBtThirdPartyApp.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000007168 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.WlanPower.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000004608 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.Power.dll
2014-05-21 18:34 - 2009-08-26 17:11 - 000081408 _____ () C:\Program Files (x86)\Sony\SmartWi Connection Utility\DevicePanel.dll
2016-03-05 14:42 - 2016-03-05 14:42 - 047517184 _____ () C:\Users\2018Jean\AppData\Local\wmcagent\libcef.dll
2016-08-23 14:19 - 2016-08-23 14:19 - 001414144 _____ () C:\Users\2018Jean\AppData\Local\wmcagent\CrackCaptchaAPI.dll
2016-08-23 14:19 - 2016-08-23 14:19 - 000419328 _____ () C:\Users\2018Jean\AppData\Local\wmcagent\lua5.dll
2016-08-23 14:19 - 2016-08-23 14:19 - 000124928 _____ () C:\Users\2018Jean\AppData\Local\wmcagent\cjson.dll
2016-08-22 12:41 - 2016-08-22 12:41 - 000101888 _____ () C:\Users\2018Jean\AppData\Local\wmcagent\lcurl.dll
2016-03-05 14:42 - 2016-03-05 14:42 - 001576960 _____ () C:\Users\2018Jean\AppData\Local\wmcagent\libglesv2.dll
2016-03-05 14:42 - 2016-03-05 14:42 - 000074752 _____ () C:\Users\2018Jean\AppData\Local\wmcagent\libegl.dll


==================== Alternate Data Streams (Whitelisted) =========


(If an entry is included in the fixlist, only the ADS will be removed.)


AlternateDataStreams: C:\Windows:nlsPreferences [0]


==================== Safe Mode (Whitelisted) ===================


(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\plsapp => ""="service"


==================== Association (Whitelisted) ===============


(If an entry is included in the fixlist, the registry item will be restored to default or removed.)




==================== Internet Explorer trusted/restricted ===============


(If an entry is included in the fixlist, it will be removed from the registry.)




==================== Hosts content: ==========================


(If needed Hosts: directive could be included in the fixlist to reset Hosts.)


2014-09-19 15:54 - 2018-04-29 13:15 - 000002047 _____ C:\Windows\system32\Drivers\etc\hosts


127.0.0.1 localhost
0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 rp.yefeneri2.com
0.0.0.0 os.yefeneri2.com
0.0.0.0 os2.yefeneri2.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com


==================== Other Areas ============================


(Currently there is no automatic fix for this section.)


HKU\S-1-5-21-4256033146-2562541644-1532691662-1006\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
Windows Firewall is enabled.


==================== MSCONFIG/TASK MANAGER disabled items ==


MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk => C:\Windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SoftEther VPN Client Manager Startup.lnk => C:\Windows\pss\SoftEther VPN Client Manager Startup.lnk.CommonStartup
MSCONFIG\startupreg: Acrobat Assistant 7.0 => "C:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
MSCONFIG\startupreg: Acronis Scheduler2 Service => "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: Aimersoft Helper Compact.exe => C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe
MSCONFIG\startupreg: Desktop Disc Tool => "C:\Program Files (x86)\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe"
MSCONFIG\startupreg: LightScribe Control Panel => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
MSCONFIG\startupreg: SoftEther VPN Client UI Helper => "C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe" /uihelp
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: Virtual Account Numbers => C:\Users\NEWUSE~1\Desktop\CITIVI~1\CitiVAN.exe /lang=en_RG /dontopenmycards


