1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved Slow Running Computer - Problems Booting and Shutting Down

Discussion in 'Virus & Other Malware Removal' started by HaroRider, Nov 3, 2018.

Thread Status:
Not open for further replies.
Advertisement
  1. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Hello, I don't know what has been going on with my computer lately, but it is very slow. I also have been having issues on it shutting down and starting up. I know the system is old, but I really don't want to have to replace it right now if I don't have to. I am unsure if this is a malware/virus problem or something even more serious.

    I don't mind spending some money to make this machine faster if necessary. So any recommendations on that will be much appreciated.



    Here are my specs:



    Tech Support Guy System Info Utility version 1.0.0.4

    OS Version: Microsoft Windows 7 Ultimate, Service Pack 1, 64 bit

    Processor: Intel(R) Core(TM)2 CPU 6420 @ 2.13GHz, Intel64 Family 6 Model 15 Stepping 6

    Processor Count: 2

    RAM: 7167 Mb

    Graphics Card: NVIDIA GeForce GT 630, -2048 Mb

    Hard Drives: C: 232 GB (46 GB Free);

    Motherboard: ASUSTeK Computer INC., P5B-E Plus

    Antivirus: Microsoft Security Essentials, Enabled and Updated



    I appreciate any help, Thomas
     
    Last edited: Nov 3, 2018
  2. askey127

    askey127 Malware Specialist

    Joined:
    Dec 22, 2006
    Messages:
    3,721
    Hi HaroRider,
    ----------------------------------------------
    Download and Run Temp File Cleaner (TFC.exe)
    Download Temp File Cleaner and save it to your desktop.
    You might want to Save any unsaved work. TFC will close ALL open programs... including your browser!
    Right click the TFC icon and choose Run as administrator.
    If you have a lot of junk files to remove, it could take a while, so please be patient and let it finish.
    When it's done, it will report the total size of files removed. If it asks to Reboot, choose to do so. This will remove files that could not be removed while Windows was running.
    After Restart, log back in to your usual account.
    You can keep TFC on your desktop and run it every week or two to clean out excessive temporary files. It does usually require a restart.

    -------------------------------------------------------------
    Download MyDefrag from here and Install it : http://filehippo.com/download_mydefrag/
    After Installation, run MyDefrag in System Disk Monthly Mode on the C: drive
    (Click System Disk Monthly and then check C: drive, click Run)
    Wait for it. It goes through 6 Zones. It may take an hour or two, depending on how badly the HD is scrambled.
    The Window will be labeled Finished at the top when it is done.
    Going forward, you can run it in System Disk Daily mode, but once every week or two is sufficient.
    It will finish a lot faster in the ensuing runs.

    Let me know how it runs after these are done.
    askey127
     
  3. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Thanks, it seems a bit faster. Is there a way to make sure that its not due to a virus or malware? I have Adwcleaner, Malwarebytes and Microsoft Security Essentials. Are these good enough to find a virus or malware?
     
  4. askey127

    askey127 Malware Specialist

    Joined:
    Dec 22, 2006
    Messages:
    3,721
    HaroRider,
    If it's still not quite up to par, let's take a deeper look to see what might be causing the slowdown.

    -----------------------------------------------------------
    Download and Run the Farbar Scan Tool
    • Download FRST64 and save to your Desktop.
      (If you end up saving it to your Downloads folder, you can move it to the Desktop or run it from Downloads).
    • Double click Frst64.exe to launch it.
    • FRST64 will start to run.
      • When the tool opens click Yes to disclaimer.
      • Press the Scan button.
      • When finished scanning, 2 logs will open on your Desktop, FRST.txt and Addition.txt
      • Please post them in your next reply.
    If you lose track of them, they will be saved in the same location as FRST64.exe
    Feel free to use separate replies for each of the two logs if it's more convenient.
    You can post the full contents of both in your reply, or attach them.

    askey127
     
  5. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Thank you for the help so far!! It is definitely better, than it was.

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24.10.2018
    Ran by Thomas (administrator) on THOMAS-PC (04-11-2018 20:45:33)
    Running from C:\Users\Thomas\Desktop
    Loaded Profiles: Thomas (Available Profiles: Thomas)
    Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: IE)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.3.227\WsAppService.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
    (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
    (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
    (Creative Technology Ltd) C:\Windows\SysWOW64\CtHelper.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Seiko Epson Corporation) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
    (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe

    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [AsioReg] => REGSVR32.EXE /S CTASIO.DLL
    HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2465088 2014-11-17] (NVIDIA Corporation)
    HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
    HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-05-11] (Apple Inc.)
    HKLM-x32\...\Run: [AsioThk32Reg] => REGSVR32.EXE /S CTASIO.DLL
    HKLM-x32\...\Run: [CTHelper] => C:\Windows\SysWOW64\CTHELPER.EXE [19456 2007-04-09] (Creative Technology Ltd)
    HKLM-x32\...\Run: [CTxfiHlp] => C:\Windows\SysWOW64\CTXFIHLP.EXE [19968 2007-04-09] (Creative Technology Ltd)
    HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1308456 2018-05-16] (Seiko Epson Corporation)
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\...\Run: [Chromium] => "c:\users\thomas\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\...\MountPoints2: {6089965c-9de3-11e4-8f8f-001a92d2f743} - K:\LG_PC_Programs.exe
    HKU\S-1-5-18\...\Run: [DevconDefaultDB] => C:\Windows\system32\READREG /SILENT /FAIL=1
    Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Epson Scanner Registration.lnk [2018-11-03]
    ShortcutTarget: Epson Scanner Registration.lnk -> C:\Users\Thomas\AppData\Roaming\Leadertech\PowerRegister\Epson Scanner Registration.exe (Aviata/Epson)
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{E87E5278-7B44-4C37-A056-15845EC0C4B6}: [DhcpNameServer] 192.168.1.1

    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131150147890209734&GUID=747F00F6-E610-406C-9766-3ED9D690C322
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131150147890239736&GUID=747F00F6-E610-406C-9766-3ED9D690C322
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://aol.com/
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
    SearchScopes: HKU\S-1-5-21-2475564236-1283100031-3943380601-1001 -> DefaultScope {3CB5156A-D232-492D-909F-684FB77B1F64} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-2475564236-1283100031-3943380601-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-2475564236-1283100031-3943380601-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL =
    SearchScopes: HKU\S-1-5-21-2475564236-1283100031-3943380601-1001 -> {3CB5156A-D232-492D-909F-684FB77B1F64} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
    DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    StartMenuInternet: IEXPLORE.EXE - iexplore.exe

    FireFox:
    ========
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
    FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-11-12] (NVIDIA Corporation)
    FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-11-12] (NVIDIA Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-09-20] (Adobe Systems Inc.)
    FF Plugin-x32: [email protected]/YahooActiveXPluginBridge;version=1.0.0.1 -> C:\Program Files (x86)\Yahoo!\Common\npyaxmpb.dll [2007-03-09] (Yahoo! Inc.)
    FF Plugin HKU\S-1-5-21-2475564236-1283100031-3943380601-1001: temasys.com.sg/TemWebRTCPlugin -> C:\Users\Thomas\AppData\Roaming\Tem\TemWebRTCPlugin\0.8.902\npTemWebRTCPlugin.dll [2017-10-26] (Temasys)

    Chrome:
    =======
    CHR DefaultProfile: Default
    CHR Profile: C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default [2018-10-06]
    CHR Extension: (YouTube) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-22]
    CHR Extension: (Google Search) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-22]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-05-24]
    CHR Extension: (Gmail) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-06]
    CHR Extension: (Chrome Media Router) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-10-06]

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)
    R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [145224 2018-05-08] (Seiko Epson Corporation)
    R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-11-17] (NVIDIA Corporation)
    R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6440736 2018-03-03] (Malwarebytes)
    R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
    R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
    R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-11-17] (NVIDIA Corporation)
    R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19821376 2014-11-17] (NVIDIA Corporation)
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
    R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.227\WsAppService.exe [492768 2017-06-21] (Wondershare)
    S3 WsDrvInst; C:\Program Files (x86)\Wondershare\Dr.Fone for Android\DriverInstall.exe [X]

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 andnetadb; C:\Windows\System32\Drivers\lgandnetadb.sys [31744 2012-07-03] (Google Inc)
    S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
    S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
    S3 COMMONFX.DLL; C:\Windows\System32\COMMONFX.DLL [151296 2007-04-12] (Creative Technology Ltd)
    S3 CT20XUT.DLL; C:\Windows\System32\CT20XUT.DLL [252712 2007-04-10] (Creative Technology Ltd.)
    S3 CTAUDFX.DLL; C:\Windows\System32\CTAUDFX.DLL [700200 2007-04-10] (Creative Technology Ltd)
    S3 CTEAPSFX.DLL; C:\Windows\System32\CTEAPSFX.DLL [219432 2007-04-10] (Creative Technology Ltd)
    S3 CTEDSPFX.DLL; C:\Windows\System32\CTEDSPFX.DLL [321832 2007-04-10] (Creative Technology Ltd)
    S3 CTEDSPIO.DLL; C:\Windows\System32\CTEDSPIO.DLL [190248 2007-04-10] (Creative Technology Ltd)
    S3 CTEDSPSY.DLL; C:\Windows\System32\CTEDSPSY.DLL [363304 2007-04-10] (Creative Technology Ltd)
    S3 CTERFXFX.DLL; C:\Windows\System32\CTERFXFX.DLL [142120 2007-04-10] (Creative Technology Ltd)
    S3 CTEXFIFX.DLL; C:\Windows\System32\CTEXFIFX.DLL [1571112 2007-04-10] (Creative Technology Ltd.)
    S3 CTHWIUT.DLL; C:\Windows\System32\CTHWIUT.DLL [123688 2007-04-10] (Creative Technology Ltd.)
    S3 CTSBLFX.DLL; C:\Windows\System32\CTSBLFX.DLL [681256 2007-04-10] (Creative Technology Ltd)
    S3 DroidCam; C:\Windows\System32\DRIVERS\droidcam.sys [33592 2016-04-14] (Dev47Apps)
    S3 DroidCamVideo; C:\Windows\System32\DRIVERS\droidcamvideo.sys [229432 2016-04-14] (Dev47Apps)
    R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [76200 2018-01-18] ()
    R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [193248 2018-11-04] (Malwarebytes)
    R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [109800 2018-11-04] (Malwarebytes)
    R3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [45960 2018-11-04] (Malwarebytes)
    R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253664 2018-11-04] (Malwarebytes)
    R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [92280 2018-11-04] (Malwarebytes)
    R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
    R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
    R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
    R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20800 2014-11-17] (NVIDIA Corporation)
    S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38216 2014-10-03] (NVIDIA Corporation)
    S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [10848 2000-04-19] () [File not signed]
    S3 WinUsb; C:\Windows\SysWOW64\DRIVERS\WinUsb.sys [42944 2018-04-21] (Microsoft Corporation)
    S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
    S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2018-11-04 20:45 - 2018-11-04 20:46 - 000015052 _____ C:\Users\Thomas\Desktop\FRST.txt
    2018-11-04 20:45 - 2018-11-04 20:45 - 000000000 ____D C:\FRST
    2018-11-04 20:44 - 2018-11-04 20:45 - 002414592 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
    2018-11-04 20:43 - 2018-11-04 20:43 - 000193248 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
    2018-11-04 20:43 - 2018-11-04 20:43 - 000045960 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
    2018-11-04 20:42 - 2018-11-04 20:45 - 000092280 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
    2018-11-04 20:42 - 2018-11-04 20:42 - 000253664 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
    2018-11-04 20:42 - 2018-11-04 20:42 - 000109800 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
    2018-11-03 21:55 - 2018-11-03 21:55 - 007592144 _____ (Malwarebytes) C:\Users\Thomas\Desktop\adwcleaner_7.2.4.0.exe
    2018-11-03 21:47 - 2018-11-03 21:47 - 000001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
    2018-11-03 21:46 - 2018-11-03 21:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
    2018-11-03 21:46 - 2018-11-03 21:46 - 000000000 ____D C:\ProgramData\MB2Migration
    2018-11-03 21:46 - 2018-11-03 21:46 - 000000000 ____D C:\Program Files\Malwarebytes
    2018-11-03 21:46 - 2018-01-18 07:03 - 000076200 _____ C:\Windows\system32\Drivers\mbae64.sys
    2018-11-03 18:56 - 2018-11-04 04:19 - 000000000 ____D C:\Program Files\MyDefrag v4.3.1
    2018-11-03 18:56 - 2018-11-03 18:56 - 000004120 _____ C:\Windows\System32\Tasks\MyDefrag v4.3.1 Monthly
    2018-11-03 18:56 - 2018-11-03 18:56 - 000003440 _____ C:\Windows\System32\Tasks\MyDefrag v4.3.1 Daily
    2018-11-03 18:56 - 2018-11-03 18:56 - 000000863 _____ C:\Users\Public\Desktop\MyDefrag.lnk
    2018-11-03 18:56 - 2018-11-03 18:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyDefrag v4.3.1
    2018-11-03 18:56 - 2010-05-21 11:11 - 001147392 _____ (J.C. Kessels) C:\Windows\system32\MyDefragScreenSaver_v4.3.1.exe
    2018-11-03 18:56 - 2010-05-21 11:11 - 000485376 _____ (J.C. Kessels) C:\Windows\system32\MyDefragScreenSaver_v4.3.1.scr
    2018-11-03 18:36 - 2018-11-03 18:36 - 000448512 _____ (OldTimer Tools) C:\Users\Thomas\Desktop\TFC.exe
    2018-11-03 13:48 - 2018-11-03 13:48 - 000005525 _____ C:\Users\Thomas\Desktop\New - Slow Running Computer - Problems Booting and Shutting Down Tech Support Guy.url
    2018-11-03 13:11 - 2018-09-18 00:52 - 025735168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2018-11-03 13:11 - 2018-09-17 23:39 - 015283712 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2018-11-03 13:11 - 2018-09-17 23:33 - 020278784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2018-11-03 13:11 - 2018-09-17 23:23 - 001555968 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2018-11-03 13:11 - 2018-09-17 22:34 - 001330176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2018-11-03 13:11 - 2018-09-11 13:28 - 003227136 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2018-11-03 13:11 - 2018-09-08 20:02 - 005552328 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2018-11-03 13:11 - 2018-08-28 01:24 - 014637568 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
    2018-11-03 13:11 - 2018-08-28 01:09 - 011411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
    2018-11-03 13:11 - 2018-08-13 16:49 - 001391856 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
    2018-11-03 13:10 - 2018-09-19 03:08 - 000343552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd3x40.dll
    2018-11-03 13:10 - 2018-09-18 14:08 - 000396888 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2018-11-03 13:10 - 2018-09-18 13:10 - 000348976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2018-11-03 13:10 - 2018-09-18 00:38 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2018-11-03 13:10 - 2018-09-18 00:38 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2018-11-03 13:10 - 2018-09-18 00:27 - 002902016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2018-11-03 13:10 - 2018-09-18 00:26 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2018-11-03 13:10 - 2018-09-18 00:25 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2018-11-03 13:10 - 2018-09-18 00:25 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
    2018-11-03 13:10 - 2018-09-18 00:25 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2018-11-03 13:10 - 2018-09-18 00:25 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2018-11-03 13:10 - 2018-09-18 00:19 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2018-11-03 13:10 - 2018-09-18 00:18 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2018-11-03 13:10 - 2018-09-18 00:16 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2018-11-03 13:10 - 2018-09-18 00:15 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2018-11-03 13:10 - 2018-09-18 00:15 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2018-11-03 13:10 - 2018-09-18 00:14 - 005779456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2018-11-03 13:10 - 2018-09-18 00:14 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2018-11-03 13:10 - 2018-09-18 00:14 - 000794624 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2018-11-03 13:10 - 2018-09-18 00:09 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2018-11-03 13:10 - 2018-09-18 00:06 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2018-11-03 13:10 - 2018-09-18 00:01 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2018-11-03 13:10 - 2018-09-18 00:00 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
    2018-11-03 13:10 - 2018-09-18 00:00 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
    2018-11-03 13:10 - 2018-09-17 23:57 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2018-11-03 13:10 - 2018-09-17 23:57 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2018-11-03 13:10 - 2018-09-17 23:55 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2018-11-03 13:10 - 2018-09-17 23:53 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
    2018-11-03 13:10 - 2018-09-17 23:45 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
    2018-11-03 13:10 - 2018-09-17 23:43 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2018-11-03 13:10 - 2018-09-17 23:42 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2018-11-03 13:10 - 2018-09-17 23:41 - 002136064 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2018-11-03 13:10 - 2018-09-17 23:41 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2018-11-03 13:10 - 2018-09-17 23:35 - 004510720 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2018-11-03 13:10 - 2018-09-17 23:31 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2018-11-03 13:10 - 2018-09-17 23:21 - 000497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2018-11-03 13:10 - 2018-09-17 23:21 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2018-11-03 13:10 - 2018-09-17 23:20 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
    2018-11-03 13:10 - 2018-09-17 23:20 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2018-11-03 13:10 - 2018-09-17 23:19 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2018-11-03 13:10 - 2018-09-17 23:18 - 002295808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2018-11-03 13:10 - 2018-09-17 23:15 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2018-11-03 13:10 - 2018-09-17 23:15 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2018-11-03 13:10 - 2018-09-17 23:14 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2018-11-03 13:10 - 2018-09-17 23:13 - 000662016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2018-11-03 13:10 - 2018-09-17 23:13 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2018-11-03 13:10 - 2018-09-17 23:12 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2018-11-03 13:10 - 2018-09-17 23:10 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2018-11-03 13:10 - 2018-09-17 23:06 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2018-11-03 13:10 - 2018-09-17 23:03 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2018-11-03 13:10 - 2018-09-17 23:02 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