==================== FirewallRules (Whitelisted) ===============


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


FirewallRules: [{2CF04BE8-6CB7-426E-87E3-443822B9A514}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{C296184F-C227-4713-B174-243ABDA04E6C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{C5C518B4-86AF-4027-987D-669619A5A3BF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{2D5B7835-F8DD-4027-8C30-FA0E38A820A5}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{E0A2AA88-06EA-4DC1-985C-BEA2B91B0965}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{76D20174-CA61-42BF-957C-3182D16A2267}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{E5396464-C096-44DD-9C9C-C9E70DD24C67}C:\program files\ftpwanderer.exe] => (Allow) C:\program files\ftpwanderer.exe
FirewallRules: [UDP Query User{2A565AA3-9DBC-49CA-BEA8-990BD55777CD}C:\program files\ftpwanderer.exe] => (Allow) C:\program files\ftpwanderer.exe
FirewallRules: [{977B5A87-36E7-4E73-B8A8-485851DE5FFA}] => (Allow) c:\program files\pcmax\pcmax.exe
FirewallRules: [{70FEFAD7-1777-4261-B557-56633AAB151D}] => (Allow) c:\program files\pcmax\pcmax.exe
FirewallRules: [{B0BB7AC1-2F97-4761-B6D0-F0310615C680}] => (Allow) c:\program files\pcmax\service.exe
FirewallRules: [{59E62978-D0B6-46D5-A4A9-9E978950D36D}] => (Allow) c:\program files\pcmax\service.exe
FirewallRules: [TCP Query User{38DD868C-6480-43DF-8F77-A3FFE5977B1A}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe
FirewallRules: [UDP Query User{ECE89D7D-A57F-467F-A90D-8F50C65E2D20}C:\program files (x86)\deluge\deluge.exe] => (Allow) C:\program files (x86)\deluge\deluge.exe
FirewallRules: [TCP Query User{EB90B550-47E4-40BE-99DB-56F72A70635F}C:\program files (x86)\airfoil\airfoil.exe] => (Allow) C:\program files (x86)\airfoil\airfoil.exe
FirewallRules: [UDP Query User{5BBCC7AF-5563-44DE-BAF5-04FAFC24751E}C:\program files (x86)\airfoil\airfoil.exe] => (Allow) C:\program files (x86)\airfoil\airfoil.exe
FirewallRules: [{4592994F-1A98-4637-B054-66DF68050396}] => (Block) C:\program files (x86)\airfoil\airfoil.exe
FirewallRules: [{CBE3AA6C-3F2B-49E9-81CD-37300559E7C2}] => (Block) C:\program files (x86)\airfoil\airfoil.exe
FirewallRules: [TCP Query User{395E59A3-FE0C-49FF-B30B-A65C5CD2445E}C:\program files (x86)\airfoil\airfoilspeakers.exe] => (Allow) C:\program files (x86)\airfoil\airfoilspeakers.exe
FirewallRules: [UDP Query User{7754B78D-9D14-4E9F-9142-AE33E8E5FF18}C:\program files (x86)\airfoil\airfoilspeakers.exe] => (Allow) C:\program files (x86)\airfoil\airfoilspeakers.exe
FirewallRules: [{88485275-5EA1-459F-84B5-89C2E34230D9}] => (Block) C:\program files (x86)\airfoil\airfoilspeakers.exe
FirewallRules: [{D84C9003-E681-47F2-A258-9DBC93386DE3}] => (Block) C:\program files (x86)\airfoil\airfoilspeakers.exe
FirewallRules: [{E396AD23-C425-441E-9010-CF148DB3C78C}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{6409AF99-EFD5-4489-9F55-FF78F5857EB4}] => (Allow) LPort=2869
FirewallRules: [{CA56823E-F76E-4F0C-8B76-61B4A2B97020}] => (Allow) LPort=1900
FirewallRules: [TCP Query User{263E4B15-F753-4495-B694-FD4282AD962F}C:\program files (x86)\deluge\deluge.exe] => (Block) C:\program files (x86)\deluge\deluge.exe
FirewallRules: [UDP Query User{85580AB7-6E56-40DA-8E0F-2ED6036EA6C2}C:\program files (x86)\deluge\deluge.exe] => (Block) C:\program files (x86)\deluge\deluge.exe
FirewallRules: [TCP Query User{CA87FA13-9113-442F-AC3E-38802B0AE86F}C:\program files (x86)\deluge\deluged.exe] => (Allow) C:\program files (x86)\deluge\deluged.exe
FirewallRules: [UDP Query User{C202DD56-CDF8-4944-8507-70755547EE77}C:\program files (x86)\deluge\deluged.exe] => (Allow) C:\program files (x86)\deluge\deluged.exe