    2018-11-03 13:10 - 2018-09-17 23:02 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
    2018-11-03 13:10 - 2018-09-17 23:00 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2018-11-03 13:10 - 2018-09-17 22:59 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2018-11-03 13:10 - 2018-09-17 22:58 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2018-11-03 13:10 - 2018-09-17 22:57 - 004494848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2018-11-03 13:10 - 2018-09-17 22:57 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
    2018-11-03 13:10 - 2018-09-17 22:53 - 013679616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2018-11-03 13:10 - 2018-09-17 22:52 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
    2018-11-03 13:10 - 2018-09-17 22:51 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2018-11-03 13:10 - 2018-09-17 22:50 - 002059776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2018-11-03 13:10 - 2018-09-17 22:50 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2018-11-03 13:10 - 2018-09-17 22:37 - 004037632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2018-11-03 13:10 - 2018-09-17 22:31 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2018-11-03 13:10 - 2018-09-11 13:23 - 000161280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
    2018-11-03 13:10 - 2018-09-11 13:22 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
    2018-11-03 13:10 - 2018-09-08 20:02 - 001680072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
    2018-11-03 13:10 - 2018-09-08 20:02 - 000986824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
    2018-11-03 13:10 - 2018-09-08 20:02 - 000708296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
    2018-11-03 13:10 - 2018-09-08 20:02 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
    2018-11-03 13:10 - 2018-09-08 20:02 - 000265416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
    2018-11-03 13:10 - 2018-09-08 20:02 - 000262344 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
    2018-11-03 13:10 - 2018-09-08 20:02 - 000154824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
    2018-11-03 13:10 - 2018-09-08 20:02 - 000095432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
    2018-11-03 13:10 - 2018-09-08 20:01 - 001664320 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 002851840 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 002009600 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 001211904 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000094208 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
    2018-11-03 13:10 - 2018-09-08 19:59 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
    2018-11-03 13:10 - 2018-09-08 19:58 - 001461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
    2018-11-03 13:10 - 2018-09-08 19:58 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
    2018-11-03 13:10 - 2018-09-08 19:58 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
    2018-11-03 13:10 - 2018-09-08 19:58 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
    2018-11-03 13:10 - 2018-09-08 19:58 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
    2018-11-03 13:10 - 2018-09-08 19:58 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
    2018-11-03 13:10 - 2018-09-08 19:58 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
    2018-11-03 13:10 - 2018-09-08 19:58 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:57 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:46 - 004054216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2018-11-03 13:10 - 2018-09-08 19:46 - 003959496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2018-11-03 13:10 - 2018-09-08 19:46 - 001314072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
    2018-11-03 13:10 - 2018-09-08 19:44 - 002755584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themeui.dll
    2018-11-03 13:10 - 2018-09-08 19:44 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
    2018-11-03 13:10 - 2018-09-08 19:44 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
    2018-11-03 13:10 - 2018-09-08 19:44 - 000313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
    2018-11-03 13:10 - 2018-09-08 19:44 - 000275968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
    2018-11-03 13:10 - 2018-09-08 19:44 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
    2018-11-03 13:10 - 2018-09-08 19:44 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
    2018-11-03 13:10 - 2018-09-08 19:44 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
    2018-11-03 13:10 - 2018-09-08 19:44 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
    2018-11-03 13:10 - 2018-09-08 19:44 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
    2018-11-03 13:10 - 2018-09-08 19:44 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
    2018-11-03 13:10 - 2018-09-08 19:43 - 001391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
    2018-11-03 13:10 - 2018-09-08 19:43 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2018-11-03 13:10 - 2018-09-08 19:43 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
    2018-11-03 13:10 - 2018-09-08 19:43 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
    2018-11-03 13:10 - 2018-09-08 19:43 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
    2018-11-03 13:10 - 2018-09-08 19:43 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
    2018-11-03 13:10 - 2018-09-08 19:43 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
    2018-11-03 13:10 - 2018-09-08 19:43 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
    2018-11-03 13:10 - 2018-09-08 19:43 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
    2018-11-03 13:10 - 2018-09-08 19:43 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
    2018-11-03 13:10 - 2018-09-08 19:43 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:42 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:25 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
    2018-11-03 13:10 - 2018-09-08 19:25 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
    2018-11-03 13:10 - 2018-09-08 19:25 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
    2018-11-03 13:10 - 2018-09-08 19:25 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
    2018-11-03 13:10 - 2018-09-08 19:21 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
    2018-11-03 13:10 - 2018-09-08 19:21 - 000129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys
    2018-11-03 13:10 - 2018-09-08 19:20 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
    2018-11-03 13:10 - 2018-09-08 19:18 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
    2018-11-03 13:10 - 2018-09-08 19:16 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
    2018-11-03 13:10 - 2018-09-08 19:15 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
    2018-11-03 13:10 - 2018-09-08 19:15 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdk8.sys
    2018-11-03 13:10 - 2018-09-08 19:15 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\intelppm.sys
    2018-11-03 13:10 - 2018-09-08 19:15 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\processr.sys
    2018-11-03 13:10 - 2018-09-08 19:15 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdppm.sys
    2018-11-03 13:10 - 2018-09-08 19:15 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
    2018-11-03 13:10 - 2018-09-08 19:13 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
    2018-11-03 13:10 - 2018-09-08 19:13 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
    2018-11-03 13:10 - 2018-09-08 19:13 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
    2018-11-03 13:10 - 2018-09-08 19:13 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
    2018-11-03 13:10 - 2018-09-08 19:12 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
    2018-11-03 13:10 - 2018-09-08 19:12 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:12 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:12 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2018-11-03 13:10 - 2018-09-08 19:12 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2018-11-03 13:10 - 2018-08-28 01:24 - 012574720 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
    2018-11-03 13:10 - 2018-08-28 01:24 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
    2018-11-03 13:10 - 2018-08-28 01:24 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
    2018-11-03 13:10 - 2018-08-28 01:24 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
    2018-11-03 13:10 - 2018-08-28 01:09 - 012574208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
    2018-11-03 13:10 - 2018-08-28 00:52 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
    2018-11-03 13:10 - 2018-08-28 00:52 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
    2018-11-03 13:10 - 2018-08-28 00:52 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
    2018-11-03 13:10 - 2018-08-15 21:18 - 000041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
    2018-11-03 13:10 - 2018-08-13 10:54 - 000687616 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
    2018-11-03 13:10 - 2018-08-12 15:32 - 000140976 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
    2018-11-03 13:10 - 2018-08-12 15:27 - 000680960 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
    2018-11-03 13:10 - 2018-08-08 10:54 - 000194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
    2018-11-03 13:10 - 2018-08-08 10:54 - 000170496 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
    2018-11-03 13:10 - 2018-08-08 10:40 - 000158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
    2018-11-03 13:10 - 2018-08-08 10:40 - 000142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itss.dll
    2018-10-27 12:39 - 2018-10-27 12:39 - 000000000 ____D C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DroidCam
    2018-10-17 22:05 - 2018-10-17 22:05 - 185950219 _____ C:\Users\Thomas\HMK - Black God White Devil - Download.zip
    2018-10-17 21:00 - 2018-11-03 22:08 - 000017558 _____ C:\Users\Thomas\Desktop\Level II.odt
    2018-10-13 20:12 - 2018-10-13 20:12 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maxis
    2018-10-13 20:08 - 2018-10-13 20:08 - 000000000 ____D C:\Program Files (x86)\Maxis
    2018-10-13 20:03 - 2018-10-13 20:03 - 000003156 _____ C:\Windows\System32\Tasks\{B3FC8E5E-4391-4124-9091-548B3D7877BD}
    2018-10-13 19:35 - 1999-05-12 19:00 - 001064456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCTL.OCX
    2018-10-13 19:31 - 2018-10-13 19:31 - 000000000 ____D C:\Program Files\Microsoft Office
    2018-10-13 19:30 - 2018-10-13 19:30 - 000000000 ____D C:\~MSSETUP.T
    2018-10-11 16:09 - 2018-10-11 16:10 - 000189642 _____ C:\Windows\ntbtlog.txt
    2018-10-10 01:23 - 2018-10-10 01:27 - 000015512 _____ C:\Users\Thomas\Desktop\BOC Project.ods

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2018-11-04 20:42 - 2009-07-14 00:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
    2018-11-04 20:41 - 2014-11-29 21:58 - 000000000 ____D C:\ProgramData\NVIDIA
    2018-11-04 10:13 - 2014-11-29 18:18 - 000000000 ____D C:\Program Files (x86)\Steam
    2018-11-04 09:37 - 2018-07-27 19:43 - 000000907 _____ C:\Windows\Tasks\EPSON ES-200 Update.job
    2018-11-04 09:32 - 2009-07-13 23:45 - 000021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2018-11-04 09:32 - 2009-07-13 23:45 - 000021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2018-11-04 09:30 - 2009-07-14 00:13 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
    2018-11-04 09:30 - 2009-07-13 22:20 - 000000000 ____D C:\Windows\inf
    2018-11-04 09:26 - 2016-05-14 16:26 - 000000274 _____ C:\Windows\Tasks\{0CFA3DD2-96AE-3053-FFC5-25ECA3383F18}.job
    2018-11-04 04:46 - 2009-07-13 22:20 - 000000000 ____D C:\Windows\rescache
    2018-11-03 21:58 - 2009-07-13 23:45 - 000295616 _____ C:\Windows\system32\FNTCACHE.DAT
    2018-11-03 21:56 - 2016-08-08 00:36 - 000000000 ____D C:\AdwCleaner
    2018-11-03 21:46 - 2015-05-18 18:43 - 000000000 ____D C:\ProgramData\Malwarebytes
    2018-11-03 16:45 - 2014-12-09 22:51 - 000000000 ____D C:\Windows\system32\appraiser
    2018-11-03 16:45 - 2014-11-29 18:33 - 000000000 ___SD C:\Windows\system32\CompatTel
    2018-11-03 16:45 - 2009-07-13 22:20 - 000000000 ____D C:\Windows\registration
    2018-11-03 16:45 - 2009-07-13 22:20 - 000000000 ____D C:\Program Files\Common Files\Microsoft Shared
    2018-11-03 16:44 - 2018-09-20 06:39 - 000000000 ____D C:\Users\Thomas\AppData\Roaming\Leadertech
    2018-11-03 12:56 - 2014-11-29 21:12 - 000000000 ____D C:\Users\Thomas
    2018-11-03 12:56 - 2009-07-14 00:32 - 000000000 ____D C:\Windows\system32\FxsTmp
    2018-10-27 12:45 - 2016-04-14 17:13 - 000000035 _____ C:\ProgramData\droidcam-settings
    2018-10-25 17:09 - 2015-02-04 00:06 - 000002224 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2018-10-23 20:41 - 2015-11-25 15:58 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
    2018-10-18 17:29 - 2014-11-29 22:09 - 000066424 _____ C:\Users\Thomas\AppData\Local\GDIPFONTCACHEV1.DAT
    2018-10-17 21:14 - 2015-01-08 02:46 - 000000000 ____D C:\Users\Thomas\AppData\LocalLow\Adobe
    2018-10-15 16:48 - 2014-11-29 18:29 - 000559880 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
    2018-10-13 20:12 - 2016-12-17 14:26 - 000000754 _____ C:\Windows\eReg.dat
    2018-10-13 19:36 - 2015-06-27 13:11 - 000000000 ____D C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
    2018-10-11 01:12 - 2014-11-29 18:31 - 000000000 ____D C:\Windows\system32\MRT
    2018-10-11 01:10 - 2014-11-29 18:31 - 136745976 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2018-10-11 01:07 - 2014-11-30 01:11 - 000773912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
    2018-10-10 22:22 - 2018-10-02 21:19 - 000016623 _____ C:\Users\Thomas\Desktop\Conversions.odt
    2018-10-09 11:35 - 2014-11-30 02:41 - 000842240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2018-10-09 11:35 - 2014-11-30 02:41 - 000175104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2018-10-09 11:35 - 2014-11-30 02:41 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2018-10-09 11:35 - 2014-11-30 02:41 - 000000000 ____D C:\Windows\system32\Macromed
    2018-10-09 11:34 - 2014-11-30 02:41 - 000000000 ____D C:\Windows\SysWOW64\Macromed
    2018-10-05 21:02 - 2009-07-14 00:08 - 000032628 _____ C:\Windows\Tasks\SCHEDLGU.TXT