FirewallRules: [TCP Query User{7607D4FC-971D-49FD-A14B-D746D9BB5894}C:\program files (x86)\videolan\vlc\vlc.exe] => (Allow) C:\program files (x86)\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{DB641E5D-EEBC-4F32-AE79-2812B5BD92D3}C:\program files (x86)\videolan\vlc\vlc.exe] => (Allow) C:\program files (x86)\videolan\vlc\vlc.exe
FirewallRules: [{666EBB23-B790-465A-84A8-D3E17BDDE7C7}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{86D1F545-83E3-46D9-9CA1-4C50C70B6ACA}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{82ED3894-7B01-47C7-A7BF-D551ABB3190C}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{2ACA73FD-C92F-4AF0-86FB-8E22A2FBAA37}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{9007269C-05E4-4FD4-9B97-A1D3673672DE}] => (Allow) C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{2FDAAD5B-14B3-4694-90DB-D6336F2E5B11}] => (Allow) C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{CF4CB251-F0A9-427D-A596-B8FE63BF5D87}] => (Allow) C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\StartNBR.exe
FirewallRules: [{E171BE02-A7C6-40A8-B917-3B2AE5BF68AF}] => (Allow) C:\Program Files (x86)\Nero\KM\NMDllHost.exe
FirewallRules: [{8FE37018-CA41-4853-8283-2BE4BEFF16D0}] => (Allow) C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\nero.exe
FirewallRules: [TCP Query User{6480198D-41E2-496E-ADCF-BBC3D13050E0}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{C2E1467F-97BD-4BEB-9855-1998F725D70B}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [{42DDB0D2-48BA-4088-8BC7-60821D32647F}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd.exe
FirewallRules: [{930758F4-F0FA-404C-8254-4CA698743038}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr.exe
FirewallRules: [{EB9525D5-145F-425D-9DE4-7610E925F082}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe
FirewallRules: [{EDA9D5AB-6059-4F57-9BA7-13CFFD8EA9E3}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient.exe
FirewallRules: [{2FC8BAB5-49F6-4954-A990-BF928D55F6D9}] => (Allow) C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
FirewallRules: [{F5C61075-AFB7-4922-9A30-34D045D98F48}] => (Allow) C:\Program Files\SoftEther VPN Client\vpncmd_x64.exe
FirewallRules: [TCP Query User{79314B27-9638-4350-86F2-577A218A4869}C:\program files\java\jre7\bin\javaw.exe] => (Block) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{2E232829-9FAA-4287-A284-F36485E21E0F}C:\program files\java\jre7\bin\javaw.exe] => (Block) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [{063EB077-C6E2-4B8B-A140-96E5E5DF9735}] => (Allow) C:\Windows\explorer.exe
FirewallRules: [{0E8CA58E-D591-41C5-B047-EED091B8D663}] => (Allow) C:\Windows\system32\rundll32.exe
FirewallRules: [TCP Query User{8B6BAD13-64C7-4D3C-8EE1-891786080AD3}C:\program files (x86)\popcorn time\chromecast\node.exe] => (Allow) C:\program files (x86)\popcorn time\chromecast\node.exe
FirewallRules: [UDP Query User{5BE27818-A173-49CE-93FC-81234C988403}C:\program files (x86)\popcorn time\chromecast\node.exe] => (Allow) C:\program files (x86)\popcorn time\chromecast\node.exe
FirewallRules: [TCP Query User{1BA97C60-8921-4FCB-95BB-36E4DDAF8FD2}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [UDP Query User{57D3F1BB-95FF-4D51-A8C6-EC5E99FE608E}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [{B7A616F4-11E4-4395-892E-CE63AD5D5B17}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{2453CD04-EF1E-4985-9F1A-F379B751D9B9}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{5F45E1E2-E0DE-4373-806B-880AD30688B2}] => (Allow) C:\Program Files (x86)\Realtek\USB Wireless LAN Utility\RtWLan.exe
FirewallRules: [{EB667CDB-CBE6-49BA-92BB-4CE900836A8E}] => (Allow) C:\Program Files (x86)\Realtek\USB Wireless LAN Utility\RtWLan.exe
FirewallRules: [{2544F6BE-597E-445D-9EC3-48102EB0304F}] => (Allow) LPort=1542