    ==================== Files in the root of some directories =======

    2015-05-16 14:24 - 2015-05-16 14:24 - 000000000 _____ () C:\Users\Thomas\AppData\Local\Temp.dat

    Files to move or delete:
    ====================
    C:\Windows\Tasks\{0CFA3DD2-96AE-3053-FFC5-25ECA3383F18}.job


    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2018-11-04 04:39

    ==================== End of FRST.txt ============================
     
  6. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24.10.2018
    Ran by Thomas (04-11-2018 20:46:41)
    Running from C:\Users\Thomas\Desktop
    Windows 7 Ultimate Service Pack 1 (X64) (2014-11-30 02:11:55)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-2475564236-1283100031-3943380601-500 - Administrator - Disabled)
    Guest (S-1-5-21-2475564236-1283100031-3943380601-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-2475564236-1283100031-3943380601-1002 - Limited - Enabled)
    Thomas (S-1-5-21-2475564236-1283100031-3943380601-1001 - Administrator - Enabled) => C:\Users\Thomas

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
    AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 19.008.20080 - Adobe Systems Incorporated)
    Adobe Flash Player 31 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 31.0.0.122 - Adobe Systems Incorporated)
    AIM 7 (HKLM-x32\...\AIM_7) (Version: - )
    Apple Application Support (32-bit) (HKLM-x32\...\{26356515-5821-40FA-9C3D-9785052A1062}) (Version: 4.3.1 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\...\{C2651553-6CA3-4822-B2E6-BC4ACA6E0EA2}) (Version: 4.3.1 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
    Batch PDF Merger version 5.1.1 (HKLM-x32\...\{43CF388F-EB3B-4AF2-9A3C-0E5A2013F598}_is1) (Version: 5.1.1 - Essex Software, LLC)
    Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
    Call of Duty(R) - World at War(TM) (HKLM-x32\...\{D80A6A73-E58A-4673-AFF5-F12D7110661F}) (Version: 1.0 - Activision) Hidden
    Call of Duty(R) - World at War(TM) (HKLM-x32\...\InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}) (Version: 1.0 - Activision)
    Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Document Capture Pro (HKLM-x32\...\{3FB9973F-8927-4739-B2B4-898A04FC2961}) (Version: 2.01.0004 - Seiko Epson Corporation)
    Epson ES-200_ES-300W_ES-300WR Guide (HKLM-x32\...\UsersGuideEpson ES-200_ES-300W_ES-300WR Guide_is1) (Version: 1.0 - Epson America, Inc.)
    Epson Event Manager (HKLM-x32\...\{D15E8620-6B05-4E19-BC82-E38A8D7F6330}) (Version: 3.10.0099 - Seiko Epson Corporation)
    EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
    Epson Scan 2 (HKLM-x32\...\Epson Scan 2) (Version: - Seiko Epson Corporation)
    EPSON Scan OCR Component (HKLM-x32\...\{563B99D8-8895-4E3E-AE8D-15BE8C05F1C1}) (Version: 3.00.04 - SEIKO EPSON Corp.)
    Epson ScanSmart (HKLM-x32\...\{0759F4C1-F260-41C6-9EC3-D5C7CAE4F462}) (Version: 1.0.4 - Seiko Epson Corporation)
    Epson ScanSmart Receipt Manager Plug-In (HKLM-x32\...\{DECE351A-225E-430D-84CD-83B178BBF2B5}) (Version: 1.01.0000 - Seiko Epson Corporation)
    Epson Software Updater (HKLM-x32\...\{60A3CB9F-4429-4C7A-AA97-77CC4FE10671}) (Version: 4.4.9 - Seiko Epson Corporation)
    EPSON WorkForce 500 Series Printer Uninstall (HKLM\...\EPSON WorkForce 500 Series) (Version: - SEIKO EPSON Corporation)
    ES-200_ES-300W User’s Guide (HKLM-x32\...\UsersGuideES-200_ES-300W User’s Guide_is1) (Version: 1.0 - Epson America, Inc.)
    Extended Asian Language font pack for Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-2530-0000-AC13084E6700}) (Version: 19.008.20071 - Adobe Systems Incorporated)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 70.0.3538.77 - Google Inc.)
    Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
    Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
    GWX Control Panel (HKLM-x32\...\UltimateOutsider_GwxControlPanel) (Version: - UltimateOutsider)
    Intel® Hardware Accelerated Execution Manager (HKLM\...\{27276DC1-66AA-4B16-918D-5AB1EEDF09C6}) (Version: 6.0.5 - Intel Corporation)
    iTunes (HKLM\...\{58D7E5F7-BAD1-49C5-93C8-B655736EDA00}) (Version: 12.4.0.119 - Apple Inc.)
    LG United Mobile Drivers (HKLM-x32\...\{5DB849D6-9392-4FB7-9ABB-87ED433152E5}) (Version: 3.8.1 - LG Electronics)
    Malwarebytes version 3.4.4.2398 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.4.4.2398 - Malwarebytes)
    Maxi PC Suite (HKLM-x32\...\{4BB75795-621C-424A-8886-9F054F01A187}) (Version: 1.23 - Autel) Hidden
    Maxi PC Suite (HKLM-x32\...\InstallShield_{4BB75795-621C-424A-8886-9F054F01A187}) (Version: 1.23 - Autel)
    Microsoft .NET Framework 4.7.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.03062 - Microsoft Corporation)
    Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)
    Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
    Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
    MS Access 97 SP2 (HKLM-x32\...\MS Access 97 SP2) (Version: - )
    MyDefrag v4.3.1 (HKLM\...\MyDefrag v4.3.1_is1) (Version: 4.0.0.0 - J.C. Kessels)
    Network Play System (Patching) (HKLM-x32\...\Network Play System (Patching)) (Version: - )
    NVIDIA 3D Vision Controller Driver 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.75 - NVIDIA Corporation)
    NVIDIA 3D Vision Driver 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.75 - NVIDIA Corporation)
    NVIDIA GeForce Experience 2.1.4.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.4.1 - NVIDIA Corporation)
    NVIDIA Graphics Driver 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.75 - NVIDIA Corporation)
    NVIDIA HD Audio Driver 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
    NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
    OpenOffice 4.1.2 (HKLM-x32\...\{E6AD67BB-1C33-4AB3-A387-E0D48137AB70}) (Version: 4.12.9782 - Apache Software Foundation)
    SHIELD Streaming (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv) (Version: 3.1.2000 - NVIDIA Corporation) Hidden
    SHIELD Wireless Controller Driver (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShieldWirelessController) (Version: 16.13.69 - NVIDIA Corporation) Hidden
    SimCity 3000 Unlimited (HKLM-x32\...\SimCity 3000 Unlimited) (Version: - )
    Starcraft (HKLM-x32\...\Starcraft) (Version: - )
    Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
    TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
    TemWebRTCPlugin (HKLM-x32\...\{00A96020-0597-4602-9E6F-FDACD74483B4}) (Version: 0.8.902 - Temasys)
    The Sims (HKLM-x32\...\The Sims) (Version: - )
    Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
    WinRAR 5.21 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
    ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2015-02-15] (Alexander Roshal)
    ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2015-02-15] (Alexander Roshal)
    ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
    ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-03] (Malwarebytes)
    ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
    ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2014-11-12] (NVIDIA Corporation)
    ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-03] (Malwarebytes)
    ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2015-02-15] (Alexander Roshal)
    ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2015-02-15] (Alexander Roshal)

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {08CC7756-255F-4331-9FD4-B178EF47401F} - System32\Tasks\{655F5D48-1233-4C71-9614-1DBCF12EA07D} => "C:\Program Files\Internet Explorer\iexplore.exe" hxxp://ui.skype.com/ui/0/7.18.85.112/en/abandoninstall?page=tsProgressBar
    Task: {25FDDB0C-50E4-4C51-82C7-083B337ED473} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
    Task: {333D8719-A7F8-46D0-B297-0F68AA80916C} - System32\Tasks\MyDefrag v4.3.1 Daily => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticDaily.MyD [2010-05-21] ()
    Task: {474B85D1-CA50-4EAF-8096-2C98C6775606} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
    Task: {4960080B-A8B1-4886-883D-9B2FE4986648} - System32\Tasks\{4D025105-9C12-4688-8867-D34681DE77DD} => C:\Windows\system32\pcalua.exe -a "C:\Users\Thomas\Desktop\Honda Civic\2\SetupCivic.exe" -d "C:\Users\Thomas\Desktop\Honda Civic\2"
    Task: {4EBC6494-DFA8-4BAD-B454-E3B1A03A372D} - System32\Tasks\MyDefrag v4.3.1 Monthly => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticMonthly.MyD [2010-05-21] ()
    Task: {51CED45B-5258-4D5C-AFAB-EE28B3EA6E92} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-10-09] (Adobe Systems Incorporated)
    Task: {76C2D497-5AC4-41F4-893A-C9D7C0B3B163} - System32\Tasks\{0CFA3DD2-96AE-3053-FFC5-25ECA3383F18} => C:\Users\Thomas\AppData\Local\{0E1B3~1\UNINST~1.EXE <==== ATTENTION
    Task: {884D045C-4B8F-4751-80B6-05A158B46B7E} - System32\Tasks\{B3FC8E5E-4391-4124-9091-548B3D7877BD} => C:\Windows\system32\pcalua.exe -a C:\Windows\IsUninst.exe -c -f"C:\Program Files (x86)\Maxis\The Sims\Uninst.isu"
    Task: {8C8D0618-D888-4296-BED9-4AAA0AA16E12} - System32\Tasks\EPSON ES-200 Update => C:\Program Files (x86)\epson\Epson Scan 2\Update\e_dtsksd.exe [2018-05-08] (SEIKO EPSON CORPORATION)
    Task: {ABB6EBAF-5C52-492E-B8CF-45C767898DE6} - System32\Tasks\{C7A0B69A-D81B-4C3E-9FB6-93EC947E6E79} => C:\Program Files (x86)\Starcraft\StarCraft.exe [2009-01-09] (Blizzard Entertainment)
    Task: {B88B07C2-98A3-4072-B62F-8DF41C59EC93} - System32\Tasks\{D9FF4F6F-7E8B-4AE6-9500-9FEF40A01EC3} => "C:\Program Files\Internet Explorer\iexplore.exe" hxxps://ui.skype.com/ui/0/7.31.80.104/en/abandoninstall?page=tsProgressBar
    Task: {B8B35056-645B-42AF-B95F-59D95F863A8D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-08-13] (Adobe Systems Incorporated)
    Task: {DA6B4C7C-A3B3-45D6-9AC2-62B8C5DD98CD} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\EPSON ES-200 Update.job => C:\Program Files (x86)\epson\Epson Scan 2\Update\e_dtsksd.exe/EXE_S:EPSON ES-200,ES013E.DAT /F:UpdateThomasĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
    Task: C:\Windows\Tasks\{0CFA3DD2-96AE-3053-FFC5-25ECA3383F18}.job => C:\Users\Thomas\AppData\Local\{0E1B3~1\UNINST~1.EXE <==== ATTENTION

    ==================== Shortcuts & WMI ========================

    (The entries could be listed to be restored or removed.)


    ==================== Loaded Modules (Whitelisted) ==============

    2014-11-29 21:58 - 2014-11-12 16:56 - 000118080 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
    2016-04-22 00:07 - 2016-04-22 00:07 - 000092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2016-04-22 00:07 - 2016-04-22 00:07 - 001337144 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2018-11-03 21:46 - 2018-02-05 13:44 - 002299168 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
    2018-11-03 21:46 - 2018-03-01 09:31 - 002488608 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\ProgramData\TEMP:972E3A44 [127]

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)


    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 21:34 - 2016-05-14 16:39 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
    DNS Servers: 192.168.1.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    If an entry is included in the fixlist, it will be removed.