FirewallRules: [{E6E19DDA-3C9D-4317-9796-9E057E76DCC1}] => (Allow) LPort=1542
FirewallRules: [{748CD8B3-0360-4523-B7EF-87ED0A50323F}] => (Allow) LPort=53
FirewallRules: [{5F20B306-74DF-4363-94CF-B3E937B01E8D}] => (Allow) C:\Program Files (x86)\MediatekWiFi\Common\RaMediaServer.exe
FirewallRules: [{34393942-319F-4450-B74D-6A3D5854B9DA}] => (Allow) C:\Program Files (x86)\MediatekWiFi\Common\RaMediaServer.exe
FirewallRules: [{BA1B9B4B-E7C0-462A-A835-7558CEE2DAF2}] => (Allow) C:\Program Files (x86)\MediatekWiFi\Common\RaUI.exe
FirewallRules: [{2DB9CEAE-0E43-4EDB-9D88-97C086FF95B7}] => (Allow) LPort=67
FirewallRules: [{F18D36AD-580F-4E37-B727-7091DAA9B7F0}] => (Allow) LPort=68
FirewallRules: [{CC22FF8C-3558-4419-8161-E129054A10C2}] => (Allow) LPort=53
FirewallRules: [{4CBB465C-F887-4950-BFA1-9358262CC2F3}] => (Allow) LPort=53
FirewallRules: [{34C53CB0-FE9A-4DB6-B15F-A51E97C935B6}] => (Allow) C:\Program Files (x86)\Realtek\USB Wireless LAN Utility\Rtldhcp.exe
FirewallRules: [TCP Query User{4ACE9B7F-2F49-444E-A972-C1544EF946CD}C:\program files (x86)\youwave android\vb\vboxsdl.exe] => (Allow) C:\program files (x86)\youwave android\vb\vboxsdl.exe
FirewallRules: [UDP Query User{034E629D-BDA3-431F-A414-0616439C10BF}C:\program files (x86)\youwave android\vb\vboxsdl.exe] => (Allow) C:\program files (x86)\youwave android\vb\vboxsdl.exe
FirewallRules: [TCP Query User{CD93C2D2-E82D-4969-91B7-A6F303BE3235}C:\program files (x86)\callcentric\callcentric softphone\callcentric.exe] => (Allow) C:\program files (x86)\callcentric\callcentric softphone\callcentric.exe
FirewallRules: [UDP Query User{1F7EB81A-09E3-40CC-BE0F-8B6075A29B71}C:\program files (x86)\callcentric\callcentric softphone\callcentric.exe] => (Allow) C:\program files (x86)\callcentric\callcentric softphone\callcentric.exe
FirewallRules: [TCP Query User{CD029BCC-19A7-4340-B504-F18A27E184BE}C:\program files (x86)\filezilla ftp client\filezilla.exe] => (Allow) C:\program files (x86)\filezilla ftp client\filezilla.exe
FirewallRules: [UDP Query User{3DE96037-7FAD-47BB-A1B0-C59A83A0B0B5}C:\program files (x86)\filezilla ftp client\filezilla.exe] => (Allow) C:\program files (x86)\filezilla ftp client\filezilla.exe
FirewallRules: [{7B242E38-2D4F-438F-9DF9-ABA2BE340438}] => (Allow) C:\Program Files\Sony\VAIO Care\VCAgent.exe
FirewallRules: [{4DA46A1F-86C4-44BF-965B-83BD1EF1655C}] => (Allow) C:\Program Files\Sony\VAIO Care\VCAdmin.exe
FirewallRules: [{6052E95E-48ED-443C-B45E-B2F103E23ADB}] => (Allow) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
FirewallRules: [{6C8DB5CB-4FE9-4034-A8CC-74EAC8D533DA}] => (Allow) C:\Program Files\Sony\VAIO Care\VAIOShell.exe
FirewallRules: [{6FE38D40-D843-442E-8193-CF49F871B811}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9F1A3DBB-D8D9-48A6-A4DB-F6E4D6C7EA8A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E5F4366A-7119-43AD-A659-971903596B24}] => (Allow) C:\Program Files (x86)\Apowersoft\Video Converter Studio\Video Converter Studio.exe
FirewallRules: [{7D36D9CA-0FC0-4E19-98D6-E24DC8FA09F3}] => (Allow) C:\Program Files (x86)\Apowersoft\Video Converter Studio\Video Converter Studio.exe
FirewallRules: [TCP Query User{29204BD5-66AA-46FF-9E2B-62845C0E39B7}C:\program files\serviio\jre\bin\javaw.exe] => (Allow) C:\program files\serviio\jre\bin\javaw.exe
FirewallRules: [UDP Query User{CD709486-5A60-4707-B99B-D26172468A31}C:\program files\serviio\jre\bin\javaw.exe] => (Allow) C:\program files\serviio\jre\bin\javaw.exe
FirewallRules: [{D6089E07-8A0C-41AB-A4C9-269F3141228C}] => (Allow) C:\Program Files\Serviio\bin\ServiioService.exe
FirewallRules: [{DE333EF5-0110-46DA-A946-C3DB012799C8}] => (Allow) C:\Program Files\Serviio\bin\ServiioService.exe
FirewallRules: [{48B2AD10-3253-4D52-B0EE-A7D4A45F00EF}] => (Allow) C:\Program Files\Serviio\bin\ServiioConsole.exe