    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{4687C519-3D42-4627-B437-336323F33362}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
    FirewallRules: [{0CB79711-8767-421B-BB68-61C4A73D4CC0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
    FirewallRules: [{97C3A49E-4037-4945-9951-A0D4A19CC7E0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    FirewallRules: [{32E1F334-F1B7-4424-A286-35ED6B2C2857}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    FirewallRules: [{112B7127-E66A-4FA1-AB4F-A33B24592095}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    FirewallRules: [{0B9B1959-5766-450B-AFD3-1DEA93B95558}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    FirewallRules: [{D55DA5C4-2670-4B7A-AD34-EC8D5BE68632}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    FirewallRules: [{2ADDA51D-D26C-4972-8993-A13028AB39B6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    FirewallRules: [{CBC5CF28-4AB4-4D40-A2B3-9462929A5928}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
    FirewallRules: [{86876A32-356C-4624-98EE-7A1D1D1DA088}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
    FirewallRules: [{498B6236-4E1E-4EA7-9DD2-03900AC05E71}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source\hl2.exe
    FirewallRules: [{5663B212-F6BB-4512-BFEF-9B4C9A3F6B3A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source\hl2.exe
    FirewallRules: [{F81B1AFC-E1A0-44E9-B199-E10A06A2BF86}] => (Allow) C:\Users\Thomas\AppData\Local\Temp\nsz5967.tmp\CnetInstaller-10648593.exe
    FirewallRules: [{8BA5D0AD-4E8C-49B4-AFE9-B0D92C4DC131}] => (Allow) C:\Users\Thomas\AppData\Local\Temp\nsz5967.tmp\CnetInstaller-10648593.exe
    FirewallRules: [{E627DF3B-8D43-4003-8FBC-7E530D0DAB2F}] => (Allow) C:\Program Files (x86)\AIM\aim.exe
    FirewallRules: [{1AE9E2D5-3C54-4068-9758-5D4B7785C820}] => (Allow) C:\Program Files (x86)\AIM\aim.exe
    FirewallRules: [{F68609E6-1A18-48C0-9CFD-ADD9D3AABE4B}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
    FirewallRules: [{756BD68C-E730-43A5-A133-7642EDD073A8}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
    FirewallRules: [{543349FD-E7D0-4E47-8A86-9544C699EF16}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
    FirewallRules: [{BC698ACF-DAD7-48EB-AEFC-4B65C51D4CC6}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
    FirewallRules: [{0315A52C-2D3B-4A48-817C-EC77234C199C}] => (Allow) C:\Program Files (x86)\Activision\Call of Duty - World at War\CoDWaWmp.exe
    FirewallRules: [{5564A70C-44E0-4B94-93E2-851F8E10730A}] => (Allow) C:\Program Files (x86)\Activision\Call of Duty - World at War\CoDWaWmp.exe
    FirewallRules: [{31CBFA62-6DEB-411F-9381-EA1CB317D87E}] => (Allow) C:\Program Files (x86)\Activision\Call of Duty - World at War\CoDWaW.exe
    FirewallRules: [{53F7DFB9-45D6-4FC7-A445-0AA0D356A644}] => (Allow) C:\Program Files (x86)\Activision\Call of Duty - World at War\CoDWaW.exe
    FirewallRules: [TCP Query User{2C198AED-F8F6-4187-9A6F-B0BC2CA54B2A}C:\program files (x86)\starcraft\starcraft.exe] => (Allow) C:\program files (x86)\starcraft\starcraft.exe
    FirewallRules: [UDP Query User{EF72E5B4-61F6-43C2-91B3-F24CBF8AD40E}C:\program files (x86)\starcraft\starcraft.exe] => (Allow) C:\program files (x86)\starcraft\starcraft.exe
    FirewallRules: [{EC9B18AA-CB0E-46E0-8172-F7266137CEF9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Half-Life\hl.exe
    FirewallRules: [{8DC7E831-AD56-43ED-A4D9-B0D5F9FB317E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Half-Life\hl.exe
    FirewallRules: [TCP Query User{097A5515-E7F0-4E82-BF44-D2798B741008}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [UDP Query User{5D1866C6-EC05-4313-8949-66E83305FECE}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [TCP Query User{9BA18054-0D32-4BAC-8BC6-8A0A50F89118}C:\program files (x86)\secondlifeviewer\slvoice.exe] => (Block) C:\program files (x86)\secondlifeviewer\slvoice.exe
    FirewallRules: [UDP Query User{ED951674-C95D-4BE2-94B7-56C4E808C87B}C:\program files (x86)\secondlifeviewer\slvoice.exe] => (Block) C:\program files (x86)\secondlifeviewer\slvoice.exe
    FirewallRules: [{8FA1E749-C69B-4320-A060-BED0CAFF3341}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{ADB6AFD1-B056-47AC-8809-DA5AD208423D}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{6311EA5B-18EC-40BD-83B6-77AD6EE6FFE3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{9EA2AC88-7417-4427-9828-1C5F3C1DB8A9}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{53C6944D-3839-4436-8AE5-78193CEF0D77}] => (Allow) C:\Program Files\iTunes\iTunes.exe
    FirewallRules: [{691349F7-53C9-4E72-9D8C-BCAB259431D4}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
    FirewallRules: [{5A90D081-0928-4487-8337-FE55568DC5D5}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
    FirewallRules: [{C8E4309B-8281-4ADC-AD5F-15D7C1EEE2BE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
    FirewallRules: [{B5C1DBC1-C623-483D-B865-3E276D2366B7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
    FirewallRules: [{D6BCCC3E-383E-4CAA-AC33-124746872D6C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto IV\GTAIV\LaunchGTAIV.exe
    FirewallRules: [{A6C18709-879B-4089-8CC6-1335EF1CD679}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto IV\GTAIV\LaunchGTAIV.exe
    FirewallRules: [TCP Query User{24974B3D-45FF-4D52-9309-2C44B428CED8}C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe
    FirewallRules: [UDP Query User{341905C4-E075-467F-8511-462143BF7C7D}C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe
    FirewallRules: [TCP Query User{CF7CD6A5-FE19-41EC-8C70-3963275AE604}C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe] => (Allow) C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe
    FirewallRules: [UDP Query User{A19A7966-D66B-4DB1-A2B1-6820C7616CCE}C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe] => (Allow) C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe
    FirewallRules: [{637C394F-FE83-4E3E-97FA-9E521F142CB3}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe
    FirewallRules: [{B67E8A06-3366-419C-B56B-5B49BB55B592}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe
    FirewallRules: [{DF12EE0E-9A5A-4020-967E-5D17B7FE5FD7}] => (Allow) C:\Program Files (x86)\Autel\PassThru\Maxi PC Suit\PCLink.exe
    FirewallRules: [{BEA35DC2-48E4-4237-9626-4FD9751C6575}] => (Allow) C:\Program Files (x86)\Autel\PassThru\Maxi PC Suit\PCLink.exe
    FirewallRules: [{9EEA2958-95C4-42E1-8613-BE03309BCD40}] => (Allow) LPort=5150
    FirewallRules: [{6AC572BB-2D17-4990-A65F-582D1E7F731B}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
    FirewallRules: [{C7EF1E7B-ABC8-49E4-A89A-B49B4F3EE6BF}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
    FirewallRules: [{3AB2EEC1-1E63-407E-B4F4-A0FBF7427929}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    FirewallRules: [{054D39BD-473C-4571-AA7A-A145F582F5FB}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    FirewallRules: [{1571C5CD-C0A1-4363-A6F8-C465932CB086}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    FirewallRules: [{D4B7EB47-9510-4972-98EF-5A385BC5066F}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    FirewallRules: [TCP Query User{8DE86726-A402-4E80-9723-A1DE5C86E56C}C:\program files (x86)\maxis\simcity 3000 unlimited\apps\updater\updater.exe] => (Allow) C:\program files (x86)\maxis\simcity 3000 unlimited\apps\updater\updater.exe
    FirewallRules: [UDP Query User{F04AC7A6-6FA8-478C-84CD-BF268FFCCC88}C:\program files (x86)\maxis\simcity 3000 unlimited\apps\updater\updater.exe] => (Allow) C:\program files (x86)\maxis\simcity 3000 unlimited\apps\updater\updater.exe
    FirewallRules: [{5EE5B222-3E81-43D0-928D-746569591CFD}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    FirewallRules: [{4633B076-78E8-4A92-A15A-5138D0738CD8}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe
    FirewallRules: [{62660209-A7B6-4445-A3FF-696EF5329DFC}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe

    ==================== Restore Points =========================

    04-11-2018 04:46:37 Scheduled Checkpoint

    ==================== Faulty Device Manager Devices =============

    Name: NVIDIA High Definition Audio
    Description: NVIDIA High Definition Audio
    Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
    Manufacturer: NVIDIA
    Service: NVHDA
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

    Name: AT91 USB to Serial Converter (COM3)
    Description: AT91 USB to Serial Converter
    Class Guid: {4d36e978-e325-11ce-bfc1-08002be10318}
    Manufacturer: ATMEL Corp.
    Service: usbser
    Problem: : This device cannot start. (Code10)
    Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
    On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

    Name: NVIDIA Virtual Audio Device (Wave Extensible) (WDM)
    Description: NVIDIA Virtual Audio Device (Wave Extensible) (WDM)
    Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
    Manufacturer: NVIDIA
    Service: nvvad_WaveExtensible
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (11/04/2018 08:42:03 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
    Description: Event-ID 1

    Error: (11/04/2018 08:42:03 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
    Description: Event-ID 1

    Error: (11/04/2018 09:24:31 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
    Description: Event-ID 1

    Error: (11/04/2018 09:24:31 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
    Description: Event-ID 1

    Error: (11/04/2018 09:10:00 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program mbam.exe version 3.0.0.1395 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

    Process ID: 13d4

    Start Time: 01d47447b25c710b

    Termination Time: 60000

    Application Path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe

    Report Id: 245b3477-e03b-11e8-948a-0018f3ee8f2a

    Error: (11/04/2018 09:06:19 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
    Description: Event-ID 1

    Error: (11/04/2018 09:06:19 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
    Description: Event-ID 1

    Error: (11/03/2018 10:13:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program IEXPLORE.EXE version 11.0.9600.19155 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

    Process ID: 152c

    Start Time: 01d473ec4509dc9e

    Termination Time: 63

    Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

    Report Id:


    System errors:
    =============
    Error: (11/04/2018 08:43:16 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 40.

    Error: (11/04/2018 08:43:16 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 70.

    Error: (11/04/2018 09:24:59 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 40.

    Error: (11/04/2018 09:24:59 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 70.