FirewallRules: [{ABD9CC4F-7124-4A2F-A409-F2BA2B646471}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A705390D-6100-4309-ACFD-2BB825970F02}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{1992C8FE-AB9D-408D-B2C0-5CB151151523}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2A3D0737-6132-4ECC-803F-BE512344CC55}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6EC71A4A-289A-46B8-BA63-52B691DDD9B5}] => (Allow) C:\Program Files (x86)\Song Surgeon 4\SongSurgeon4.exe
FirewallRules: [{0E4789F4-9F90-4ABB-9FBC-E8B0BF1FE640}] => (Allow) C:\Program Files (x86)\Song Surgeon 4\SongSurgeon4reg.exe
FirewallRules: [{EAA1B54E-3D4F-4D16-9FC0-2953FA06D4A2}] => (Allow) C:\Program Files (x86)\Song Surgeon 4\MusicPad.exe
FirewallRules: [{6686CD8F-E5B1-44DD-B405-8869DA7DF07C}] => (Allow) C:\Program Files (x86)\Song Surgeon 4\BatchFileConverter.exe
FirewallRules: [{191A969B-B049-4AAC-A5D3-BEB07EFEF133}] => (Allow) C:\Program Files (x86)\Song Surgeon 4\rpcapd.exe
FirewallRules: [{DC8A0E7B-E613-419B-A8A0-859C3A23A3CA}] => (Allow) C:\Program Files (x86)\Song Surgeon 4\SongSurgeon4.exe
FirewallRules: [{FC2AA9AA-CE8F-4F35-8308-455DDBFF0830}] => (Allow) C:\Program Files (x86)\Song Surgeon 4\SongSurgeon4reg.exe
FirewallRules: [{5800D832-8925-44D7-8D65-1DB635D72582}] => (Allow) C:\Program Files (x86)\Song Surgeon 4\MusicPad.exe
FirewallRules: [{5A0930F7-1DFE-4652-ADAD-9F34948B71C6}] => (Allow) C:\Program Files (x86)\Song Surgeon 4\BatchFileConverter.exe
FirewallRules: [{9BCFC6E9-43DE-463C-8795-7A2F17E1E5A0}] => (Allow) C:\Program Files (x86)\Song Surgeon 4\rpcapd.exe
FirewallRules: [{D6924CD1-DF03-4B19-AE6E-16A158F838C8}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdater.exe
FirewallRules: [{FED7BEC2-D498-452A-98FD-A5B7AF585508}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
FirewallRules: [{F20F9F2C-408D-48C1-83E7-447F20263304}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
FirewallRules: [{91A82756-D605-4CD4-960D-3B9C27D731BA}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
FirewallRules: [{2EFAC593-95AF-4FC9-9E75-75A39A653A0F}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
FirewallRules: [{F4D66D4B-D0FF-4824-B85C-E0A020ACD526}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
FirewallRules: [TCP Query User{D6BE3D14-AC0D-43D9-AD0F-DD4AF113E43C}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [UDP Query User{D93C0AA3-2221-4781-B763-E66056BA84F3}C:\program files (x86)\netgear genie\bin\netgeargenie.exe] => (Allow) C:\program files (x86)\netgear genie\bin\netgeargenie.exe
FirewallRules: [TCP Query User{4553BA8C-7A9A-4212-ACF7-9ED1491E883D}C:\program files (x86)\kodi\kodi.exe] => (Allow) C:\program files (x86)\kodi\kodi.exe
FirewallRules: [UDP Query User{E93C4BD1-249F-4E15-8DD6-A5D531F7FC1D}C:\program files (x86)\kodi\kodi.exe] => (Allow) C:\program files (x86)\kodi\kodi.exe
FirewallRules: [TCP Query User{83F05975-F842-4E2A-9D04-A1CAE73D11D2}C:\program files (x86)\deluge\deluge-web-debug.exe] => (Allow) C:\program files (x86)\deluge\deluge-web-debug.exe
FirewallRules: [UDP Query User{7EB8779E-F44A-4B27-8202-BD795089F535}C:\program files (x86)\deluge\deluge-web-debug.exe] => (Allow) C:\program files (x86)\deluge\deluge-web-debug.exe
FirewallRules: [{DCAF63CE-91A7-431E-B07A-103C63097553}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{0C27EC27-5C06-4517-B565-D273A3E54232}] => (Allow) C:\Program Files (x86)\Chalice\Slighting.exe
FirewallRules: [{AA8902D0-920F-457C-88F9-511E9EB562C3}] => (Allow) C:\Program Files (x86)\Eduard\Slighting.exe
FirewallRules: [{6CD507BF-7CFA-4BD9-B5D3-201CC3F9FDBA}] => (Allow) C:\Program Files (x86)\fighter\undermining.exe
FirewallRules: [{CEE8DED6-E113-4B37-AA7C-008C57328790}] => (Allow) C:\Program Files (x86)\Eduard\undermining.exe


==================== Restore Points =========================


26-04-2018 17:48:32 Microsoft Antimalware Checkpoint
27-04-2018 13:33:27 Restore Point Created by FRST
27-04-2018 13:56:30 Windows Update
29-04-2018 13:00:26 Restore Point Created by FRST


==================== Faulty Device Manager Devices =============


Name: ZAM Helper Driver
Description: ZAM Helper Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ZAM
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


Name: ZAM Guard Driver
Description: ZAM Guard Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ZAM_Guard
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.




==================== Event log errors: =========================


Application errors:
==================
Error: (04/29/2018 01:27:01 PM) (Source: Acronis Scheduler) (EventID: 1) (User: )
Description: Scheduler is unable to run task with GUID 'C73DF26C-DA36-4B34-A03E-033834498780' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).


Error: (04/29/2018 01:26:01 PM) (Source: Acronis Scheduler) (EventID: 1) (User: )
Description: Scheduler is unable to run task with GUID 'E8EB23E7-2D44-49CD-BDBA-301B0BD1C9E3' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).


Error: (04/29/2018 01:26:01 PM) (Source: Acronis Scheduler) (EventID: 1) (User: )
Description: Scheduler is unable to run task with GUID 'C73DF26C-DA36-4B34-A03E-033834498780' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).


Error: (04/29/2018 01:25:01 PM) (Source: Acronis Scheduler) (EventID: 1) (User: )
Description: Scheduler is unable to run task with GUID 'C73DF26C-DA36-4B34-A03E-033834498780' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).


Error: (04/29/2018 01:24:01 PM) (Source: Acronis Scheduler) (EventID: 1) (User: )
Description: Scheduler is unable to run task with GUID 'E8EB23E7-2D44-49CD-BDBA-301B0BD1C9E3' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).


Error: (04/29/2018 01:24:01 PM) (Source: Acronis Scheduler) (EventID: 1) (User: )
Description: Scheduler is unable to run task with GUID 'C73DF26C-DA36-4B34-A03E-033834498780' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).


Error: (04/29/2018 01:23:01 PM) (Source: Acronis Scheduler) (EventID: 1) (User: )
Description: Scheduler is unable to run task with GUID 'C73DF26C-DA36-4B34-A03E-033834498780' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).


Error: (04/29/2018 01:22:01 PM) (Source: Acronis Scheduler) (EventID: 1) (User: )
Description: Scheduler is unable to run task with GUID 'E8EB23E7-2D44-49CD-BDBA-301B0BD1C9E3' because of error 2 (Failed to find the file (folder) or the key (value) in the registry.).




System errors:
=============
Error: (04/29/2018 01:22:48 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error:
Unspecified error


Error: (04/29/2018 01:22:48 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Function Discovery Resource Publication service terminated with the following error:
Unspecified error


Error: (04/29/2018 01:21:52 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk0\DR0.


Error: (04/29/2018 01:21:52 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk0\DR0.


Error: (04/29/2018 01:21:52 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk0\DR0.


Error: (04/29/2018 01:21:52 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk0\DR0.


Error: (04/29/2018 01:21:52 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk0\DR0.


Error: (04/29/2018 01:21:52 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk0\DR0.




CodeIntegrity:
===================================


Date: 2016-08-14 16:57:47.868
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\c4154e707216b0f9ca48a8462c2fdd9e\inst\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.23455_none_b5d141c3e2043820\appid.sys because the set of per-page image hashes could not be found on the system.


Date: 2016-08-14 16:57:47.572
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\c4154e707216b0f9ca48a8462c2fdd9e\inst\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.23455_none_b5d141c3e2043820\appid.sys because the set of per-page image hashes could not be found on the system.


Date: 2016-08-14 16:57:47.351
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\c4154e707216b0f9ca48a8462c2fdd9e\inst\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.23455_none_b5d141c3e2043820\appid.sys because the set of per-page image hashes could not be found on the system.


Date: 2016-08-14 16:57:47.113
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\c4154e707216b0f9ca48a8462c2fdd9e\inst\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.23455_none_b5d141c3e2043820\appid.sys because the set of per-page image hashes could not be found on the system.


Date: 2016-08-14 16:57:45.980
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\c4154e707216b0f9ca48a8462c2fdd9e\inst\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.23455_none_b5d141c3e2043820\appidapi.dll because the set of per-page image hashes could not be found on the system.


Date: 2016-08-14 16:57:45.771
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\c4154e707216b0f9ca48a8462c2fdd9e\inst\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.23455_none_b5d141c3e2043820\appidapi.dll because the set of per-page image hashes could not be found on the system.


Date: 2016-08-14 16:57:45.469
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\c4154e707216b0f9ca48a8462c2fdd9e\inst\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.23455_none_b5d141c3e2043820\appidapi.dll because the set of per-page image hashes could not be found on the system.


Date: 2016-08-14 16:57:45.215
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\c4154e707216b0f9ca48a8462c2fdd9e\inst\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.23455_none_b5d141c3e2043820\appidapi.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================


Processor: Intel(R) Core(TM) i7 CPU Q 740 @ 1.73GHz
Percentage of memory in use: 41%
Total physical RAM: 8172.93 MB
Available physical RAM: 4818.38 MB
Total Virtual: 16344.04 MB
Available Virtual: 12555.44 MB


==================== Drives ================================


Drive c: () (Fixed) (Total:465.66 GB) (Free:278.98 GB) NTFS


\\?\Volume{e0097a0f-d8c1-11e3-91fa-806e6f6e6963}\ () (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS


==================== MBR & Partition Table ==================


========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 465.8 GB) (Disk ID: 3AF72EB9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)


==================== End of Addition.txt ========
 
Last edited:
Hi, Jean.

Although the top of the FRST log was cut off, it is necessary to go at this a different direction and not in either safe mode or normal mode. If you have a printer handy, you may even want to print these instructions for reference.

1. Please download a new copy of Farbar Recovery Scan Tool (FRST) and save it to your flash drive. Note: It is extremely important that you do not place FRST64 in a folder. Just save it to the flash drive.

2. After you have the new copy of FRST on the flash drive, plug in the flash drive on the working computer:

  • Open notepad (Start orb > type notepad into Start Search > chose notepad from list.
  • Please copy the entire contents of the quote box below and paste into notepad.
    C:\Windows\system32\drivers\dwrpswzc.sys
    HKLM\SYSTEM\CurrentControlSet\Services\osvgw
    Click to expand...
  • Click on File > Save as.., name it fixlist.txt and save it to the flash drive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Next:

Plug the flashdrive into the infected PC.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Click on Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

  • Select Command Prompt
Next:

  • In the command window type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press the Fix button.
 
Error message from cmd: "device not ready"
(fixlist.txt is present in flashdrive w-frst64)
 
Error message from cmd (via System Repair): "device not ready"
(fixlist.txt is present in flashdrive w-frst64)

I checked all the USB controllers showing in Device Manager; all said "working properly and best driver already installed". Also in Properties of the flash drive alone, same OK's.
 
Are you using the correct path for the flash drive? For example, if you used e:\frst64 as the path, is that actually the floppy disk drive and not the USB? The easiest way is to open My Computer. Plug in the HDD and watch for it to populate in there with an external drive heading on the right side under "Devices with Removable Storage".
 
Laptop so no floppy. Flash drive comes up under Computer as E:
Tried as both e: and E: - same error
 
DonnaB and I have been discussing the situation. We'd like you to do the following:

Please run the internal disk checker program:
  • Click Start and select "Computer"
  • Right-click C:
  • Select the "Tools" tab
  • In the Error-checking area, click "Check Now"
  • Click "Start"
  • Check the option to "Automatically fix file system errors" and click Start.
You will receive a message that the operation cannot be performed while the system is in use and ask if you want to check when you restart your computer. Click "Schedule disk check" and then restart the computer, allowing disk check to run at startup.

To find the disk check log that is produced please do the following:

Please download ListChkdskResult by SleepyDude to the desktop.
  • Double-click on the icon and click Run
  • The log will appear on your desktop as a .txt file and the notepad will open.
Please copy and paste the results in your next reply.
 
ListChkdskResult by SleepyDude v0.1.7 Beta | 21-09-2013


------< Log generate on 4/30/2018 9:21:44 AM >------
No Events found for Winlogon, Chkdsk or Wininit!
 
Hi Jean,

I am the Donna that Corrine mentioned above. (waves) :)

It appears that your computer has a mind of it's own. Usually when we have this much trouble getting control of a system I like to just put on my girl shoes and give a good swift kick. But of course we can't really do that so let's try the following...


You will need a clean USB that is totally blank so we can download a few programs to and create a bootable recovery USB using and RC.iso.If you had a clean computer to create this bootable USB on that would be even better.

Please take your time reading and doing the steps one by one. To a novice they can be a bit confusing.

Download the following three programs to your desktop :

1. Rufus
2. Download Windows 7 64bit.iso
3. Farbar Recovery Scan Tool x64

Insert the USB into the computer then click on the icon to start/run Rufus.

Select the ISO file on the desktop via the ISO icon. (See icon imagine outlined in green below)

Press Start Burn

Then copy FRST to the same USB

Insert the USB into the sick computer and start the computer. First ensuring that the system is set to boot from USB
Note: If you are not sure how to do that follow the instructions Here

Upon reboot look for and Click repair my computer

Select your operating system

Select Command prompt

At the command prompt type notepad
Then press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe or e:\frst.exe dependant on system
and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

I have run a couple of errands and will be back shortly. :)
 

Attachments

  • Rufus iso.JPG
    Rufus iso.JPG
    42.9 KB · Views: 2
Last edited by a moderator:
Bootup from flashdrive successful. (On this Sony Vaio BIOS is F2)
But, in cmd w-Notepad showing flash drive as X, and using X:\FRST64 rec'd error message "not recognized as command"

Tried variants of capitalization/non, appended w-.exe; all same fail.
<insert bad words here>
 
Hm? Keep trying. I think you might be missing something\overlooking a step or just not doing it right. As I mentioned earlier, the very first time I experimented with this method it took me a couple tries to grasp exactly how to it to get it right.

When you followed the below instructions, what drive letter was assigned to the USB flash under Devices with Removable Storage

At the command prompt type notepad
Then press Enter.
The notepad opens. Under File menu select Open.
Select Computer and find your flash drive letter and close the notepad.

You will need to find and write down the drive letter then close out notepad.

Next you need to type into the command prompt

(drive letter):\frst64.exe
 
Notepad identifies drive letter as X.
(Oddly? in days previous, when in Safe/Normal mode startup, same flash drive in same USB port was identified as drive E.)

Still same fail, "not recognized as valid command" using x:\frst64.exe in cmd whilst booting from flash drive.
(If I try drive letter e - receive the "not ready" error.)
 
P.S. I doublechecked the flashdrive's contents...in the clean laptop (also a Sony Vaio), FRST64 is present. In my infected one, via System Recovery and the cmd>notepad>driveX view to search, and "show all files" - app FRST64 not showing.

Using F2 again to access BIOS in my computer, I tried four times to change back from boot-from-external to normal boot-from-HD. Although carefully selecting save before exiting, it seems changes were not initiated - each time received "cannot restart" error. (I had wanted to doublecheck the flash drives contents in my own machine since they showed fine in the clean laptop) I could go back via F2 to the BIOS startup options, change all back to boot-from-external, and could get a successful start.

So, now, on top of everything else, it seems I am stuck in booting from the flash drive.

OK, Mentor(s), back to the biggest fire first, or one wreck at a time whenever you can.
 
JeanO said:
I am stuck in booting from the flash drive.
Click to expand...
And, have to request shutdown from the last (F2) BIOS screen.

FYI - when attempting (safe) starts - receive Boot Manager error window:

"error occurred while attempting to read boot config data"
"File: \Boot\BCD"
"Status: 0xc000000f"
 
Hi, Jean.

Do you have a System Repair Disk? If not, since you can't get to the start menu, if you have access to another Windows 7 64-bit computer, you can create the repair disk from there. Instructions for creating and using the System Repair Disk are here: Create a system repair disc
 
I do have a System Repair Disk; started off with use of it days ago and rec'd "cannot be repaired" error, leading into the options restore, cmd, etc. - which led to my writing into this forum.

Tried again this afternoon to use it as "boot from optical drive selection" in BIOS to perhaps get around the stuck-in-external boot mode. Nope, BIOS still stuck, even with careful selection of options and "save".

Any other ideas of how I might at least get back to running in safe mode? before I try this...

...since I'm stuck in the boot from flash drive mode anyway - how about my downloading HD wiper DBAN to the flash drive using the other clean laptop, and attempting to run it in the infected one?
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top