    Error: (11/04/2018 09:06:44 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 40.

    Error: (11/04/2018 09:06:44 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 70.

    Error: (11/04/2018 03:11:41 AM) (Source: volsnap) (EventID: 36) (User: )
    Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

    Error: (11/03/2018 10:01:13 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 40.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM)2 CPU 6420 @ 2.13GHz
    Percentage of memory in use: 27%
    Total physical RAM: 7167.18 MB
    Available physical RAM: 5201.25 MB
    Total Virtual: 14332.5 MB
    Available Virtual: 12412.62 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:232.79 GB) (Free:108.13 GB) NTFS

    \\?\Volume{4d231d83-7835-11e4-a18d-806e6f6e6963}\ (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7/8/10) (Size: 232.9 GB) (Disk ID: 2E26A10E)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
     
  7. askey127

    askey127 Malware Specialist

    Joined:
    Dec 22, 2006
    Messages:
    3,721
    HaroRider,
    Run this to clean up items that may be slowing your machine or opening you to junkware.
    --------------------------------------------------------
    Run A Fix With FRST
    Download attached Fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both the program FRST64.exe and Fixlist.txt be in the same location, or the fix will not work.
    (Both on the Desktop is OK, or both in the same folder elsewhere)

    Run FRST64 and press the FIX button just once, and wait. DO NOT PRESS THE SCAN BUTTON.
    If for some reason the tool needs a restart, please make sure you let the system restart normally.
    The tool may start automatically and complete its work after the system restart. Let the tool complete its run.
    When finished, FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents in your reply.

    Let me know how things work after this is completed.
    Also tell me if any problems with it.

    askey127
     

    Attached Files:

  8. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Fix result of Farbar Recovery Scan Tool (x64) Version: 24.10.2018
    Ran by Thomas (05-11-2018 17:03:20) Run:1
    Running from C:\Users\Thomas\Desktop
    Loaded Profiles: Thomas (Available Profiles: Thomas)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************

    CreateRestorePoint:
    CloseProcesses:
    Task: {76C2D497-5AC4-41F4-893A-C9D7C0B3B163} - System32\Tasks\{0CFA3DD2-96AE-3053-FFC5-25ECA3383F18} => C:\Users\Thomas\AppData\Local\{0E1B3~1\UNINST~1.EXE <==== ATTENTION
    Task: C:\Windows\Tasks\{0CFA3DD2-96AE-3053-FFC5-25ECA3383F18}.job => C:\Users\Thomas\AppData\Local\{0E1B3~1\UNINST~1.EXE <==== ATTENTION
    FirewallRules: [{F81B1AFC-E1A0-44E9-B199-E10A06A2BF86}] => (Allow) C:\Users\Thomas\AppData\Local\Temp\nsz5967.tmp\CnetInstaller-10648593.exe
    FirewallRules: [{8BA5D0AD-4E8C-49B4-AFE9-B0D92C4DC131}] => (Allow) C:\Users\Thomas\AppData\Local\Temp\nsz5967.tmp\CnetInstaller-10648593.exe
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
    SearchScopes: HKU\S-1-5-21-2475564236-1283100031-3943380601-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    FF Plugin-x32: [email protected]/YahooActiveXPluginBridge;version=1.0.0.1 -> C:\Program Files (x86)\Yahoo!\Common\npyaxmpb.dll [2007-03-09] (Yahoo! Inc.)
    R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.227\WsAppService.exe [492768 2017-06-21] (Wondershare)
    S3 WsDrvInst; C:\Program Files (x86)\Wondershare\Dr.Fone for Android\DriverInstall.exe [X]
    C:\Program Files (x86)\Wondershare
    EmptyTemp:
    Cmd: ipconfig /flushdns


    *****************

    Restore point was successfully created.
    Processes closed successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{76C2D497-5AC4-41F4-893A-C9D7C0B3B163}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{76C2D497-5AC4-41F4-893A-C9D7C0B3B163}" => removed successfully
    C:\Windows\System32\Tasks\{0CFA3DD2-96AE-3053-FFC5-25ECA3383F18} => moved successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{0CFA3DD2-96AE-3053-FFC5-25ECA3383F18}" => removed successfully
    C:\Windows\Tasks\{0CFA3DD2-96AE-3053-FFC5-25ECA3383F18}.job => moved successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{F81B1AFC-E1A0-44E9-B199-E10A06A2BF86}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{8BA5D0AD-4E8C-49B4-AFE9-B0D92C4DC131}" => removed successfully
    HKLM\SOFTWARE\Policies\Google => removed successfully
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => removed successfully
    HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => removed successfully
    HKLM\Software\Wow6432Node\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => removed successfully
    HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
    HKLM\Software\Wow6432Node\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1 => removed successfully
    C:\Program Files (x86)\Yahoo!\Common\npyaxmpb.dll => moved successfully
    HKLM\System\CurrentControlSet\Services\WsAppService => removed successfully
    WsAppService => service removed successfully
    HKLM\System\CurrentControlSet\Services\WsDrvInst => removed successfully
    WsDrvInst => service removed successfully
    C:\Program Files (x86)\Wondershare => moved successfully

    ========= ipconfig /flushdns =========


    Windows IP Configuration

    Successfully flushed the DNS Resolver Cache.

    ========= End of CMD: =========


    =========== EmptyTemp: ==========

    BITS transfer queue => 8388608 B
    DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 42637216 B
    Java, Flash, Steam htmlcache => 310213778 B
    Windows/system/drivers => 35886 B
    Edge => 0 B
    Chrome => 85882112 B
    Firefox => 0 B
    Opera => 0 B

    Temp, IE cache, history, cookies, recent:
    Users => 0 B
    Default => 33058 B
    Public => 0 B
    ProgramData => 0 B
    systemprofile => 33186 B
    systemprofile32 => 33058 B
    LocalService => 66228 B
    NetworkService => 150960245 B
    Thomas => 211245137 B

    RecycleBin => 0 B
    EmptyTemp: => 772 MB temporary data Removed.

    ================================


    The system needed a reboot.

    ==== End of Fixlog 17:04:11 ====
     
  9. askey127

    askey127 Malware Specialist

    Joined:
    Dec 22, 2006
    Messages:
    3,721
    HaroRider,
    Looks Ok.
    If you're satisfied with the machine's behavior, you can click the button at the top to mark this thread Complete.
    If there is anything else we need to take care of, please let me know.
    Good Luck,

    askey127
     
  10. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Thank you, I marked it as solved. My last question is there anything I can upgrade on this rig? Or would I just be throwing good money at bad?
     
  11. askey127

    askey127 Malware Specialist

    Joined:
    Dec 22, 2006
    Messages:
    3,721
    My personal opinion advice:
    From Control panel, you can get rid of the installed GWX control panel, which was formerly used to coerce conversion to Win10.
    Otherwise, I would advise using mostly Firefox instead of Chrome.
    Firefox does not have any vested interested in tracking, and is easier to fix.
    If you install HTTPS Everywhere and uBlock Origin add-ons, it's pretty solid.
    Stay away from Yahoo (way too many data breaches) in any form, and I would not recommend Bing for anything.
    If you ever want a solid paid antivirus, I would suggest ESET NOD32.
    Your machine looks pretty good.
    Good luck going forward.
     
  12. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Will do, one last thing. My computer doesn't always want to shut down. I click start and shutdown and the screen just goes black and I am forced to hard shut down (with the button) I know this is eventually going to screw something up, any ideas on this?
     
  13. askey127

    askey127 Malware Specialist

    Joined:
    Dec 22, 2006
    Messages:
    3,721
  14. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1218702

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice