Many games and apps broken

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • system
    PCHF Owner
    • Jan 2015
    • 7634

    #31
    We shall be starting again if you agree to the following.
    Originally posted by gus
    If we start again will you agree to not change any computer users, or settings unless asked by us. Will you also agree to not remove, install, or update any software, and not to change any logs produced by any tools, until we give you the all clear?

    Please respond to the above before we proceed.
    We are all volunteers here who are happy to help but we will have to insist users not to change the pc configuration and requested logs.

    Comment

    • 10months
      PCHF Member
      • Aug 2017
      • 23

      #32
      Software will keep automatically updating, other than that I can agree - so far it has been over a month since I started the thread, I can’t prevent updating anything for so long.

      Comment

      • system
        PCHF Owner
        • Jan 2015
        • 7634

        #33
        OK, it must be said you have an extraordinary amount of games installed on your machine and removing some of them would help the PC to cope. In your original post you mentioned difficulty installing Nvidia driver, and its evident in your logs that you have an Intel video driver installed. If you no longer intend to use the intel driver I would suggest you remove it. If you agree then I would suggest you use the following app to remove the Intel graphics driver and superfluous games.

        Please go HERE and download Geek Uninstaller portable and save it to somewhere you can find later. Now use you favorite Unzip application to extract the zipped file from the download. This should create a new folder that contains a Geek.exe file which you can now double left click to open the program.

        Optionally you can create a desktop shortcut by right clicking the Geek.exe file and choose “Send to” from the drop down menu. This will give you a shortcut icon on the desktop for future use of this handy application.

        You can safely ignore any security pop ups that may appear before the program opens.

        Either way you open it once Geek Uninstaller is running select the program you wish to uninstall by right clicking it and then choose “Uninstall” from the drop down menu.

        [MEDIA=imgur]dvNuQMe[/MEDIA]

        Follow and accept all uninstall options once the uninstaller begins.

        It is recommended when removing any Antivirus/Security program, or if you have errors or difficulty removing any program to use “Force removal” to uninstall the program.

        [MEDIA=imgur]m089MyG[/MEDIA]

        Should you have any further difficulty removing any items please ask us for help

        Once you have uninstalled your choice, can you then follow this guide to remove and reinstall your Nvidia drivers?

        Comment

        • 10months
          PCHF Member
          • Aug 2017
          • 23

          #34
          Okay, the intel driver is gone, alongside around 700GB+ of games. The reinstall worked this time and now nvidia seems to be working fine (the 6 different parts are all there, up to date, control panel and geforce work without any issue). But this has had no discernible effect on games. Those I have tested still crash the same way as before, even after a reinstall.

          Comment

          • system
            PCHF Owner
            • Jan 2015
            • 7634

            #35
            Glad to hear your video driver issue is fixed, one maybe two more scans to go, and we will clean up our tools. Can you please get fresh FRST logs.

            Please download the FRST 32 bit or FRST 64bit version to suit your operating system. It is important FRST is downloaded to your desktop.

            If you are unsure if your operating system is 32 or 64 Bit please go HERE.

            Once downloaded right click the FRST desktop icon and select “Run as administrator” from the menu"



            If you receive any security warnings, or the User Account Control warning opens at any time whilst using FRST you can safely allow FRST to proceed.
            Frst will open with two dialogue boxes, accept the disclaimer.


            [ol]
            [li]Accept the default whitelist options,[/li][li]If the additions.txt options box is not checked please select it. [/li]
            [li]Then select “Scan”[/li][/ol]



            Frst will take a few minutes to scan your computer, and when finished will produce two log files on your desktop, FRST.txt, and Addition.txt. They will display immediately on the desktop, but can be reopened later as a notepad file.



            Please COPY and PASTE the contents of these two files in your next post.

            Comment

            • 10months
              PCHF Member
              • Aug 2017
              • 23

              #36
              FRST.txt
              Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-09-2017 01
              Ran by Alex (administrator) on SEXY_BEAST (18-09-2017 00:44:28)
              Running from C:\Users\Alex\Downloads
              Loaded Profiles: Alex (Available Profiles: Alex)
              Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
              Internet Explorer Version 8 (Default browser: Chrome)
              Boot Mode: Normal
              Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

              ==================== Processes (Whitelisted) =================

              (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

              (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Containe r.exe
              (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Containe r.exe
              (Intel Corporation) C:\Windows\System32\igfxCUIService.exe
              (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
              (Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
              (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
              (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
              (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
              (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
              (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.ex e
              (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64. exe
              () C:\Windows\runSW.exe
              (Realtek) C:\Windows\SwUSB.exe
              () C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe
              (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
              (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
              (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\Pres entationFontCache.exe
              (Intel Corporation) C:\Windows\System32\igfxEM.exe
              (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
              (Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
              (Discord Inc.) C:\Users\Alex\AppData\Local\Discord\app-0.0.298\Discord.exe
              (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
              (Valve Corporation) E:\Steam\Steam.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Microsoft Corporation) C:\Windows\System32\StikyNot.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
              () E:\1A\TWCU.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Discord Inc.) C:\Users\Alex\AppData\Local\Discord\app-0.0.298\Discord.exe
              (Discord Inc.) C:\Users\Alex\AppData\Local\Discord\app-0.0.298\Discord.exe
              (Valve Corporation) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
              (Valve Corporation) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
              (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
              (Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Microsoft Corporation) C:\Windows\System32\taskmgr.exe
              (Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
              (Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              (Valve Corporation) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe

              ==================== Registry (Whitelisted) ====================

              (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

              HKLM...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7611608 2014-05-27] (Realtek Semiconductor)
              HKLM...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)
              HKLM...\Run: [ShadowPlay] => “C:\Windows\system32\rundll32.exe” C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSyst emStart
              HKLM-x32...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2383040 2016-08-24] (Adobe Systems Incorporated)
              HKLM-x32...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-21] (Oracle Corporation)
              HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Run: [Discord] => C:\Users\Alex\AppData\Local\Discord\app-0.0.298\Discord.exe [57477112 2017-08-08] (Discord Inc.)
              HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27716568 2017-05-04] (Skype Technologies S.A.)
              HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Run: [Steam] => E:\Steam\steam.exe [3071776 2017-09-07] (Valve Corporation)
              HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Run: [GoogleChromeAutoLaunch_AD2529C7DB5B63D28C233623852 76129] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1301848 2017-08-23] (Google Inc.)
              HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
              Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Configuration Utility.lnk [2015-09-23]
              ShortcutTarget: TP-LINK Wireless Configuration Utility.lnk → E:\TWCU.exe (No File)

              ==================== Internet (Whitelisted) ====================

              (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

              Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
              Tcpip..\Interfaces{D6FE7615-E3F4-4DBD-B664-C7231B00AA05}: [DhcpNameServer] 192.168.0.5
              Tcpip..\Interfaces{DE19D148-F66E-4E70-9848-0E911A76D5E4}: [DhcpNameServer] 192.168.1.254
              [HEADING=1]Internet Explorer:[/HEADING]
              HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
              HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
              SearchScopes: HKLM → DefaultScope {E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQxcUwFIFAEUbQsNVFxcFQATIRRZA FtDDAxFcg4PWV1HEAIVdB9aFQQTSEcFME0FCFwEURNNfWtdEkw dVUZrNVs=&q={searchTerms}
              SearchScopes: HKLM → OldSearch URL = hxxp://uk.yhs4.search.yahoo.com/yhs/search?hspart=appattach&hsimp=yhs-appattach&type=493&p={searchTerms}
              SearchScopes: HKLM → {E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQxcUwFIFAEUbQsNVFxcFQATIRRZA FtDDAxFcg4PWV1HEAIVdB9aFQQTSEcFME0FCFwEURNNfWtdEkw dVUZrNVs=&q={searchTerms}
              SearchScopes: HKLM-x32 → DefaultScope {E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} URL =
              SearchScopes: HKU\S-1-5-21-630333582-4039751370-1614634531-1000 → OldSearch URL =
              SearchScopes: HKU\S-1-5-21-630333582-4039751370-1614634531-1000 → {A6A1D0B1-E2C0-425C-9FA5-600268E3E449} URL = hxxp://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=bl-bir-dd__alt__ddc_dss_bd_com&p={searchTerms}
              BHO: Lync Browser Helper → {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} → C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-09-16] (Microsoft Corporation)
              BHO: Norton Identity Safety → {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} → C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\coIEPlg.dll [2017-08-24] (Symantec Corporation)
              BHO: Java™ Plug-In SSV Helper → {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} → C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll [2017-08-14] (Oracle Corporation)
              BHO: Windows Live ID Sign-in Helper → {9030D464-4C02-4ABF-8ECC-5164760863C6} → C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
              BHO: Office Document Cache Handler → {B4F3A835-0E21-4959-BA22-42B3008E02FF} → C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2017-09-16] (Microsoft Corporation)
              BHO: Microsoft OneDrive for Business Browser Helper → {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} → C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-09-16] (Microsoft Corporation)
              BHO: Java™ Plug-In 2 SSV Helper → {DBC80044-A445-435b-BC74-9C25C1C588A9} → C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-08-14] (Oracle Corporation)
              BHO-x32: Lync Browser Helper → {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} → C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-09-16] (Microsoft Corporation)
              BHO-x32: Norton Identity Safety → {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} → C:\Program Files (x86)\Norton Security\Engine32\22.10.1.10\coIEPlg.dll [2017-08-24] (Symantec Corporation)
              BHO-x32: Windows Live ID Sign-in Helper → {9030D464-4C02-4ABF-8ECC-5164760863C6} → C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
              BHO-x32: Office Document Cache Handler → {B4F3A835-0E21-4959-BA22-42B3008E02FF} → C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2017-09-16] (Microsoft Corporation)
              BHO-x32: Microsoft OneDrive for Business Browser Helper → {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} → C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-09-16] (Microsoft Corporation)
              Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\coIEPlg.dll [2017-08-24] (Symantec Corporation)
              Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine32\22.10.1.10\coIEPlg.dll [2017-08-24] (Symantec Corporation)
              Toolbar: HKU\S-1-5-21-630333582-4039751370-1614634531-1000 → Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\coIEPlg.dll [2017-08-24] (Symantec Corporation)
              Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-16] (Microsoft Corporation)
              Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-16] (Microsoft Corporation)
              Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-16] (Microsoft Corporation)
              Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-16] (Microsoft Corporation)
              Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-12-10] (Microsoft Corporation)
              Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-12-10] (Microsoft Corporation)
              Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-12-10] (Microsoft Corporation)
              Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-12-10] (Microsoft Corporation)
              [HEADING=1]FireFox:[/HEADING]
              FF DefaultProfile: h90wxnqo.default
              FF ProfilePath: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Prof iles\h90wxnqo.default [2017-09-07]
              FF DefaultSearchEngine: Mozilla\Firefox\Profiles\h90wxnqo.default → Bing
              FF SelectedSearchEngine: Mozilla\Firefox\Profiles\h90wxnqo.default → Bing
              FF SearchEngineOrder.3: Mozilla\Firefox\Profiles\h90wxnqo.default → Bing
              FF Keyword.URL: Mozilla\Firefox\Profiles\h90wxnqo.default → hxxp://www.bing.com/search?FORM=SK216DF&PC=SK216&q=
              FF Homepage: Mozilla\Firefox\Profiles\h90wxnqo.default → hxxp://www.msn.com/?pc=SK216&ocid=SK216DHP&osmkt=en-gb
              FF Extension: (Bing Search) - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Prof iles\h90wxnqo.default\Extensions\bingsearch.full@microsoft.com.xpi [2016-11-23]
              FF SearchPlugin: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Prof iles\h90wxnqo.default\searchplugins\bing-.xml [2016-11-23]
              FF HKLM...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.6.0.142\coFFAddon
              FF Extension: (Norton Security Toolbar) - C:\ProgramData\Norton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.6.0.142\coFFAddon [2017-09-05]
              FF HKLM-x32...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.6.0.142\coFFAddon
              FF Plugin: @java.com/DTPlugin,version=11.144.2 → C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1 .dll [2017-08-14] (Oracle Corporation)
              FF Plugin: @java.com/JavaPlugin,version=11.144.2 → C:\Program Files\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-08-14] (Oracle Corporation)
              FF Plugin: @microsoft.com/GENUINE → disabled [No File]
              FF Plugin: adobe.com/AdobeAAMDetect → C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-08-24] (Adobe Systems)
              FF Plugin-x32: @adobe.com/FlashPlayer → C:\Windows\system32\Macromed\Flash\NPSWF32.dll [No File]
              FF Plugin-x32: @microsoft.com/GENUINE → disabled [No File]
              FF Plugin-x32: @microsoft.com/Lync,version=15.0 → C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-09-16] (Microsoft Corporation)
              FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 → C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-09-16] (Microsoft Corporation)
              FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 → C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
              FF Plugin-x32: @nvidia.com/3DVision → C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-08-21] (NVIDIA Corporation)
              FF Plugin-x32: @nvidia.com/3DVisionStreaming → C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-08-21] (NVIDIA Corporation)
              FF Plugin-x32: @tools.google.com/Google Update;version=3 → C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-08-11] (Google Inc.)
              FF Plugin-x32: @tools.google.com/Google Update;version=9 → C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-08-11] (Google Inc.)
              FF Plugin-x32: adobe.com/AdobeAAMDetect → C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-08-24] (Adobe Systems)
              FF Plugin HKU\S-1-5-21-630333582-4039751370-1614634531-1000: SkypePlugin → C:\Users\Alex\AppData\Local\SkypePlugin\7.27.0.105 \npGatewayNpapi.dll [2016-10-20] (Skype Technologies S.A.)
              FF Plugin HKU\S-1-5-21-630333582-4039751370-1614634531-1000: SkypePlugin64 → C:\Users\Alex\AppData\Local\SkypePlugin\7.27.0.105 \npGatewayNpapi-x64.dll [2016-10-20] (Skype Technologies S.A.)
              [HEADING=1]Chrome:[/HEADING]
              CHR DefaultProfile: Default
              CHR RestoreOnStartup: Default → “hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRggWJAsAWAxFFhgRdQxdTA1EEVQOIVhaU xRIRwcUdwFcVwhGFwEFIk0FA1oDB0VXfV5bFElXTwhxJUpNDU0 CaUBB”
              CHR StartupUrls: Default → “chrome://history/”,“hxxps://www.youtube.com/feed/subscriptions”,“hxxp://www.netflix.com/browse/”,“hxxps://twitter.com/”,“hxxp://www.schoolplannerbook.com/tanbridge/homework/?email=12afarr%40ths.uk.net&action=homeworkfromema il&view=due&as=list”,“hxxp://vle.ths.uk.net/”
              CHR Profile: C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default [2017-09-18]
              CHR Extension: (Google Docs) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfi lokake [2017-08-13]
              CHR Extension: (Google Drive) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigk jlhalf [2017-08-13]
              CHR Extension: (Skype Calling) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blakpkgjpemejpbmfiglncklih nhjkij [2017-08-13]
              CHR Extension: (YouTube) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldk acnbeo [2017-08-13]
              CHR Extension: (Norton Security Toolbar) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjabmdjcfcfdmffimndhafhblf mpjdpe [2017-09-05]
              CHR Extension: (Google Search) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljnie djpjpf [2017-08-13]
              CHR Extension: (ZenMate VPN - Best Cyber Security & Unblock) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfo mcebme [2017-08-13]
              CHR Extension: (Google Docs Offline) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdl olhkhi [2017-08-13]
              CHR Extension: (AdBlock) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbi glidom [2017-08-13]
              CHR Extension: (Norton Identity Safe) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdal ibjnif [2017-08-13]
              CHR Extension: (Skype) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfg npldfl [2017-08-13]
              CHR Extension: (Take Webpage Screenshots Entirely - FireShot) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbpblocgmgfnpjjppndjkmgja ogfceg [2017-08-29]
              CHR Extension: (Chrome Web Store Payments) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccm gmieda [2017-08-25]
              CHR Extension: (Gmail) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoe jaedia [2017-08-13]
              CHR Extension: (Chrome Media Router) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcj beemfm [2017-08-13]
              CHR HKLM...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\Exts\Chrome.crx
              CHR HKLM...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
              CHR HKLM-x32...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\Exts\Chrome.crx
              CHR HKLM-x32...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
              CHR HKLM-x32...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

              ==================== Services (Whitelisted) ====================

              (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

              R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [744640 2016-08-24] (Adobe Systems Incorporated)
              R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2246256 2017-05-18] (Adobe Systems, Incorporated)
              S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1517576 2017-04-18] ()
              R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [4424392 2017-09-08] (Microsoft Corporation)
              S3 IEEtwCollectorService; C:\Windows\system32\IEEtwCollector.exe [116224 2017-07-14] (Microsoft Corporation) [File not signed]
              R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation)
              S2 NS; C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\NS.exe [326144 2017-08-24] (Symantec Corporation)
              R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [513144 2017-08-22] (NVIDIA Corporation)
              S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [513144 2017-08-22] (NVIDIA Corporation)
              R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Containe r.exe [462784 2017-08-21] (NVIDIA Corporation)
              R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [450168 2017-08-22] (NVIDIA Corporation)
              S3 Origin Client Service; E:\Origin\OriginClientService.exe [2142728 2016-10-26] (Electronic Arts)
              S2 Origin Web Helper Service; E:\Origin\OriginWebHelperService.exe [2209296 2016-10-26] (Electronic Arts)
              S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1450824 2017-09-10] (Overwolf LTD)
              S3 PAExec; C:\Windows\PAExec.exe [189112 2017-09-17] (Power Admin LLC)
              R2 RunSwUSB; C:\Windows\runSW.exe [48856 2013-10-18] ()
              R2 TunnelBearMaintenance; C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe [39424 2016-02-10] ()
              S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

              ===================== Drivers (Whitelisted) ======================

              (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

              R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [36608 2013-12-13] (Advanced Micro Devices, Inc.)
              R1 BHDrvx64; C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\BASHDef s\20170908.001\BHDrvx64.sys [1872032 2017-09-07] (Symantec Corporation)
              R1 ccSet_NS; C:\Windows\system32\drivers\NSx64\160A010.00A\ccSe tx64.sys [187520 2017-07-14] (Symantec Corporation)
              R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [508032 2017-08-12] (Symantec Corporation)
              R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [158336 2017-08-12] (Symantec Corporation)
              R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2014-04-11] (Intel Corporation)
              R1 IDSVia64; C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\IPSDefs \20170915.001\IDSvia64.sys [1056920 2017-09-01] (Symantec Corporation)
              R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation)
              S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30328 2017-08-22] (NVIDIA Corporation)
              R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [48248 2017-08-22] (NVIDIA Corporation)
              R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [57976 2017-08-22] (NVIDIA Corporation)
              S3 RdpVideoMiniport; C:\Windows\System32\drivers\rdpvideominiport.sys [19456 2013-08-30] (Microsoft Corporation) [File not signed]
              R3 RtlWlanu; C:\Windows\System32\DRIVERS\rtwlanu.sys [2978520 2013-11-14] (Realtek Semiconductor Corporation )
              S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [12464 2015-10-31] (Macrovision Europe Ltd) [File not signed]
              S3 SRTSP; C:\Windows\System32\Drivers\NSx64\160A010.00A\SRTS P64.SYS [810136 2017-07-14] (Symantec Corporation)
              R1 SRTSPX; C:\Windows\system32\drivers\NSx64\160A010.00A\SRTS PX64.SYS [49304 2017-07-14] (Symantec Corporation)
              R0 SymEFASI; C:\Windows\System32\drivers\NSx64\160A010.00A\SYME FASI64.SYS [1868416 2017-07-14] (Symantec Corporation)
              R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [102568 2017-09-04] (Symantec Corporation)
              R1 SymIRON; C:\Windows\system32\drivers\NSx64\160A010.00A\Iron x64.SYS [301288 2017-07-14] (Symantec Corporation)
              R1 SymNetS; C:\Windows\System32\Drivers\NSx64\160A010.00A\SYMN ETS.SYS [566912 2017-07-14] (Symantec Corporation)
              S3 terminpt; C:\Windows\system32\drivers\terminpt.sys [29696 2013-08-30] (Microsoft Corporation) [File not signed]
              S3 NAVENG; ??\C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\SDSDefs \20170903.001\NAVENG.SYS
              S3 NAVEX15; ??\C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\SDSDefs \20170903.001\NAVEX15.SYS

              ==================== NetSvcs (Whitelisted) ===================

              (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

              ==================== One Month Created files and folders ========

              (If an entry is included in the fixlist, the file/folder will be moved.)

              2017-09-18 00:44 - 2017-09-18 00:44 - 000000000 ____D C:\Users\Alex\Downloads\FRST-OlderVersion
              2017-09-17 21:39 - 2017-09-17 21:39 - 000880278 _____ C:\Users\Alex\Downloads\Studying Economics at University.pdf
              2017-09-17 21:39 - 2017-09-17 21:39 - 000037715 _____ C:\Users\Alex\Downloads\Student Timetable SY170200 (1).pdf
              2017-09-17 17:09 - 2017-09-17 17:09 - 000000000 ____D C:\Users\Alex\AppData\Local\NVIDIA
              2017-09-17 17:00 - 2017-09-17 17:21 - 000000000 D C:\ProgramData\NVIDIA
              2017-09-17 17:00 - 2017-09-17 17:02 - 000000000 D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
              2017-09-17 17:00 - 2017-09-17 17:00 - 000004146 _____ C:\Windows\System32\Tasks\NvDriverUpdateCheckDaily
              {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
              2017-09-17 17:00 - 2017-09-17 17:00 - 000003852 _____ C:\Windows\System32\Tasks\NvNodeLauncher
              {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
              2017-09-17 17:00 - 2017-09-17 17:00 - 000003814 _____ C:\Windows\System32\Tasks\NVIDIA GeForce Experience SelfUpdate
              {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
              2017-09-17 17:00 - 2017-09-17 17:00 - 000003738 _____ C:\Windows\System32\Tasks\NvTmRep
              {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
              2017-09-17 17:00 - 2017-09-17 17:00 - 000003738 _____ C:\Windows\System32\Tasks\NvProfileUpdaterDaily
              {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
              2017-09-17 17:00 - 2017-09-17 17:00 - 000003730 _____ C:\Windows\System32\Tasks\NvTmMon
              {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
              2017-09-17 17:00 - 2017-09-17 17:00 - 000003554 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon
              {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
              2017-09-17 17:00 - 2017-09-17 17:00 - 000003494 _____ C:\Windows\System32\Tasks\NvProfileUpdaterOnLogon
              {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
              2017-09-17 17:00 - 2017-09-17 17:00 - 000001429 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
              2017-09-17 17:00 - 2017-09-17 17:00 - 000000000 ____D C:\Program Files (x86)\VulkanRT
              2017-09-17 17:00 - 2017-09-17 17:00 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
              2017-09-17 17:00 - 2017-08-22 01:40 - 001923192 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
              2017-09-17 17:00 - 2017-08-22 01:40 - 001755256 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
              2017-09-17 17:00 - 2017-08-22 01:40 - 001505912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
              2017-09-17 17:00 - 2017-08-22 01:40 - 001317496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
              2017-09-17 17:00 - 2017-08-22 01:40 - 000512960 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
              2017-09-17 17:00 - 2017-08-22 01:40 - 000418936 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
              2017-09-17 17:00 - 2017-08-22 01:40 - 000179320 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
              2017-09-17 17:00 - 2017-08-22 01:40 - 000146552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
              2017-09-17 17:00 - 2017-08-22 01:40 - 000121464 _____ C:\Windows\system32\NvRtmpStreamer64.dll
              2017-09-17 17:00 - 2017-08-22 01:40 - 000001951 _____ C:\Windows\NvTelemetryContainerRecovery.bat
              2017-09-17 17:00 - 2017-08-22 00:10 - 006463424 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
              2017-09-17 17:00 - 2017-08-22 00:10 - 002479224 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
              2017-09-17 17:00 - 2017-08-22 00:10 - 001762752 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
              2017-09-17 17:00 - 2017-08-22 00:10 - 000549312 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
              2017-09-17 17:00 - 2017-08-22 00:10 - 000392312 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
              2017-09-17 17:00 - 2017-08-22 00:10 - 000082040 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll
              2017-09-17 17:00 - 2017-08-22 00:10 - 000069752 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
              2017-09-17 17:00 - 2017-08-21 23:33 - 000135800 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
              2017-09-17 17:00 - 2017-08-19 08:10 - 008142301 _____ C:\Windows\system32\nvcoproc.bin
              2017-09-17 17:00 - 2017-06-15 20:32 - 000541984 _____ C:\Windows\system32\vulkan-1.dll
              2017-09-17 17:00 - 2017-06-15 20:32 - 000525088 _____ C:\Windows\SysWOW64\vulkan-1.dll
              2017-09-17 17:00 - 2017-06-15 20:32 - 000254240 _____ C:\Windows\system32\vulkaninfo.exe
              2017-09-17 17:00 - 2017-06-15 20:32 - 000233760 _____ C:\Windows\SysWOW64\vulkaninfo.exe
              2017-09-17 16:59 - 2017-09-17 17:09 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
              2017-09-17 16:59 - 2017-08-22 01:40 - 040240248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 035881592 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 035314112 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 028985976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 023132184 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 021405440 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 018849272 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 018704744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 017807096 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 015409088 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
              2017-09-17 16:59 - 2017-08-22 01:40 - 014687256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 013782904 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 012225984 _____ (NVIDIA Corporation) C:\Windows\system32\nvptxJitCompiler.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 011692528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 010072768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvptxJitCompiler.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 004188872 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 003802048 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 003692216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 003354560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 001988216 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6438541.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 001615448 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 001597888 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6438541.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 001067456 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 001005176 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000972920 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000924280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000690320 _____ (NVIDIA Corporation) C:\Windows\system32\nvfatbinaryLoader.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000609728 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000578056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvfatbinaryLoader.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000512672 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000499136 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000491720 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000429920 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000407064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000218712 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
              2017-09-17 16:59 - 2017-08-22 01:40 - 000171384 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000154208 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000149040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000132072 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000057976 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvhci.sys
              2017-09-17 16:59 - 2017-08-22 01:40 - 000048248 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
              2017-09-17 16:59 - 2017-08-22 01:40 - 000045976 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
              2017-09-17 16:59 - 2017-08-22 01:40 - 000044190 _____ C:\Windows\system32\nvinfo.pb
              2017-09-17 16:59 - 2017-08-22 01:40 - 000000669 _____ C:\Windows\SysWOW64\nv-vk32.json
              2017-09-17 16:59 - 2017-08-22 01:40 - 000000669 _____ C:\Windows\system32\nv-vk64.json
              2017-09-17 15:45 - 2017-09-17 16:58 - 414447096 _____ (NVIDIA Corporation) C:\Users\Alex\Downloads\385.41-desktop-win8-win7-64bit-international-whql.exe
              2017-09-17 15:34 - 2017-09-17 15:34 - 000189112 _____ (Power Admin LLC) C:\Windows\PAExec.exe
              2017-09-17 15:32 - 2017-09-17 15:34 - 000000000 ____D C:\Users\Alex\Downloads\ddu
              2017-09-17 15:27 - 2017-09-17 15:27 - 000664256 _____ C:\Windows\Minidump\091717-203784-01.dmp
              2017-09-17 15:08 - 2017-09-17 15:29 - 000000000 ____D C:\Users\Alex\AppData\Roaming\Geek Uninstaller
              2017-09-17 15:08 - 2017-07-04 13:07 - 007137216 _____ (Geek Unіnstaller) C:\Users\Alex\Downloads\geek.exe
              2017-09-17 15:07 - 2017-09-17 15:08 - 003000643 _____ C:\Users\Alex\Downloads\geek.zip
              2017-09-16 20:33 - 2017-09-16 20:33 - 000000000 ____D C:\Windows\System32\Tasks\Remediation
              2017-09-14 22:23 - 2017-09-18 00:44 - 000025779 _____ C:\Users\Alex\Downloads\FRST.txt
              2017-09-14 22:23 - 2017-09-14 22:23 - 000099197 _____ C:\Users\Alex\Downloads\Addition.txt
              2017-09-14 22:22 - 2017-09-18 00:44 - 000000000 ____D C:\FRST
              2017-09-14 22:21 - 2017-09-18 00:44 - 002399744 _____ (Farbar) C:\Users\Alex\Downloads\FRST64.exe
              2017-09-13 23:55 - 2017-09-13 23:55 - 000004652 _____ C:\Users\Alex\Desktop\ZHPFixReport.txt
              2017-09-13 23:50 - 2017-09-13 23:50 - 000417344 _____ C:\Windows\Minidump\091317-6692-01.dmp
              2017-09-13 23:43 - 2017-09-13 23:43 - 000000000 ____D C:\Users\Alex\Downloads\Quarantine
              2017-09-13 23:42 - 2017-09-13 23:42 - 003061760 _____ (Nicolas Coolman) C:\Users\Alex\Downloads\ZHPFix.exe
              2017-09-13 03:05 - 2017-08-19 16:28 - 000197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
              2017-09-13 03:05 - 2017-08-19 16:10 - 000180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
              2017-09-13 03:05 - 2017-08-16 16:29 - 000806912 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
              2017-09-13 03:05 - 2017-08-16 16:10 - 000629760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
              2017-09-13 03:05 - 2017-08-16 15:57 - 003224576 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
              2017-09-13 03:05 - 2017-08-15 16:29 - 014182400 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
              2017-09-13 03:05 - 2017-08-15 16:29 - 001867264 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
              2017-09-13 03:05 - 2017-08-15 16:10 - 012880896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
              2017-09-13 03:05 - 2017-08-15 16:10 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
              2017-09-13 03:05 - 2017-08-14 18:35 - 003203584 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
              2017-09-13 03:05 - 2017-08-14 18:35 - 002150912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcndmgr.dll
              2017-09-13 03:05 - 2017-08-14 18:35 - 000355328 _____ (Microsoft Corporation) C:\Windows\system32\mmcbase.dll
              2017-09-13 03:05 - 2017-08-14 18:35 - 000303104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcbase.dll
              2017-09-13 03:05 - 2017-08-14 18:35 - 000172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cic.dll
              2017-09-13 03:05 - 2017-08-14 18:35 - 000131072 _____ (Microsoft Corporation) C:\Windows\system32\mmcshext.dll
              2017-09-13 03:05 - 2017-08-14 18:35 - 000128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcshext.dll
              2017-09-13 03:05 - 2017-08-14 18:34 - 000211968 _____ (Microsoft Corporation) C:\Windows\system32\cic.dll
              2017-09-13 03:05 - 2017-08-13 22:37 - 002144256 _____ (Microsoft Corporation) C:\Windows\system32\mmc.exe
              2017-09-13 03:05 - 2017-08-13 22:30 - 001401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmc.exe
              2017-09-13 03:05 - 2017-08-11 07:42 - 000631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
              2017-09-13 03:05 - 2017-08-11 07:38 - 005547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
              2017-09-13 03:05 - 2017-08-11 07:38 - 000706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
              2017-09-13 03:05 - 2017-08-11 07:38 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
              2017-09-13 03:05 - 2017-08-11 07:38 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
              2017-09-13 03:05 - 2017-08-11 07:36 - 001732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 002065408 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000757248 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000346112 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000313856 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\nsisvc.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\winnsi.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
              2017-09-13 03:05 - 2017-08-11 07:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\nsi.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000971776 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000166400 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:24 - 004001000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
              2017-09-13 03:05 - 2017-08-11 07:24 - 003945704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
              2017-09-13 03:05 - 2017-08-11 07:21 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
              2017-09-13 03:05 - 2017-08-11 07:20 - 000071680 _____ C:\Windows\system32\PrintBrmUi.exe
              2017-09-13 03:05 - 2017-08-11 07:20 - 000061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
              2017-09-13 03:05 - 2017-08-11 07:20 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe
              2017-09-13 03:05 - 2017-08-11 07:19 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000299008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winnsi.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nsi.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 07:12 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
              2017-09-13 03:05 - 2017-08-11 07:09 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe
              2017-09-13 03:05 - 2017-08-11 07:07 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
              2017-09-13 03:05 - 2017-08-11 07:07 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
              2017-09-13 03:05 - 2017-08-11 07:07 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
              2017-09-13 03:05 - 2017-08-11 07:06 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
              2017-09-13 03:05 - 2017-08-11 07:03 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
              2017-09-13 03:05 - 2017-08-11 07:03 - 000026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
              2017-09-13 03:05 - 2017-08-11 07:02 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
              2017-09-13 03:05 - 2017-08-11 07:01 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
              2017-09-13 03:05 - 2017-08-11 07:00 - 000262656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
              2017-09-13 03:05 - 2017-08-11 07:00 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
              2017-09-13 03:05 - 2017-08-11 07:00 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
              2017-09-13 03:05 - 2017-08-11 06:59 - 000460800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
              2017-09-13 03:05 - 2017-08-11 06:59 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
              2017-09-13 03:05 - 2017-08-11 06:59 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
              2017-09-13 03:05 - 2017-08-11 06:59 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
              2017-09-13 03:05 - 2017-08-11 06:59 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
              2017-09-13 03:05 - 2017-08-11 06:58 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
              2017-09-13 03:05 - 2017-08-11 06:58 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
              2017-09-13 03:05 - 2017-08-11 06:58 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nsiproxy.sys
              2017-09-13 03:05 - 2017-08-11 06:56 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
              2017-09-13 03:05 - 2017-08-11 06:56 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
              2017-09-13 03:05 - 2017-08-11 06:56 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
              2017-09-13 03:05 - 2017-08-11 06:56 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
              2017-09-13 03:05 - 2017-08-11 06:55 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
              2017-09-13 03:05 - 2017-08-11 06:55 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 06:55 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 06:55 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
              2017-09-13 03:05 - 2017-08-11 06:55 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
              2017-09-13 03:05 - 2017-07-07 16:29 - 001143296 _____ (Microsoft Corporation) C:\Windows\system32\DXPTaskRingtone.dll
              2017-09-13 03:05 - 2017-07-07 16:10 - 000973312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DXPTaskRingtone.dll
              2017-09-11 07:41 - 2017-09-11 07:41 - 000000000 ____D C:\Windows\System32\Tasks\Norton Security
              2017-09-11 07:35 - 2017-09-11 07:35 - 000417368 _____ C:\Windows\Minidump\091117-6676-01.dmp
              2017-09-11 07:35 - 2017-09-11 07:35 - 000003218 _____ C:\Windows\System32\Tasks\Norton WSC Integration
              2017-09-10 23:40 - 2017-09-10 23:40 - 001422530 _____ C:\Users\Alex\Documents\STARTING WITH CONFIDENCE 2017 final.pdf
              2017-09-10 20:39 - 2017-09-10 20:39 - 000037726 _____ C:\Users\Alex\Documents\Student Timetable SY170200.pdf
              2017-09-09 22:11 - 2017-09-09 22:11 - 000000000 ____D C:\Users\Alex\Documents\Fear Equation
              2017-09-09 22:11 - 2017-09-09 22:11 - 000000000 ____D C:\Users\Alex\AppData\LocalLow\Screwfly Studios
              2017-09-09 20:13 - 2017-09-09 20:13 - 000417384 _____ C:\Windows\Minidump\090917-6723-01.dmp
              2017-09-09 10:52 - 2017-09-09 10:52 - 000037726 _____ C:\Users\Alex\Downloads\Student Timetable SY170200.pdf
              2017-09-08 16:02 - 2017-09-10 11:08 - 000000000 ____D C:\AdwCleaner
              2017-09-08 16:01 - 2017-09-08 16:01 - 008182736 _____ (Malwarebytes) C:\Users\Alex\Downloads\adwcleaner_7.0.2.1.exe
              2017-09-08 15:58 - 2017-09-08 15:58 - 000009674 _____ C:\Users\Alex\Documents\roguekiller.txt
              2017-09-08 15:47 - 2017-09-08 15:47 - 000028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
              2017-09-08 15:45 - 2017-09-08 15:59 - 000000000 ____D C:\ProgramData\RogueKiller
              2017-09-08 15:44 - 2017-09-08 15:44 - 035802208 _____ (Adlice Software ) C:\Users\Alex\Downloads\setup.exe
              2017-09-08 13:04 - 2017-09-08 13:04 - 000000000 ____D C:\Users\Alex\AppData\Roaming\3909
              2017-09-08 12:45 - 2017-09-17 15:27 - 1475874362 _____ C:\Windows\MEMORY.DMP
              2017-09-08 12:39 - 2017-09-08 12:54 - 000002733 _____ C:\Users\Alex\Desktop\JRT.txt
              2017-09-08 12:36 - 2017-09-08 12:36 - 001790024 _____ (Malwarebytes) C:\Users\Alex\Downloads\JRT.exe
              2017-09-05 13:01 - 2017-09-05 13:01 - 000176813 _____ C:\Users\Alex\Documents\ZHPDiag.txt
              2017-09-05 12:51 - 2017-09-05 12:51 - 000177419 _____ C:\Users\Alex\Desktop\ZHPDiag.txt
              2017-09-05 12:48 - 2017-09-13 23:55 - 000000000 ____D C:\Users\Alex\AppData\Roaming\ZHP
              2017-09-05 12:48 - 2017-09-05 12:49 - 000000000 ____D C:\Users\Alex\AppData\Local\ZHP
              2017-09-05 12:48 - 2017-09-05 12:48 - 002831744 _____ C:\Users\Alex\Downloads\zhpdiag3.exe
              2017-09-05 12:48 - 2017-09-05 12:48 - 000000788 _____ C:\Users\Alex\Desktop\ZHPDiag.lnk
              2017-08-31 00:01 - 2017-08-31 00:01 - 005916576 _____ C:\Users\Alex\Downloads\econ around you - intro to econ vle.pptx
              2017-08-30 13:23 - 2017-08-30 13:23 - 000993632 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
              2017-08-30 13:23 - 2017-08-30 13:23 - 000987840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
              2017-08-30 13:23 - 2017-08-30 13:23 - 000690008 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
              2017-08-30 13:23 - 2017-08-30 13:23 - 000485576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
              2017-08-29 18:33 - 2017-08-29 18:33 - 000000000 ____D C:\Users\Alex\Documents\Warm Lamp Games
              2017-08-20 22:13 - 2017-09-17 15:41 - 000280278 _____ C:\Windows\ntbtlog.txt

              ==================== One Month Modified files and folders ========

              (If an entry is included in the fixlist, the file/folder will be moved.)

              2017-09-18 00:43 - 2015-09-23 17:35 - 000000000 ____D C:\Users\Alex\AppData\Roaming\Skype
              2017-09-18 00:27 - 2009-07-14 05:45 - 000035312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
              2017-09-18 00:27 - 2009-07-14 05:45 - 000035312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
              2017-09-17 17:25 - 2009-07-14 06:13 - 000781298 _____ C:\Windows\system32\PerfStringBackup.INI
              2017-09-17 17:25 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
              2017-09-17 17:20 - 2017-08-11 12:36 - 000000000 ____D C:\Users\Alex\AppData\Roaming\discord
              2017-09-17 17:20 - 2015-09-23 02:28 - 000000000 __SHD C:\Users\Alex\IntelGraphicsProfiles
              2017-09-17 17:19 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
              2017-09-17 17:09 - 2016-09-29 23:20 - 000000000 ____D C:\Users\Alex\AppData\Local\NVIDIA Corporation
              2017-09-17 17:01 - 2015-09-23 02:28 - 000000000 ____D C:\Users\Alex\AppData\Local\VirtualStore
              2017-09-17 17:00 - 2017-08-13 19:15 - 000000000 ____D C:\Program Files\NVIDIA Corporation
              2017-09-17 17:00 - 2015-09-18 22:28 - 000000000 ____D C:\temp
              2017-09-17 17:00 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\Help
              2017-09-17 15:41 - 2009-07-14 06:08 - 000014642 _____ C:\Windows\Tasks\SCHEDLGU.TXT
              2017-09-17 15:27 - 2017-08-14 15:12 - 000000000 ____D C:\Windows\Minidump
              2017-09-17 15:18 - 2016-05-26 16:27 - 000000000 ____D C:\Program Files (x86)\Intel
              2017-09-17 11:04 - 2016-02-29 02:41 - 000000000 ____D C:\Program Files (x86)\TunnelBear
              2017-09-16 20:11 - 2015-09-18 22:28 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
              2017-09-16 15:09 - 2015-09-18 22:28 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
              2017-09-14 21:28 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\rescache
              2017-09-14 21:03 - 2009-07-14 05:45 - 005049072 _____ C:\Windows\system32\FNTCACHE.DAT
              2017-09-13 18:16 - 2015-12-06 18:16 - 000000000 ____D C:\Program Files (x86)\Overwolf
              2017-09-12 17:07 - 2015-09-24 17:53 - 000000000 ____D C:\Users\Alex\AppData\Local\ElevatedDiagnostics
              2017-09-11 08:01 - 2016-04-23 15:45 - 000000000 ____D C:\Program Files\Common Files\AV
              2017-09-11 07:35 - 2016-04-23 15:44 - 000002308 _____ C:\Users\Public\Desktop\Norton Security.lnk
              2017-09-11 07:35 - 2016-04-23 15:44 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security
              2017-09-11 07:35 - 2016-04-23 15:44 - 000000000 ____D C:\Windows\system32\Drivers\NSx64
              2017-09-08 16:07 - 2016-10-10 16:48 - 000000000 ____D C:\Users\Alex\AppData\Local\CrashDumps
              2017-09-08 12:49 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\system32\NDF
              2017-09-04 03:38 - 2016-04-23 15:44 - 000102568 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
              2017-09-04 03:38 - 2016-04-23 15:44 - 000008309 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
              2017-08-29 01:36 - 2017-08-11 12:30 - 000002212 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
              2017-08-29 01:36 - 2017-08-11 12:30 - 000002200 _____ C:\Users\Public\Desktop\Google Chrome.lnk
              2017-08-26 21:20 - 2017-08-13 20:01 - 001281162 ____N C:\Windows\Minidump\082617-6957-01.dmp
              2017-08-22 01:40 - 2016-11-22 00:42 - 000001951 _____ C:\Windows\NvContainerRecovery.bat

              ==================== Files in the root of some directories =======

              2017-08-13 19:15 - 2017-08-13 19:15 - 000000000 ____H () C:\ProgramData\DP45977C.lfl
              [HEADING=1]Some files in TEMP:[/HEADING]
              2017-09-17 15:08 - 2017-09-17 15:08 - 004043712 _____ (Geek Unіnstaller) C:\Users\Alex\AppData\Local\Temp\geek64.exe

              ==================== Bamital & volsnap ======================

              (There is no automatic fix for files that do not pass verification.)

              C:\Windows\system32\winlogon.exe => File is digitally signed
              C:\Windows\system32\wininit.exe => File is digitally signed
              C:\Windows\SysWOW64\wininit.exe => File is digitally signed
              C:\Windows\explorer.exe => File is digitally signed
              C:\Windows\SysWOW64\explorer.exe => File is digitally signed
              C:\Windows\system32\svchost.exe => File is digitally signed
              C:\Windows\SysWOW64\svchost.exe => File is digitally signed
              C:\Windows\system32\services.exe => File is digitally signed
              C:\Windows\system32\User32.dll => File is digitally signed
              C:\Windows\SysWOW64\User32.dll => File is digitally signed
              C:\Windows\system32\userinit.exe => File is digitally signed
              C:\Windows\SysWOW64\userinit.exe => File is digitally signed
              C:\Windows\system32\rpcss.dll => File is digitally signed
              C:\Windows\system32\dnsapi.dll => File is digitally signed
              C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
              C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

              LastRegBack: 2017-09-12 16:06

              ==================== End of FRST.txt ============================
              [HEADING=1]Addition.txt
              Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-09-2017 01
              Ran by Alex (18-09-2017 00:44:44)
              Running from C:\Users\Alex\Downloads
              Windows 7 Professional Service Pack 1 (X64) (2017-08-13 18:40:16)
              Boot Mode: Normal[/HEADING]
              ==================== Accounts: =============================

              Administrator (S-1-5-21-630333582-4039751370-1614634531-500 - Administrator - Disabled)
              Alex (S-1-5-21-630333582-4039751370-1614634531-1000 - Administrator - Enabled) => C:\Users\Alex
              Guest (S-1-5-21-630333582-4039751370-1614634531-501 - Limited - Disabled)

              ==================== Security Center ========================

              (If an entry is included in the fixlist, it will be removed.)

              AV: Norton Security (Enabled - Up to date) {30744133-1E94-7B35-F4A3-82A5AEF1CBAA}
              AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
              AS: Norton Security (Enabled - Up to date) {8B15A0D7-38AE-74BB-CE13-B9D7D5768117}
              FW: Norton Security (Enabled) {084FC016-54FB-7A6D-DFFC-2B9050228CD1}

              ==================== Installed Programs ======================

              (Only the adware programs with “Hidden” flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

              A Game of Thrones version 1.2 (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...{7C82709E-75FE-4C3A-976A-8C97908DDD7B}_is1) (Version: 1.2 - AGOT TEAM)
              Adobe AIR (HKLM-x32...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
              Adobe Creative Cloud (HKLM-x32...\Adobe Creative Cloud) (Version: 3.8.0.310 - Adobe Systems Incorporated)
              Adobe Flash Player Plugin (HKLM-x32...\Adobe Flash Player Plugin) (Version: 9.0.124.0 - Adobe Systems Incorporated)
              Adobe Help Manager (HKLM-x32...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8C E.1) (Version: 4.0.244 - Adobe Systems Incorporated)
              Adobe Photoshop CS6 version 13.0.1 (HKLM-x32...{A724DC44-6241-42D3-BA57-778B178ABC17}_is1) (Version: 13.0.1 - Adobe Systems, Inc.)
              Age of Empires® III: Complete Collection (HKLM-x32...\Steam App 105450) (Version: - Ensemble Studios)
              Alien: Isolation (HKLM-x32...\Steam App 214490) (Version: - Creative Assembly)
              American Truck Simulator (HKLM...\Steam App 270880) (Version: - SCS Software)
              Ansel (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Ansel) (Version: 385.41 - NVIDIA Corporation) Hidden
              ARK: Survival Evolved (HKLM...\Steam App 346110) (Version: - Studio Wildcard)
              ARK: Survival Evolved (HKLM-x32...\Steam App 346110) (Version: - Studio Wildcard)
              Assassin’s Creed III (HKLM-x32...\Uplay Install 54) (Version: - Ubisoft)
              Astroloco: Worst Contact (HKLM...\Steam App 357490) (Version: - Hungry Planet Games)
              Audacity 2.1.2 (HKLM-x32...\Audacity®_is1) (Version: 2.1.2 - Audacity Team)
              Audiosurf (HKLM...\Steam App 12900) (Version: - Dylan Fitterer)
              Audiosurf 2 (HKLM...\Steam App 235800) (Version: - Dylan Fitterer)
              Bandicam (HKLM-x32...\Bandicam) (Version: 3.0.2.1014 - Bandisoft.com)
              Bandisoft MPEG-1 Decoder (HKLM-x32...\BandiMPEG1) (Version: - Bandisoft.com)
              Banished (HKLM...\Steam App 242920) (Version: - Shining Rock Software LLC)
              Battlefield 1942 (HKLM-x32...{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}) (Version: - )
              Battlefield 1942: Secret Weapons of WWII (HKLM-x32...{B73B4A99-4173-4747-BBEC-0F05E966F9D2}) (Version: - )
              Battlefield 1942: The Road To Rome (HKLM-x32...{D057AA08-8CBF-42E3-9EAB-23B8FED1C279}) (Version: - )
              Beholder (HKLM...\Steam App 475550) (Version: - Warm Lamp Games)
              Besiege (HKLM-x32...\Steam App 346010) (Version: - Spiderling Studios)
              Betrayer (HKLM-x32...\Steam App 243120) (Version: - Blackpowder Games)
              Blackwake (HKLM...\Steam App 420290) (Version: - Mastfire Studios Pty Ltd)
              Braid (HKLM...\Steam App 26800) (Version: - Number None)
              Broforce (HKLM-x32...\Steam App 274190) (Version: - Free Lives)
              Chivalry: Medieval Warfare (HKLM-x32...\Steam App 219640) (Version: - Torn Banner Studios)
              Clustertruck (HKLM...\Steam App 397950) (Version: - Landfall)
              Counter-Strike: Global Offensive (HKLM-x32...\Steam App 730) (Version: - Valve)
              Counter-Strike: Source (HKLM-x32...\Steam App 240) (Version: - Valve)
              Crusader Kings II (HKLM...\Steam App 203770) (Version: - Paradox Development Studio)
              D3DX10 (HKLM-x32...{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
              Darkest Dungeon (HKLM-x32...\Steam App 262060) (Version: - Red Hook Studios)
              Darksiders (HKLM-x32...\Steam App 50620) (Version: - Vigil Games)
              DarksidersInstaller (HKLM-x32...{B93EEE50-9C8F-45DF-95E4-3D85A6E242F3}) (Version: 1.00.1000 - THQ)
              DarthMod: Shogun II (HKLM-x32...\DarthMod: Shogun II) (Version: - )
              DEFCON (HKLM...\Steam App 1520) (Version: - Introversion Software)
              Democracy 3 (HKLM...\Steam App 245470) (Version: - Positech Games)
              Depth (HKLM-x32...\Steam App 274940) (Version: - Digital Confectioners)
              Discord (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Discord) (Version: 0.0.298 - Discord Inc.)
              Domina (HKLM...\Steam App 535230) (Version: - DolphinBarn)
              Empire TV Tycoon (HKLM-x32...\Steam App 377900) (Version: - Dreamsite Games)
              Euro Truck Simulator 2 (HKLM...\Steam App 227300) (Version: - SCS Software)
              Euro Truck Simulator 2 (HKLM-x32...\Steam App 227300) (Version: - SCS Software)
              Europa Universalis IV (HKLM...\Steam App 236850) (Version: - Paradox Development Studio)
              First Strike Final Hour (HKLM...\Steam App 587000) (Version: - Blindflug Studios AG)
              FTL: Faster Than Light (HKLM...\Steam App 212680) (Version: - Subset Games)
              Game of Thrones - A Telltale Games Series (HKLM-x32...\Steam App 330840) (Version: - Telltale Games)
              Garry’s Mod (HKLM-x32...\Steam App 4000) (Version: - Facepunch Studios)
              Google Chrome (HKLM-x32...\Google Chrome) (Version: 60.0.3112.113 - Google Inc.)
              Google Update Helper (HKLM-x32...{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
              Hearts of Iron IV (HKLM...\Steam App 394360) (Version: - Paradox Development Studio)
              Hell Yeah! (HKLM-x32...\Steam App 205230) (Version: - Arkedo)
              Hexcells Infinite (HKLM-x32...\Steam App 304410) (Version: - Matthew Brown)
              Java 8 Update 144 (64-bit) (HKLM...{26A24AE4-039D-4CA4-87B4-2F64180144F0}) (Version: 8.0.1440.1 - Oracle Corporation)
              Jet Set Radio (HKLM-x32...\Steam App 205950) (Version: - Blit Software)
              Kerbal Space Program (HKLM...\Steam App 220200) (Version: - Squad)
              KHOLAT (HKLM-x32...\Steam App 343710) (Version: - IMGN.PRO)
              Kinect for Windows Speech Recognition Language Pack (en-AU) (HKLM-x32...{48CEC0A3-AE10-4EE3-AC62-76D3D58792E5}) (Version: 11.0.7400.336 - Microsoft Corporation)
              Kinect for Windows Speech Recognition Language Pack (en-CA) (HKLM-x32...{9C5505DA-F9C1-46CB-9F8F-AC38F8EA518A}) (Version: 11.0.7400.336 - Microsoft Corporation)
              Kinect for Windows Speech Recognition Language Pack (en-GB) (HKLM-x32...{A0186231-0A8B-455A-8A25-B64AABCC11A6}) (Version: 11.0.7400.336 - Microsoft Corporation)
              Kinect for Windows Speech Recognition Language Pack (en-US) (HKLM-x32...{8AAA44BB-487E-4D01-AF76-484ACB90DBFE}) (Version: 11.0.7400.336 - Microsoft Corporation)
              Left 4 Dead 2 (HKLM-x32...\Steam App 550) (Version: - Valve)
              Mafia II (HKLM...\Steam App 50130) (Version: - 2K Czech)
              Mafia III (HKLM...\Steam App 360430) (Version: - Hangar 13)
              Medieval Kingdoms 1212 Part 1 (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Medieval Kingdoms 1212 Part 1) (Version: - )
              Medieval Kingdoms 1212 Part 2 (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Medieval Kingdoms 1212 Part 2) (Version: - )
              Microsoft .NET Framework 4.6.1 (HKLM...{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
              Microsoft ASP.NET MVC 4 Runtime (HKLM-x32...{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
              Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (HKLM-x32...{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.30730.0 - Microsoft Corporation)
              Microsoft Games for Windows - LIVE Redistributable (HKLM-x32...{59E4543A-D49D-4489-B445-473D763C79AF}) (Version: 2.0.672.0 - Microsoft Corporation)
              Microsoft Office 365 ProPlus - en-us (HKLM...\O365ProPlusRetail - en-us) (Version: 16.0.8326.2107 - Microsoft Corporation)
              Microsoft OneDrive (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation)
              Microsoft Server Speech Platform Runtime (x64) (HKLM...{3B433087-E62E-4BF5-97F9-4AF6E1C2409C}) (Version: 11.0.7400.345 - Microsoft Corporation)
              Microsoft Small Basic v1.1 (HKLM-x32...{7AAA27E4-CDB3-49C0-AA2D-41827C001BA3}) (Version: 1.1.0.0 - Microsoft Corporation)
              Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32...{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
              Microsoft Visual C++ 2005 Redistributable (HKLM-x32...{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
              Microsoft Visual C++ 2005 Redistributable (HKLM-x32...{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
              Microsoft Visual C++ 2005 Redistributable (HKLM-x32...{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
              Microsoft Visual C++ 2005 Redistributable (HKLM-x32...{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
              Microsoft Visual C++ 2005 Redistributable (x64) (HKLM...{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
              Microsoft Visual C++ 2005 Redistributable (x64) (HKLM...{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
              Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM...{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
              Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM...{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
              Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32...{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
              Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32...{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
              Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32...{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
              Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32...{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
              Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM...{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
              Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32...{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
              Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32...{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
              Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32...{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
              Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32...{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
              Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32...{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
              Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32...{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
              Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32...{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
              Microsoft Xbox 360 Accessories 1.2 (HKLM...{D9C50188-12D5-4D3E-8F00-682346C2AA5F}) (Version: 1.20.146.0 - Microsoft)
              Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32...{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
              Minecraft (HKLM-x32...{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
              Mini Metro (HKLM-x32...\Steam App 287980) (Version: - Dinosaur Polo Club)
              Mirror’s Edge (HKLM-x32...\Steam App 17410) (Version: - DICE)
              Mount & Blade: Warband (HKLM-x32...\Steam App 48700) (Version: - TaleWorlds Entertainment)
              Mount & Blade: With Fire and Sword (HKLM...\Steam App 48720) (Version: - TaleWorlds Entertainment)
              Movie Maker (HKLM-x32...{38F03569-A636-4CF3-BDDE-032C8C251304}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
              Movie Maker (HKLM-x32...{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
              Mozilla Firefox 42.0 (x86 en-GB) (HKLM-x32...\Mozilla Firefox 42.0 (x86 en-GB)) (Version: 42.0 - Mozilla)
              Mozilla Maintenance Service (HKLM-x32...\MozillaMaintenanceService) (Version: 42.0 - Mozilla)
              Napoleon: Total War (HKLM...\Steam App 34030) (Version: - The Creative Assembly)
              Naval War: Arctic Circle (HKLM-x32...\Steam App 200050) (Version: - TURBO TAPE GAMES)
              Next Car Game: Wreckfest (HKLM-x32...\Steam App 228380) (Version: - Bugbear)
              Nexus Mod Manager (HKLM...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.61.16 - Black Tree Gaming)
              Norton Security (HKLM-x32...\NS) (Version: 22.10.1.10 - Symantec Corporation)
              NVIDIA 3D Vision Controller Driver 369.04 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
              NVIDIA 3D Vision Driver 385.41 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 385.41 - NVIDIA Corporation)
              NVIDIA GeForce Experience 3.9.0.61 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.9.0.61 - NVIDIA Corporation)
              NVIDIA Graphics Driver 385.41 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 385.41 - NVIDIA Corporation)
              NVIDIA HD Audio Driver 1.3.34.27 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.27 - NVIDIA Corporation)
              NVIDIA PhysX System Software 9.17.0524 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.17.0524 - NVIDIA Corporation)
              Office 16 Click-to-Run Extensibility Component (HKLM-x32...{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8326.2107 - Microsoft Corporation) Hidden
              Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM...{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8326.2107 - Microsoft Corporation) Hidden
              Office 16 Click-to-Run Licensing Component (HKLM...{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8326.2107 - Microsoft Corporation) Hidden
              Office 16 Click-to-Run Localization Component (HKLM-x32...{90160000-008C-0409-0000-0000000FF1CE}) (Version: 16.0.8326.2107 - Microsoft Corporation) Hidden
              One Finger Death Punch (HKLM...\Steam App 264200) (Version: - Silver Dollar Games)
              OpenAL (HKLM-x32...\OpenAL) (Version: - )
              Origin (HKLM-x32...\Origin) (Version: 10.2.1.38915 - Electronic Arts, Inc.)
              ORION: Prelude (HKLM-x32...\Steam App 104900) (Version: - Spiral Game Studios)
              Overgrowth (HKLM-x32...\Steam App 25000) (Version: - Wolfire)
              Overwolf (HKLM-x32...\Overwolf) (Version: 0.107.36.0 - Overwolf Ltd.)
              Panzermadels: Tank Dating Simulator (HKLM...\Steam App 379980) (Version: - DEVGRU-P)
              Papers, Please (HKLM-x32...\Steam App 239030) (Version: - 3909)
              Pivot Animator version 4.1.10 (HKLM-x32...\Pivot Animator_is1) (Version: 4.1.10 - Motus Software Ltd)
              Plague Inc: Evolved (HKLM...\Steam App 246620) (Version: - Ndemic Creations)
              Prison Architect (HKLM-x32...\Steam App 233450) (Version: - Introversion Software)
              Project Zomboid (HKLM...\Steam App 108600) (Version: - The Indie Stone)
              PunkBuster for Battlefield 1942 (HKLM-x32...{127B684B-A002-44C8-99A7-6CF8F1E26873}) (Version: - )
              PunkBuster Services (HKLM-x32...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
              Python 3.5.0 (32-bit) (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...{1197d2bb-6cf8-488a-b994-d5bf6d7efe7b}) (Version: 3.5.150.0 - Python Software Foundation)
              Python 3.5.0 Core Interpreter (32-bit) (HKLM-x32...{E9E55FC3-A47F-4ACA-8691-C22469450FB1}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
              Python 3.5.0 Development Libraries (32-bit) (HKLM-x32...{D5A057BD-471E-40D6-B7E0-79E08210D8F6}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
              Python 3.5.0 Documentation (32-bit) (HKLM-x32...{169B7A58-FE29-48E8-8773-9D6390815C8C}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
              Python 3.5.0 Executables (32-bit) (HKLM-x32...{CE48771A-4CC2-4F35-A7B3-D136E91D04F3}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
              Python 3.5.0 Launcher (32-bit) (HKLM-x32...{CAA5FC80-DEF6-4DFA-9C06-23921A87F092}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
              Python 3.5.0 pip Bootstrap (32-bit) (HKLM-x32...{11187860-0D92-490D-86EC-3A941C98D451}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
              Python 3.5.0 Standard Library (32-bit) (HKLM-x32...{0740B2CD-63EC-44C7-B39E-B6EB579773E6}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
              Python 3.5.0 Tcl/Tk Support (32-bit) (HKLM-x32...{7AB85182-2EE4-4137-A5C6-D8C03958DCBA}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
              Python 3.5.0 Test Suite (32-bit) (HKLM-x32...{2234BC4D-E95D-40C2-818D-7845760C510F}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
              Python 3.5.0 Utility Scripts (32-bit) (HKLM-x32...{4A69B338-2C0C-4726-A261-44DBCF0DA94A}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
              Realtek High Definition Audio Driver (HKLM-x32...{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7256 - Realtek Semiconductor Corp.)
              Reigns (HKLM...\Steam App 474750) (Version: - Nerial)
              Reus (HKLM...\Steam App 222730) (Version: - Abbey Games)
              Rising Storm 2: Vietnam (HKLM...\Steam App 418460) (Version: - Antimatter Games)
              Rockstar Games Social Club (HKLM-x32...\Rockstar Games Social Club) (Version: 1.2.1.2 - Rockstar Games)
              Rodina (HKLM-x32...\Steam App 314230) (Version: - Elliptic Games)
              SEGA Genesis & Mega Drive Classics (HKLM-x32...\Steam App 34270) (Version: - Sega)
              Sir, You Are Being Hunted (HKLM...\Steam App 242880) (Version: - Big Robot Ltd)
              Skype Click to Call (HKLM-x32...{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
              Skype Web Plugin (HKLM-x32...{AC7406B6-BB3B-4CD1-AEBA-0527B9CB16FE}) (Version: 7.27.0.105 - Skype Technologies S.A.)
              Skype Web Plugin (HKLM-x32...{FAD5089C-EB67-442F-89A3-970BCD034D40}) (Version: 7.14.0.184 - Skype Technologies S.A.)
              Skype™ 7.36 (HKLM-x32...{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.36.101 - Skype Technologies S.A.)
              Spermination (HKLM-x32...\Steam App 363460) (Version: - Phr00t’s Software)
              Steam (HKLM-x32...\Steam) (Version: 2.10.91.91 - Valve Corporation)
              Stellaris (HKLM...\Steam App 281990) (Version: - Paradox Development Studio)
              Sunless Sea (HKLM-x32...\Steam App 304650) (Version: - Failbetter Games)
              Sword With Sauce: Alpha (HKLM...\Steam App 581630) (Version: - Diatomic Games)
              Team Fortress 2 (HKLM-x32...\Steam App 440) (Version: - Valve)
              TeamSpeak 3 Client (HKLM...\TeamSpeak 3 Client) (Version: 3.0.18 - TeamSpeak Systems GmbH)
              The Binding of Isaac: Rebirth (HKLM-x32...\Steam App 250900) (Version: - Nicalis, Inc.)
              The Curious Expedition (HKLM-x32...\Steam App 358130) (Version: - Maschinen-Mensch)
              The Elder Scrolls V: Skyrim (HKLM-x32...\Steam App 72850) (Version: - Bethesda Game Studios)
              The Howler (HKLM-x32...\Steam App 306040) (Version: - Antanas Marcelionis)
              The Swindle (HKLM-x32...\Steam App 369110) (Version: - Size Five Games)
              theHunter™: Call of the Wild (HKLM...\Steam App 518790) (Version: - Expansive Worlds)
              This War of Mine (HKLM-x32...\Steam App 282070) (Version: - 11 bit studios)
              Tom Clancy’s Rainbow Six Siege (HKLM...\Steam App 359550) (Version: - Ubisoft Montreal)
              Total War: ATTILA (HKLM...\Steam App 325610) (Version: - Creative Assembly)
              Total War: ROME II - Emperor Edition (HKLM...\Steam App 214950) (Version: - Creative Assembly)
              Total War™: WARHAMMER® (HKLM...\Steam App 364360) (Version: - Creative Assembly)
              TP-LINK Archer T4U Driver (HKLM-x32...{58F414FE-74CC-42A0-9D86-A089849C510A}) (Version: 1.3.1 - TP-LINK)
              TP-LINK Wireless Configuration Utility (HKLM-x32...{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.3.1 - TP-LINK)
              TunnelBear (HKLM-x32...{7094abcc-0311-45f4-aaac-638bf633a58a}) (Version: 2.3.22.0 - TunnelBear)
              TunnelBear (HKLM-x32...{EFF0A0F1-E557-4228-8F55-E6DD94516FDC}) (Version: 2.3.22.0 - TunnelBear) Hidden
              Uplay (HKLM-x32...\Uplay) (Version: 27.0 - Ubisoft)
              Verdun (HKLM...\Steam App 242860) (Version: - M2H)
              Victoria II (HKLM...\Steam App 42960) (Version: - Paradox Development Studio)
              Vulkan Run Time Libraries 1.0.51.0 (HKLM...\VulkanRT1.0.51.0) (Version: 1.0.51.0 - LunarG, Inc.)
              Warhammer: End Times - Vermintide (HKLM...\Steam App 235540) (Version: - Fatshark)
              Westerado: Double Barreled (HKLM-x32...\Steam App 275200) (Version: - Ostrich Banditos)
              Windows Live Essentials (HKLM-x32...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
              WinRAR 5.30 (32-bit) (HKLM-x32...\WinRAR archiver) (Version: 5.30.0 - win.rar GmbH)

              ==================== Custom CLSID (Whitelisted): ==========================

              (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

              CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{58743271-597A-401B-AF4A-1450179151C0}\InprocServer32 → C:\Users\Alex\AppData\Local\SkypePlugin\7.27.0.105 \GatewayActiveX-x64.dll (Skype Technologies S.A.)
              CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 → C:\Windows\system32\igfxEM.exe (Intel Corporation)
              CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{AB08C8FC-971C-4AE2-B23D-D76AC42C46E9}\localserver32 → C:\Users\Alex\AppData\Local\SkypePlugin\7.14.0.184 \GatewayVersion-x64.exe (Skype Technologies S.A.)
              CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{ABB7ECA5-6973-499F-B610-80173795847A}\InprocServer32 → C:\Users\Alex\AppData\Local\SkypePlugin\7.14.0.184 \GatewayActiveX-x64.dll (Skype Technologies S.A.)
              CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{CBF9CD8C-2714-4F36-B76A-43E6C7547BC2}\localserver32 → C:\Users\Alex\AppData\Local\SkypePlugin\7.27.0.105 \EdgeCalling.exe (Skype Technologies S.A.)
              CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{D0FC4B60-C60D-4908-8365-0C64C03E0291}\localserver32 → C:\Users\Alex\AppData\Local\SkypePlugin\7.27.0.105 \GatewayVersion-x64.exe (Skype Technologies S.A.)
              CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 → C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
              ShellIconOverlayIdentifiers: [ OverlayExcluded] → {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
              ShellIconOverlayIdentifiers: [ OverlayPending] → {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
              ShellIconOverlayIdentifiers: [ OverlayProtected] → {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
              ShellIconOverlayIdentifiers: [ AccExtIco1] → {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
              ShellIconOverlayIdentifiers: [ AccExtIco2] → {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
              ShellIconOverlayIdentifiers: [ AccExtIco3] → {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
              ShellIconOverlayIdentifiers-x32: [ OverlayExcluded] → {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
              ShellIconOverlayIdentifiers-x32: [ OverlayPending] → {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
              ShellIconOverlayIdentifiers-x32: [ OverlayProtected] → {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
              ContextMenuHandlers1: [AccExt] → {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
              ContextMenuHandlers1: [BUContextMenu] → {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
              ContextMenuHandlers1: [Symantec.Norton.Antivirus.IEContextMenu] → {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\NavShExt.dll [2017-08-24] (Symantec Corporation)
              ContextMenuHandlers1: [WinRAR] → {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2015-11-18] (Alexander Roshal)
              ContextMenuHandlers1-x32: [WinRAR32] → {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2015-11-18] (Alexander Roshal)
              ContextMenuHandlers2: [Symantec.Norton.Antivirus.IEContextMenu] → {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\NavShExt.dll [2017-08-24] (Symantec Corporation)
              ContextMenuHandlers5: [igfxcui] → {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => → No File
              ContextMenuHandlers5: [igfxDTCM] → {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2015-08-09] (Intel Corporation)
              ContextMenuHandlers5: [NvCplDesktopContext] → {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2017-08-22] (NVIDIA Corporation)
              ContextMenuHandlers6: [AccExt] → {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
              ContextMenuHandlers6: [BUContextMenu] → {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
              ContextMenuHandlers6: [Symantec.Norton.Antivirus.IEContextMenu] → {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\NavShExt.dll [2017-08-24] (Symantec Corporation)
              ContextMenuHandlers6: [WinRAR] → {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2015-11-18] (Alexander Roshal)
              ContextMenuHandlers6-x32: [WinRAR32] → {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2015-11-18] (Alexander Roshal)

              ==================== Scheduled Tasks (Whitelisted) =============

              (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

              Task: {0E10E79B-1E11-4FE0-8E62-AA7A2FEBDEBB} - System32\Tasks\Games\UpdateCheck_S-1-5-21-630333582-4039751370-1614634531-1000
              Task: {0E2760F8-3F8C-475B-857C-6F966EB51CFD} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-09-16] (Microsoft Corporation)
              Task: {1B52B129-F8C3-440F-ABFF-87CBACAAD825} - System32\Tasks\Norton Security\Norton Security Error Analyzer => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\SymErr.exe [2017-08-24] (Symantec Corporation)
              Task: {2D7FFE4C-4FD2-4698-9968-5BDA2564A4BD} - System32\Tasks\Remediation\AntimalwareMigrationTas k => C:\Program Files\Common Files\AV\Norton Security\Upgrade.exe [2017-08-24] (Symantec Corporation)
              Task: {333417FE-D85C-41DA-A0E4-3570F2DB8D8E} - System32\Tasks\Microsoft\Office\OfficeTelemetryAge ntLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-09-16] (Microsoft Corporation)
              Task: {3C6655B2-C4F1-48D6-8626-C00343860F72} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-08-22] (NVIDIA Corporation)
              Task: {4C621390-2ED0-4DC8-8214-3CC44517B6F5} - \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser → No File <==== ATTENTION
              Task: {545B86B2-596D-4117-AB6D-E9F723D954F9} - System32\Tasks\Microsoft\Office\OfficeBackgroundTa skHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.e xe [2017-09-16] ()
              Task: {641A6F4E-DAB3-4C5B-9108-FF3513DEA8C2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-08-11] (Google Inc.)
              Task: {6C337603-206E-4433-A7C7-BC2EC64E2A6D} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-08-22] (NVIDIA Corporation)
              Task: {6C64553E-F232-4DE0-972A-F5275F25F314} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-09-08] (Microsoft Corporation)
              Task: {6F344BC0-2C6B-4B4F-8420-06B6452BD820} - System32\Tasks\Microsoft\Office\OfficeTelemetryAge ntFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-09-16] (Microsoft Corporation)
              Task: {7A180518-D8DF-41D3-8C8F-E1D26DA021C7} - System32\Tasks\DllKitPRO => C:\Program Files (x86)\DllKitPRO\dllkitpro.exe
              Task: {8984C734-EF5B-477D-9477-23C78298AC9E} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-08-22] (NVIDIA Corporation)
              Task: {9350ECA1-A41C-4A0D-B77D-1A79EF41587F} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-09-10] (Overwolf LTD)
              Task: {9BFBCD6F-4A43-4019-B9F7-27446FFA8875} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-08-22] (NVIDIA Corporation)
              Task: {9D291AE7-9EA7-4F81-8894-A9BA14CD736A} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-08-22] (NVIDIA Corporation)
              Task: {B9B207BE-FDC2-4CF3-B617-5B8EF9FE99EF} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-08-22] (NVIDIA Corporation)
              Task: {CA7A9A3C-D0EB-4DB4-BD2D-FB2E4D3A6DAC} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-09-08] (Microsoft Corporation)
              Task: {D556B455-9C86-4F05-AA5E-1F501B329789} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-08-11] (Google Inc.)
              Task: {D8C22827-26A2-4491-9FB3-6C5C06A96BF5} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\WSCStub.exe [2017-08-24] (Symantec Corporation)
              Task: {E5AD3D8F-8DE9-4495-84C4-8001C1AE137B} - System32\Tasks\Norton Security\Norton Security Error Processor => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\SymErr.exe [2017-08-24] (Symantec Corporation)
              Task: {E8FDE3AE-AC85-4A31-9C6A-FEF251529C48} - System32\Tasks\Microsoft\Office\OfficeBackgroundTa skHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.e xe [2017-09-16] ()
              Task: {F50F6D2F-D9C1-4765-801D-ACFDDD8EEE31} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-08-22] (NVIDIA Corporation)
              Task: {F7833A2D-DC5B-4F58-B533-AF4B948C8207} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-08-22] (NVIDIA Corporation)

              (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

              ==================== Shortcuts & WMI ========================

              (The entries could be listed to be restored or removed.)

              ==================== Loaded Modules (Whitelisted) ==============

              2017-09-17 17:00 - 2017-08-22 00:10 - 000133752 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
              2017-09-17 17:00 - 2017-08-22 01:40 - 001267320 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
              2015-09-23 06:10 - 2013-10-18 17:42 - 000048856 _____ () C:\Windows\runSW.exe
              2016-02-10 13:24 - 2016-02-10 13:24 - 000039424 _____ () C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe
              2016-05-22 19:33 - 2016-05-22 19:33 - 000491184 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
              2016-03-16 17:23 - 2017-09-16 20:10 - 008929480 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
              2015-09-23 06:10 - 2013-12-16 09:52 - 000847872 _____ () E:\1A\TWCU.exe
              2017-08-29 01:36 - 2017-08-23 09:48 - 003824472 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\libg lesv2.dll
              2017-08-29 01:36 - 2017-08-23 09:48 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\libe gl.dll
              2017-08-11 12:36 - 2017-08-08 15:13 - 001893880 _____ () C:\Users\Alex\AppData\Local\Discord\app-0.0.298\ffmpeg.dll
              2017-04-26 15:19 - 2017-04-26 15:19 - 002005976 ____R () C:\Program Files (x86)\Skype\Phone\skypert.dll
              2017-06-01 02:18 - 2017-09-16 20:10 - 008928968 _____ () C:\Program Files (x86)\Microsoft Office\root\Office16\1033\GrooveIntlResource.dll
              2015-09-23 06:22 - 2017-08-04 22:19 - 000678176 _____ () E:\Steam\SDL2.dll
              2015-09-23 06:22 - 2016-09-01 02:02 - 004969248 _____ () E:\Steam\v8.dll
              2015-09-23 06:22 - 2016-09-01 02:02 - 001563936 _____ () E:\Steam\icui18n.dll
              2015-09-23 06:22 - 2016-09-01 02:02 - 001195296 _____ () E:\Steam\icuuc.dll
              2015-09-23 06:22 - 2017-09-07 05:51 - 002505504 _____ () E:\Steam\video.dll
              2015-09-23 06:22 - 2016-01-27 08:49 - 002549760 _____ () E:\Steam\libavcodec-56.dll
              2015-09-23 06:22 - 2016-01-27 08:49 - 000442880 _____ () E:\Steam\libavutil-54.dll
              2015-09-23 06:22 - 2016-01-27 08:49 - 000491008 _____ () E:\Steam\libavformat-56.dll
              2015-09-23 06:22 - 2016-01-27 08:49 - 000332800 _____ () E:\Steam\libavresample-2.dll
              2015-09-23 06:22 - 2016-01-27 08:49 - 000485888 _____ () E:\Steam\libswscale-3.dll
              2015-09-23 06:22 - 2017-09-07 05:51 - 000885024 _____ () E:\Steam\bin\chromehtml.DLL
              2016-03-09 09:19 - 2016-07-04 23:17 - 000266560 _____ () E:\Steam\openvr_api.dll
              2015-09-23 06:10 - 2013-11-21 16:13 - 001411072 _____ () E:\1A\nicLan.dll
              2015-09-23 06:10 - 2013-07-23 16:21 - 000193024 _____ () E:\1A\DC_WFF.dll
              2015-09-23 06:10 - 2013-12-20 11:13 - 000300544 _____ () E:\1A\WJRtl.dll
              2017-08-11 12:36 - 2017-08-08 15:13 - 001938424 _____ () C:\Users\Alex\AppData\Local\Discord\app-0.0.298\libglesv2.dll
              2017-08-11 12:36 - 2017-08-08 15:13 - 000095736 _____ () C:\Users\Alex\AppData\Local\Discord\app-0.0.298\libegl.dll
              2017-08-11 12:36 - 2017-08-31 17:42 - 009622008 _____ () \?\C:\Users\Alex\AppData\Roaming\discord\0.0.298\m odules\discord_voice\discord_voice.node
              2017-08-11 12:36 - 2017-08-11 12:36 - 001440248 _____ () \?\C:\Users\Alex\AppData\Roaming\discord\0.0.298\m odules\discord_utils\discord_utils.node
              2017-09-17 17:20 - 2017-09-17 17:21 - 000148992 _____ () \?\C:\Users\Alex\AppData\Local\Temp\DF37.tmp.node
              2017-08-11 12:36 - 2017-08-11 12:36 - 002658296 _____ () \?\C:\Users\Alex\AppData\Roaming\discord\0.0.298\m odules\discord_rpc\discord_rpc.node
              2017-08-11 12:36 - 2017-08-11 12:36 - 002673656 _____ () \?\C:\Users\Alex\AppData\Roaming\discord\0.0.298\m odules\discord_contact_import\discord_contact_impo rt.node
              2016-12-13 01:11 - 2017-07-17 23:50 - 073115424 _____ () E:\Steam\bin\cef\cef.win7\libcef.dll
              2017-06-08 08:00 - 2017-05-17 02:54 - 000678176 _____ () E:\Steam\bin\cef\cef.win7\SDL2.dll
              2015-09-23 06:22 - 2015-09-25 00:52 - 000119208 _____ () E:\Steam\winh264.dll
              2017-09-17 17:00 - 2017-08-22 01:40 - 001040504 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll

              ==================== Alternate Data Streams (Whitelisted) =========

              (If an entry is included in the fixlist, only the ADS will be removed.)

              ==================== Safe Mode (Whitelisted) ===================

              (If an entry is included in the fixlist, it will be removed from the registry. The “AlternateShell” will be restored.)

              ==================== Association (Whitelisted) ===============

              (If an entry is included in the fixlist, the registry item will be restored to default or removed.)

              ==================== Internet Explorer trusted/restricted ===============

              (If an entry is included in the fixlist, it will be removed from the registry.)

              IE trusted site: HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\sharepoint.com → hxxps://thsuknet-files.sharepoint.com

              ==================== Hosts content: ===============================

              (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

              2009-07-14 03:34 - 2009-06-10 22:00 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts

              ==================== Other Areas ============================

              (Currently there is no automatic fix for this section.)

              HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Control Panel\Desktop\Wallpaper →
              DNS Servers: 192.168.1.254
              HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Pol icies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
              Windows Firewall is enabled.

              ==================== MSCONFIG/TASK MANAGER disabled items ==

              ==================== FirewallRules (Whitelisted) ===============

              (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

              FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
              FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
              FirewallRules: [{42E0D8E2-640C-4DD9-BAD7-CD09051FF44C}] => (Allow) E:\Steam\steamapps\common\rocketleague\Binaries\Wi n32\RocketLeague.exe
              FirewallRules: [{97C74FD9-8B9C-4AF0-A2AC-83129914792B}] => (Allow) E:\Steam\steamapps\common\rocketleague\Binaries\Wi n32\RocketLeague.exe
              FirewallRules: [{9EF21195-2FF3-469C-A2E6-C75F54C9E403}] => (Allow) E:\Steam\steamapps\common\DarkestDungeon_windows\D arkest.exe
              FirewallRules: [{8751276E-0CFE-488F-B354-0042937D54ED}] => (Allow) E:\Steam\steamapps\common\DarkestDungeon_windows\D arkest.exe
              FirewallRules: [{7E36EA14-0843-4D27-B8A3-57ABA1569D41}] => (Allow) E:\Steam\steamapps\common\Tom Clancy’s Rainbow Six Siege\RainbowSix_BE.exe
              FirewallRules: [{12BBAF68-B76C-47BA-A8D7-9D62172DCB8C}] => (Allow) E:\Steam\steamapps\common\Tom Clancy’s Rainbow Six Siege\RainbowSix_BE.exe
              FirewallRules: [{2CA463D1-4AB4-44A6-87F4-8FFC550DF098}] => (Allow) E:\Steam\steamapps\common\Tom Clancy’s Rainbow Six Siege\RainbowSix.exe
              FirewallRules: [{EE5715D8-7C4F-43BD-9DD8-269A6389A3FF}] => (Allow) E:\Steam\steamapps\common\Tom Clancy’s Rainbow Six Siege\RainbowSix.exe
              FirewallRules: [UDP Query User{FA795D5E-A9B9-4D7E-9D00-E16CA398D6EE}E:\steam\steamapps\common\sword with sauce alpha\swordwithsauce\binaries\win64\swordwithsauce-win64-shipping.exe] => (Block) E:\steam\steamapps\common\sword with sauce alpha\swordwithsauce\binaries\win64\swordwithsauce-win64-shipping.exe
              FirewallRules: [TCP Query User{CFFE91F1-1D3F-4835-B704-F5F4A9262B91}E:\steam\steamapps\common\sword with sauce alpha\swordwithsauce\binaries\win64\swordwithsauce-win64-shipping.exe] => (Block) E:\steam\steamapps\common\sword with sauce alpha\swordwithsauce\binaries\win64\swordwithsauce-win64-shipping.exe
              FirewallRules: [{31DBB65F-F7A5-4814-B503-25F4476524D0}] => (Allow) E:\Steam\steamapps\common\Sword With Sauce Alpha\SwordWithSauce.exe
              FirewallRules: [{2E786667-6141-434C-A780-255A6910E673}] => (Allow) E:\Steam\steamapps\common\Sword With Sauce Alpha\SwordWithSauce.exe
              FirewallRules: [{DEBF978F-35D0-4D7E-AD01-31B137442E90}] => (Allow) E:\Steam\steamapps\common\theHunterCotW\theHunterC otW_F.exe
              FirewallRules: [{D4F83BA4-18EE-41D3-9A9F-9240A5C38382}] => (Allow) E:\Steam\steamapps\common\theHunterCotW\theHunterC otW_F.exe
              FirewallRules: [{9245239C-163E-414D-8D24-B1D9CE981418}] => (Allow) E:\Steam\steamapps\common\Domina\Domina.exe
              FirewallRules: [{229F5F9A-4796-45AB-894A-1372D1023DD6}] => (Allow) E:\Steam\steamapps\common\Domina\Domina.exe
              FirewallRules: [{963B376C-72B4-4BAE-A07D-738D4777137D}] => (Allow) E:\Steam\steamapps\common\Warhammer End Times Vermintide\binaries\vermintide.exe
              FirewallRules: [{7419C265-AC33-4499-AC29-7E0BC36F8466}] => (Allow) E:\Steam\steamapps\common\Warhammer End Times Vermintide\binaries\vermintide.exe
              FirewallRules: [{EA1E0400-571F-4557-A2A6-E1CB9748F5C7}] => (Allow) E:\Steam\steamapps\common\Warhammer End Times Vermintide\launcher\launcher.exe
              FirewallRules: [{1DD7BC8B-9BBE-4727-84BE-3BAA91C13E57}] => (Allow) E:\Steam\steamapps\common\Warhammer End Times Vermintide\launcher\launcher.exe
              FirewallRules: [{DC51661D-7F68-457D-8430-3B0E93495A8F}] => (Allow) E:\Steam\steamapps\common\ClusterTruck\Clustertruc k.exe
              FirewallRules: [{B9BDF904-4648-4ADB-B3CA-0E59657FFFEB}] => (Allow) E:\Steam\steamapps\common\ClusterTruck\Clustertruc k.exe
              FirewallRules: [{F84E3176-CF7B-409C-A59E-FC647FBC883F}] => (Allow) E:\Steam\steamapps\common\Audiosurf 2\Audiosurf2.exe
              FirewallRules: [{55FB82E4-5B01-46C5-85D1-9401F194E31D}] => (Allow) E:\Steam\steamapps\common\Audiosurf 2\Audiosurf2.exe
              FirewallRules: [{DC79F007-2E33-40E4-9745-565B808B77D2}] => (Allow) E:\Steam\steamapps\common\ShadowOfMordor\x64\Shado wOfMordor.exe
              FirewallRules: [{AD840992-EE07-40AB-AD89-B6E1EFAD6037}] => (Allow) E:\Steam\steamapps\common\ShadowOfMordor\x64\Shado wOfMordor.exe
              FirewallRules: [{C8981042-BF2C-495F-9EE0-F9456AACC242}] => (Allow) E:\Steam\steamapps\common\Kerbal Space Program\KSP_x64.exe
              FirewallRules: [{221E8CC9-8AAA-4C6A-93A1-2E0B40377098}] => (Allow) E:\Steam\steamapps\common\Kerbal Space Program\KSP_x64.exe
              FirewallRules: [{2E49665E-D241-4A03-98DA-5852486E1F6E}] => (Allow) E:\Steam\steamapps\common\Kerbal Space Program\KSP.exe
              FirewallRules: [{D2C17914-8F24-447A-82DE-458D5DEC49A2}] => (Allow) E:\Steam\steamapps\common\Kerbal Space Program\KSP.exe
              FirewallRules: [{5E474619-4428-4094-BCB0-944940119757}] => (Allow) E:\Steam\steamapps\common\Defcon\Defcon.exe
              FirewallRules: [{5D164E49-48CF-434F-95D0-F49C31D49B25}] => (Allow) E:\Steam\steamapps\common\Defcon\Defcon.exe
              FirewallRules: [{A24226EA-DE5B-4E8D-BDBC-FF9FC2575D32}] => (Allow) E:\Steam\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe
              FirewallRules: [{99FDF815-F77C-426E-8019-A3AB6C6C1FAF}] => (Allow) E:\Steam\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe
              FirewallRules: [{97BEEF9C-E91C-467B-B7AF-7678E676FD8C}] => (Allow) E:\Steam\steamapps\common\FirstStrikeFinalHour\Fir stStikeFinalHour.exe
              FirewallRules: [{47544D27-5040-44E8-931A-050BD916A9F9}] => (Allow) E:\Steam\steamapps\common\FirstStrikeFinalHour\Fir stStikeFinalHour.exe
              FirewallRules: [{34E0F4B3-7120-4A6F-B43D-858E002010D8}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
              FirewallRules: [{2A80FDE2-53BC-48B0-853F-BF2595A249C6}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
              FirewallRules: [{2D89E8FC-673D-4C02-A54E-383DF0AD9D29}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
              FirewallRules: [{01ED11F7-73E4-412C-AE10-CFED915ED1B8}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
              FirewallRules: [UDP Query User{B9388CB9-F2E6-4CB4-86E4-98275B380A1B}E:\steam\steamapps\common\rising storm 2\binaries\win64\vngame.exe] => (Allow) E:\steam\steamapps\common\rising storm 2\binaries\win64\vngame.exe
              FirewallRules: [TCP Query User{67039C1E-BFC8-492E-83C3-F4ECC6B74401}E:\steam\steamapps\common\rising storm 2\binaries\win64\vngame.exe] => (Allow) E:\steam\steamapps\common\rising storm 2\binaries\win64\vngame.exe
              FirewallRules: [{F6C784AB-160A-4DB3-8C16-69071E357605}] => (Allow) E:\Steam\steamapps\common\Rising Storm 2\Binaries\Win64\RisingStorm2.exe
              FirewallRules: [{E79E930E-783C-4A36-B7AB-DBEC5868A58E}] => (Allow) E:\Steam\steamapps\common\Rising Storm 2\Binaries\Win64\RisingStorm2.exe
              FirewallRules: [{79398897-AA55-4EBE-A4CF-174B9FF29F98}] => (Allow) E:\Steam\steamapps\common\DoorKickers\DoorKickers. exe
              FirewallRules: [{F737ED71-AC79-42DD-931A-9497AB46210D}] => (Allow) E:\Steam\steamapps\common\DoorKickers\DoorKickers. exe
              FirewallRules: [{68B62FC8-6D34-4C1B-B8F0-87B5D9CC3B57}] => (Allow) E:\Steam\steamapps\common\Banished\Application-steam-x64.exe
              FirewallRules: [{B9DEC131-09F7-4D63-8143-826784481799}] => (Allow) E:\Steam\steamapps\common\Banished\Application-steam-x64.exe
              FirewallRules: [UDP Query User{24FDCDC8-83F0-4A0E-AFC3-4323B8792A0B}E:\steam\steamapps\common\total war attila\attila.exe] => (Allow) E:\steam\steamapps\common\total war attila\attila.exe
              FirewallRules: [TCP Query User{7899C3B7-030D-4A96-89BD-0A47CB7D3C49}E:\steam\steamapps\common\total war attila\attila.exe] => (Allow) E:\steam\steamapps\common\total war attila\attila.exe
              FirewallRules: [{BEDAA2FC-1151-427E-A29B-A2CD05CCF440}] => (Allow) E:\Steam\steamapps\common\Europa Universalis IV\eu4.exe
              FirewallRules: [{81C8211F-1347-48D7-90BF-432BBFD7037B}] => (Allow) E:\Steam\steamapps\common\Europa Universalis IV\eu4.exe
              FirewallRules: [{DE521477-84D2-40CB-90CC-43C913133255}] => (Allow) E:\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe
              FirewallRules: [{B7D6DA9C-12FA-4AE7-B93B-30529673D824}] => (Allow) E:\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe
              FirewallRules: [{A7B9060E-8C9A-48B3-B6B3-F7FB977D05A2}] => (Allow) E:\Steam\steamapps\common\Hearts of Iron IV\hoi4.exe
              FirewallRules: [{91645FE8-B95A-4456-AAC6-D2D312E86449}] => (Allow) E:\Steam\steamapps\common\Hearts of Iron IV\hoi4.exe
              FirewallRules: [{90CBC851-432B-403E-87EA-51993853EB89}] => (Allow) E:\Steam\steamapps\common\Blackwake\Blackwake.exe
              FirewallRules: [{217A27C8-548A-4B26-87FB-E157D5C90A94}] => (Allow) E:\Steam\steamapps\common\Blackwake\Blackwake.exe
              FirewallRules: [{89BC7FAB-24B9-418F-9C7E-534A3123B1D5}] => (Allow) E:\Steam\steamapps\common\Braid\braid.exe
              FirewallRules: [{E715CA75-720B-40BA-87C6-6002A33AE2AE}] => (Allow) E:\Steam\steamapps\common\Braid\braid.exe
              FirewallRules: [{D30F36CB-7D63-4A3B-A961-30A61D2DE9C5}] => (Allow) E:\Steam\steamapps\common\Panzermadels\Panzermadel s.exe
              FirewallRules: [{A9BE815F-B4E1-4EDF-A90E-636DB852B603}] => (Allow) E:\Steam\steamapps\common\Panzermadels\Panzermadel s.exe
              FirewallRules: [{830C5052-BA2D-4297-8664-99690D6F439B}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
              FirewallRules: [{1DCDECD8-32DE-47B3-A9A7-15D576E33A17}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
              FirewallRules: [{D116D235-915C-4B9B-BE16-7508264D880E}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
              FirewallRules: [{CC2C3EBA-0395-4908-AAE4-32BF1CB39141}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
              FirewallRules: [{E981DFD8-5E0A-4383-A80F-3F18F88F4D0A}] => (Allow) E:\Steam\steamapps\common\Napoleon Total War\Napoleon.exe
              FirewallRules: [{F0C441EC-8414-4475-B70F-3BA5EF502412}] => (Allow) E:\Steam\steamapps\common\Napoleon Total War\Napoleon.exe
              FirewallRules: [{F85A05B8-5A75-4C25-8862-A43F6F11A7B2}] => (Allow) E:\Steam\steamapps\common\Viscera Cleanup Detail Shadow Warrior\Binaries\Win64\UDK.exe
              FirewallRules: [{17A9FEDA-B52D-4F6C-A98C-3C90BB351D52}] => (Allow) E:\Steam\steamapps\common\Viscera Cleanup Detail Shadow Warrior\Binaries\Win64\UDK.exe
              FirewallRules: [{1D8E899E-C77B-4072-8868-814363CED353}] => (Allow) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
              FirewallRules: [{B352F41F-1964-4274-BB28-091EF60E8B86}] => (Allow) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
              FirewallRules: [{1767CAD6-9A86-414E-8B02-FC3A28CCFB14}] => (Allow) E:\Steam\steamapps\common\Audiosurf\engine\QuestVi ewer.exe
              FirewallRules: [{97691625-7572-4769-870A-0D530DDB4C03}] => (Allow) E:\Steam\steamapps\common\Audiosurf\engine\QuestVi ewer.exe
              FirewallRules: [{25BC2235-AE52-47C4-A548-842CD0F4BECD}] => (Allow) E:\Steam\steamapps\common\PlagueInc\PlagueIncEvolv ed.exe
              FirewallRules: [{6B81137A-C5E8-423A-AD96-B2574B330D61}] => (Allow) E:\Steam\steamapps\common\PlagueInc\PlagueIncEvolv ed.exe
              FirewallRules: [{24F33C97-33F4-44AC-90B1-B11B5A13135F}] => (Allow) E:\Steam\steamapps\common\Reigns\Reigns.exe
              FirewallRules: [{3CC4B159-BA84-4086-A80B-F486438F3F81}] => (Allow) E:\Steam\steamapps\common\Reigns\Reigns.exe
              FirewallRules: [{6BD83D17-FA37-49B5-B749-A80DC3DC8B6C}] => (Allow) E:\Steam\steamapps\common\Stellaris\stellaris.exe
              FirewallRules: [{81BFBDCC-FA70-4BBD-BF07-FFAAE4F1A0E0}] => (Allow) E:\Steam\steamapps\common\Stellaris\stellaris.exe
              FirewallRules: [{638F03D5-B23E-4D45-A336-358F4B01FAD9}] => (Allow) E:\Steam\steamapps\common\SirYouAreBeingHunted\lau ncher\sir.exe
              FirewallRules: [{BE1C0583-684C-4250-B6CE-E136CF57FBED}] => (Allow) E:\Steam\steamapps\common\SirYouAreBeingHunted\lau ncher\sir.exe
              FirewallRules: [{0D483D8E-E7A6-4A4D-9688-DBDC4B811C3D}] => (Allow) E:\Steam\steamapps\common\Victoria 2\victoria2.exe
              FirewallRules: [{432A5774-162A-4E5F-8794-B533C7CC590A}] => (Allow) E:\Steam\steamapps\common\Victoria 2\victoria2.exe
              FirewallRules: [{76A220E4-C543-4F0E-A0F6-894E318EB56F}] => (Allow) E:\Steam\steamapps\common\Crusader Kings II\CK2game.exe
              FirewallRules: [{27A2611C-D8BD-4E1A-87DA-0EB1837E9689}] => (Allow) E:\Steam\steamapps\common\Crusader Kings II\CK2game.exe
              FirewallRules: [{3F21D295-365B-4A2D-A6B0-CEBF9A6BE268}] => (Allow) E:\Steam\steamapps\common\Mafia II\pc\mafia2.exe
              FirewallRules: [{62C82668-0ACB-4BC7-A472-8FA79FA41669}] => (Allow) E:\Steam\steamapps\common\Mafia II\pc\mafia2.exe
              FirewallRules: [UDP Query User{FBB7209E-6933-4015-9A9B-9924F738AEDD}E:\steam\steamapps\common\total war warhammer\warhammer.exe] => (Block) E:\steam\steamapps\common\total war warhammer\warhammer.exe
              FirewallRules: [TCP Query User{88DF63A5-2BE8-47A0-8981-8F6210D2D801}E:\steam\steamapps\common\total war warhammer\warhammer.exe] => (Block) E:\steam\steamapps\common\total war warhammer\warhammer.exe
              FirewallRules: [{5A437811-D259-4952-AC45-A3112F4F36D4}] => (Allow) E:\Steam\steamapps\common\Mount & Blade With Fire and Sword\mb_wfas.exe
              FirewallRules: [{72D1CB53-12F4-4FE5-B188-5A92A29E2AA1}] => (Allow) E:\Steam\steamapps\common\Mount & Blade With Fire and Sword\mb_wfas.exe
              FirewallRules: [{DE40EABE-FBAA-4DE7-9E41-D784D2BE795E}] => (Allow) E:\Steam\steamapps\common\Sega Classics\SEGAGameRoom.exe
              FirewallRules: [{C40CAABE-3F50-43CD-9C0B-944E643D1F0B}] => (Allow) E:\Steam\steamapps\common\Sega Classics\SEGAGameRoom.exe
              FirewallRules: [{3B387808-6641-4704-95BD-43C4B161627C}] => (Allow) E:\Steam\steamapps\common\Astroloco1\winsetup.exe
              FirewallRules: [{0811C7C5-BABE-4F4F-833F-B66A7047F02C}] => (Allow) E:\Steam\steamapps\common\Astroloco1\winsetup.exe
              FirewallRules: [{20E32851-A107-4FE9-8415-65AFF7306D05}] => (Allow) E:\Steam\steamapps\common\Astroloco1\AstroLoco1.ex e
              FirewallRules: [{FB4AE6F0-9CFE-4937-BC03-0C3CF0853A77}] => (Allow) E:\Steam\steamapps\common\Astroloco1\AstroLoco1.ex e
              FirewallRules: [{669200CB-CC12-4307-894C-E7D19A0E7795}] => (Allow) E:\Steam\steamapps\common\Democracy 3\Democracy3.exe
              FirewallRules: [{31410A78-3B3C-4CFC-90D1-0471D27E4D04}] => (Allow) E:\Steam\steamapps\common\Democracy 3\Democracy3.exe
              FirewallRules: [{E986416F-C4ED-4608-B49E-A138F2211A11}] => (Allow) E:\Steam\steamapps\common\Prison Architect\Prison Architect Safe Mode.exe
              FirewallRules: [{A528405E-8BB8-4BF3-BB58-30731328943D}] => (Allow) E:\Steam\steamapps\common\Prison Architect\Prison Architect Safe Mode.exe
              FirewallRules: [{9A5A74F0-4D33-4B4E-8538-4D5772003F1E}] => (Allow) E:\Steam\steamapps\common\Broforce\Broforce_beta.e xe
              FirewallRules: [{E76347D7-E4D7-4044-AA54-C17AE849BA91}] => (Allow) E:\Steam\steamapps\common\Broforce\Broforce_beta.e xe
              FirewallRules: [{9A5024AF-9A1D-4D67-AF35-9DC77D4AF1A8}] => (Allow) E:\Steam\steamapps\common\The Curious Expedition\electron.exe
              FirewallRules: [{16538FC7-E5FB-4DA9-B153-25BED221170B}] => (Allow) E:\Steam\steamapps\common\The Curious Expedition\electron.exe
              FirewallRules: [{707CA1CC-E0C6-415E-BF70-C8751C72B299}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
              FirewallRules: [{DDDDBE11-3799-4CDA-B6B3-078733C0FC91}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
              FirewallRules: [UDP Query User{B67BDE6A-907E-4D2B-B7E2-AF83CD46DC50}C:\users\alex\appdata\local\skypeplug in\7.14.0.184\pluginhost.exe] => (Block) C:\users\alex\appdata\local\skypeplugin\7.14.0.184 \pluginhost.exe
              FirewallRules: [TCP Query User{8B47E8E4-3C58-43CC-A249-39B14FB07B6F}C:\users\alex\appdata\local\skypeplug in\7.14.0.184\pluginhost.exe] => (Block) C:\users\alex\appdata\local\skypeplugin\7.14.0.184 \pluginhost.exe
              FirewallRules: [{6B502C33-FE25-41DA-8340-C8E8BE3AA202}] => (Allow) E:\Steam\steamapps\common\Hexcells Infinite\Hexcells Infinite.exe
              FirewallRules: [{216A7F06-258B-4771-9138-2C7F8673266B}] => (Allow) E:\Steam\steamapps\common\Hexcells Infinite\Hexcells Infinite.exe
              FirewallRules: [{D3D9BFBE-1FE0-48D3-BE01-2AA08697776C}] => (Allow) E:\Steam\steamapps\common\Hell Yeah\HELLYEAH.exe
              FirewallRules: [{AACDAA37-61D5-49A5-B830-18C529AE01D4}] => (Allow) E:\Steam\steamapps\common\Hell Yeah\HELLYEAH.exe
              FirewallRules: [{13569324-A13A-4DE8-8A29-4D356CECEE9E}] => (Allow) E:\Steam\steamapps\common\Jet Set Radio\jsrsetup.exe
              FirewallRules: [{AB6CB6EB-5898-4868-8068-1890315616DF}] => (Allow) E:\Steam\steamapps\common\Jet Set Radio\jsrsetup.exe
              FirewallRules: [{F917580D-38D1-447F-8A33-45A969C9D034}] => (Allow) E:\Steam\steamapps\common\Sega Classics\SEGAGenesisClassics.exe
              FirewallRules: [{02DB5186-DB06-4C8C-9B90-CF23CC415C7B}] => (Allow) E:\Steam\steamapps\common\Sega Classics\SEGAGenesisClassics.exe
              FirewallRules: [{33FC265F-D9DC-49AF-92CC-79F0643C04D2}] => (Allow) E:\Steam\steamapps\common\Game of Thrones\Thrones.exe
              FirewallRules: [{82EAD0A7-F1E2-48A8-934E-7694EBAB49AA}] => (Allow) E:\Steam\steamapps\common\Game of Thrones\Thrones.exe
              FirewallRules: [{D21D3DDF-E0A0-4DC1-AB84-03554C988AF8}] => (Allow) E:\Steam\steamapps\common\ARK\ShooterGame\Binaries \Win64\ShooterGame_BE.exe
              FirewallRules: [{382E2789-7BC3-4A3B-982A-98D06D5FABA9}] => (Allow) E:\Steam\steamapps\common\ARK\ShooterGame\Binaries \Win64\ShooterGame_BE.exe
              FirewallRules: [{23CC8488-320F-41FD-A7DB-51D8C5F1BBD0}] => (Allow) E:\Steam\steamapps\common\Alien Isolation\AI.exe
              FirewallRules: [{9E2B6E6C-D761-42C7-8054-533EE8B9121D}] => (Allow) E:\Steam\steamapps\common\Alien Isolation\AI.exe
              FirewallRules: [{C01E9C4E-BBC0-4636-ADE0-DC5024B5571B}] => (Allow) E:\Steam\steamapps\common\KHOLAT\Kholat.exe
              FirewallRules: [{CC009619-4293-4E81-83F7-CCACF57A3BA8}] => (Allow) E:\Steam\steamapps\common\KHOLAT\Kholat.exe
              FirewallRules: [{47539AD8-F699-4075-89EA-D4B16DAC6A73}] => (Allow) LPort=1900
              FirewallRules: [{60D9618F-9D12-4128-B29C-C49455BE5DA6}] => (Allow) LPort=2869
              FirewallRules: [{E1719443-8853-4CC3-9B84-95DD1EC708D1}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
              FirewallRules: [{2C0384B5-AB33-4A4E-8D81-C04C16C02762}] => (Allow) E:\Steam\steamapps\common\SunlessSea\Sunless Sea.exe
              FirewallRules: [{75FAA455-D3E0-42B7-AF88-FABA47C7AE50}] => (Allow) E:\Steam\steamapps\common\SunlessSea\Sunless Sea.exe
              FirewallRules: [{19498042-C076-40DC-91E6-098E3D1C2D36}] => (Allow) E:\Steam\steamapps\common\Howler\Howler.exe
              FirewallRules: [{5FA0E1FF-1811-4489-AA53-037F92F270F1}] => (Allow) E:\Steam\steamapps\common\Howler\Howler.exe
              FirewallRules: [{1448BA25-590A-41A5-BD28-50B2BBF34D86}] => (Allow) E:\Steam\steamapps\common\Empire TV Tycoon\EmpireTV.exe
              FirewallRules: [{7B2B72E1-D744-4AD3-8826-57AED661EAF2}] => (Allow) E:\Steam\steamapps\common\Empire TV Tycoon\EmpireTV.exe
              FirewallRules: [{68C4BA0D-0783-4F45-9E1D-C34CFB96AAFD}] => (Allow) E:\Steam\steamapps\common\MiniMetro\MiniMetro.exe
              FirewallRules: [{AA23588A-A03C-44D5-B53E-6723F4F2E201}] => (Allow) E:\Steam\steamapps\common\MiniMetro\MiniMetro.exe
              FirewallRules: [{7724CFD5-31FC-4A19-BD34-B9BA0AF24661}] => (Allow) E:\Steam\steamapps\common\The Swindle\TheSwindle.exe
              FirewallRules: [{DC0EF240-DC38-4DA6-84E4-537114BFA7B4}] => (Allow) E:\Steam\steamapps\common\The Swindle\TheSwindle.exe
              FirewallRules: [{84F9DC32-5293-4774-B36D-E8F44C44D282}] => (Allow) E:\Steam\steamapps\common\ARK\ShooterGame\Binaries \Win64\ShooterGame.exe
              FirewallRules: [{973B707E-89EF-46A6-B5E6-56B2C3DCD6B4}] => (Allow) E:\Steam\steamapps\common\ARK\ShooterGame\Binaries \Win64\ShooterGame.exe
              FirewallRules: [{431DAC89-E340-4DD1-96A4-53A33A1A2DF0}] => (Allow) E:\Steam\steamapps\common\Rodina\Rodina_Steam.exe
              FirewallRules: [{55D36DCC-D3A6-4256-9C99-CC1A162545CF}] => (Allow) E:\Steam\steamapps\common\Rodina\Rodina_Steam.exe
              FirewallRules: [{7CEC57F9-D511-45D9-A137-BEDADCEB920B}] => (Allow) E:\Steam\steamapps\common\This War of Mine\Storyteller.exe
              FirewallRules: [{BD430A1E-086F-4F5A-8465-BBF42C5A4DD4}] => (Allow) E:\Steam\steamapps\common\This War of Mine\Storyteller.exe
              FirewallRules: [UDP Query User{7DA012B3-6B97-4F21-8658-4B432060A4B4}E:\steam\steamapps\common\total war rome ii\rome2.exe] => (Block) E:\steam\steamapps\common\total war rome ii\rome2.exe
              FirewallRules: [TCP Query User{788EAAA3-ABF4-4CAC-B9B0-487216940C79}E:\steam\steamapps\common\total war rome ii\rome2.exe] => (Block) E:\steam\steamapps\common\total war rome ii\rome2.exe
              FirewallRules: [{B1961B26-11B2-43D1-9298-AD44D596DC72}] => (Allow) E:\Steam\steamapps\common\Overgrowth\Overgrowth.ex e
              FirewallRules: [{2C687411-8DE4-4695-9DCD-0DF12ADC43C0}] => (Allow) E:\Steam\steamapps\common\Overgrowth\Overgrowth.ex e
              FirewallRules: [{AFC963A7-0506-473D-AB2D-5C34C49A4A7C}] => (Allow) E:\Steam\steamapps\common\Darksiders\DarksidersPC. exe
              FirewallRules: [{FA1AE159-6B0F-4876-A169-C92B26F9A330}] => (Allow) E:\Steam\steamapps\common\Darksiders\DarksidersPC. exe
              FirewallRules: [{F904C541-FB04-46E7-BBBF-0D23915A34E4}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
              FirewallRules: [{95CDE522-2BC2-4BF6-BB2A-20E988DEB5FF}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
              FirewallRules: [UDP Query User{53A68656-E320-4EFB-868F-C3278D7CC6A5}E:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) E:\steam\steamapps\common\grand theft auto v\gta5.exe
              FirewallRules: [TCP Query User{EB5330A2-FF1A-48B8-9F0C-1CB31701CC34}E:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) E:\steam\steamapps\common\grand theft auto v\gta5.exe
              FirewallRules: [UDP Query User{A22DDE37-3357-4F80-9975-662DBD11CD1A}C:\program files (x86)\ea games\battlefield 1942\bf1942_w32ded.exe] => (Block) C:\program files (x86)\ea games\battlefield 1942\bf1942_w32ded.exe
              FirewallRules: [TCP Query User{D470F145-DBAB-4712-A507-8CDC5D7A3ABF}C:\program files (x86)\ea games\battlefield 1942\bf1942_w32ded.exe] => (Block) C:\program files (x86)\ea games\battlefield 1942\bf1942_w32ded.exe
              FirewallRules: [{5EB6144C-17C7-4A08-807A-B8C7F37B83BF}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
              FirewallRules: [{0A8BDE35-C0B0-4BB8-881E-C17E1BF8373B}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
              FirewallRules: [{364C1438-B6A9-48FB-B3A0-3A3697EBE5A4}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
              FirewallRules: [{A804557F-B272-4CA7-B433-379FB196B77A}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
              FirewallRules: [{7871B363-C137-4E69-B738-84BFF793F221}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin’s Creed III\AC3MP.exe
              FirewallRules: [{E5E38B0F-C356-4961-BB23-A5B9992B1721}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin’s Creed III\AC3MP.exe
              FirewallRules: [{2F32C1BD-026D-440F-BB09-1D284E8E5D5C}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin’s Creed III\AC3SP.exe
              FirewallRules: [{19285886-F36F-4AA2-A87B-D274DF754BC5}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin’s Creed III\AC3SP.exe
              FirewallRules: [{D55C3026-CF01-435E-B93D-A18323811FCE}] => (Allow) E:\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
              FirewallRules: [{7A2B3893-9D9F-4F61-BFF9-F15E19D8DC9F}] => (Allow) E:\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
              FirewallRules: [{804661D2-E50A-4486-8AEB-94E0197928D0}] => (Allow) E:\Steam\steamapps\common\Westerado\WesteradoDB.ex e
              FirewallRules: [{B1F63AFE-4C8D-44D3-9F9B-AF879136B157}] => (Allow) E:\Steam\steamapps\common\Westerado\WesteradoDB.ex e
              FirewallRules: [{54409E8C-8D01-4435-BA9C-5CEC57CCED21}] => (Allow) E:\Steam\steamapps\common\Naval War Arctic Circle\NWAC.exe
              FirewallRules: [{44C58591-853D-4720-BECF-BFA5C33AB711}] => (Allow) E:\Steam\steamapps\common\Naval War Arctic Circle\NWAC.exe
              FirewallRules: [{9604FC57-4CCF-4D1C-8B0D-018E398B9CF0}] => (Allow) E:\Steam\steamapps\common\Team Fortress 2\hl2.exe
              FirewallRules: [{2F984FA6-3F9F-4BD4-8888-78EFD19DE263}] => (Allow) E:\Steam\steamapps\common\Team Fortress 2\hl2.exe
              FirewallRules: [{D66E2B93-4647-4F74-B284-6451632088AB}] => (Allow) E:\Steam\steamapps\common\PapersPlease\PapersPleas e.exe
              FirewallRules: [{06E982CE-5605-4D95-90A6-7CF3E266E380}] => (Allow) E:\Steam\steamapps\common\PapersPlease\PapersPleas e.exe
              FirewallRules: [{F9C922EC-ADA5-4083-833F-0459141144D4}] => (Allow) E:\Steam\steamapps\common\Prison Architect\Prison Architect.exe
              FirewallRules: [{92EDC087-8DD4-4A74-B13F-E9906D60F831}] => (Allow) E:\Steam\steamapps\common\Prison Architect\Prison Architect.exe
              FirewallRules: [{58155C47-495C-49B8-A90B-5C0EBDF2EF90}] => (Allow) E:\Steam\steamapps\common\Orion Dino Beatdown\Binaries\Win32\DinoHordeGame.exe
              FirewallRules: [{A9A66C06-6376-4396-A3DC-E40364C946E2}] => (Allow) E:\Steam\steamapps\common\Orion Dino Beatdown\Binaries\Win32\DinoHordeGame.exe
              FirewallRules: [{423B688C-6B43-4659-A471-03B66F857889}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3y.exe
              FirewallRules: [{A5FE7682-0818-4E8B-A6A6-566EFADADD08}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3y.exe
              FirewallRules: [{F796B4B4-1F7A-4D24-BF22-321C3FDB3B82}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3x.exe
              FirewallRules: [{BD5D063E-88CC-4F0D-8F95-D7CEDD5AD206}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3x.exe
              FirewallRules: [{D1A87504-C435-417C-86F4-D59C69BC93FE}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3.exe
              FirewallRules: [{BA7A361D-9F1D-4EFA-A38D-5D6882D29FCC}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3.exe
              FirewallRules: [{2C26FEBC-10A7-44E2-916E-59EA27E7044B}] => (Allow) E:\Steam\steamapps\common\mirrors edge\Binaries\MirrorsEdge.exe
              FirewallRules: [{8B59C55D-83D0-4872-8980-A584B27F34E4}] => (Allow) E:\Steam\steamapps\common\mirrors edge\Binaries\MirrorsEdge.exe
              FirewallRules: [{B94486E4-B0C8-4DCE-BB9E-07D2C1820114}] => (Allow) E:\Steam\steamapps\common\GarrysMod\hl2.exe
              FirewallRules: [{E3A2D27F-63F4-46AB-84A8-44607939B9D3}] => (Allow) E:\Steam\steamapps\common\GarrysMod\hl2.exe
              FirewallRules: [{7B0149ED-B97A-42EE-9346-C611D26C9072}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Source\hl2.exe
              FirewallRules: [{9C3B6A05-CC77-4942-84D6-596B1741B647}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Source\hl2.exe
              FirewallRules: [{88138129-409E-4C8A-877A-9ADA8EB205FD}] => (Allow) E:\Steam\steamapps\common\Shadow Warrior\dx11\launcher.exe
              FirewallRules: [{8C81187B-7DA3-4FEB-AEA5-43C070B8CD3C}] => (Allow) E:\Steam\steamapps\common\Shadow Warrior\dx11\launcher.exe
              FirewallRules: [{CE65FD72-AAF6-43EB-BC91-DFC7DB02622E}] => (Allow) E:\Steam\steamapps\common\Skyrim\SkyrimLauncher.ex e
              FirewallRules: [{C05D7E65-7A05-47BD-938D-47FD5E6A793E}] => (Allow) E:\Steam\steamapps\common\Skyrim\SkyrimLauncher.ex e
              FirewallRules: [{F89D9D8B-8F5F-405E-AF70-93085D9EB57D}] => (Allow) E:\Steam\steamapps\common\MountBlade Warband\mb_warband.exe
              FirewallRules: [{1B85F771-A5F4-419E-A0A9-1A55AF524C47}] => (Allow) E:\Steam\steamapps\common\MountBlade Warband\mb_warband.exe
              FirewallRules: [{F029FA80-2EE1-4D56-BA7F-4DCB400E9DDD}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ ChivLauncher.exe
              FirewallRules: [{4A79F3FB-2D3A-447F-B98F-B921BF91B69F}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ ChivLauncher.exe
              FirewallRules: [{5CF3CCFE-06D4-420E-92C7-97306CC9BDCE}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ Binaries\Win32\CMW.exe
              FirewallRules: [{83CF1D96-3135-43E9-88AB-767C9827B614}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ Binaries\Win32\CMW.exe
              FirewallRules: [{2D4FF11C-A0D9-4586-B8DC-0CD9B2847568}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ Binaries\Win64\CMW.exe
              FirewallRules: [{6362D936-34F4-46EC-A216-7E26B633D0FF}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ Binaries\Win64\CMW.exe
              FirewallRules: [{3D7F4B70-337C-4710-8161-6868FCA7E18D}] => (Allow) E:\Steam\steamapps\common\Besiege\Besiege.exe
              FirewallRules: [{DAFBB32B-1CDB-438F-A697-592636C7D7BE}] => (Allow) E:\Steam\steamapps\common\Besiege\Besiege.exe
              FirewallRules: [{3BECF9E9-4FFD-4743-9464-486B115D6D40}] => (Allow) E:\Steam\steamapps\common\Depth\Binaries\Win32\Dep thGame.exe
              FirewallRules: [{4B9B38DB-A288-442A-86C6-3EBCA7214BA2}] => (Allow) E:\Steam\steamapps\common\Depth\Binaries\Win32\Dep thGame.exe
              FirewallRules: [{78E8D1FF-A533-4DC3-971B-F014C9CF2B28}] => (Allow) E:\Steam\steamapps\common\This War of Mine\This War of Mine.exe
              FirewallRules: [{38951131-905C-47D2-B57B-646DF9AADFA1}] => (Allow) E:\Steam\steamapps\common\This War of Mine\This War of Mine.exe
              FirewallRules: [{9E1F2C96-4CF6-4FEF-8331-647E4CED1B16}] => (Allow) E:\Steam\steamapps\common\Bugbear Entertainment\Wreckfest_x64.exe
              FirewallRules: [{77CD7DBC-6942-4274-AAFD-3A837CF21061}] => (Allow) E:\Steam\steamapps\common\Bugbear Entertainment\Wreckfest_x64.exe
              FirewallRules: [{104AE981-B2B4-4886-B8C5-EE4D7BDA5444}] => (Allow) E:\Steam\steamapps\common\Bugbear Entertainment\Wreckfest.exe
              FirewallRules: [{8119A035-E01C-4CA3-ADAF-1860F7D7EA94}] => (Allow) E:\Steam\steamapps\common\Bugbear Entertainment\Wreckfest.exe
              FirewallRules: [{29253754-6C95-4AE9-986C-B3824E346FF5}] => (Allow) E:\Steam\steamapps\common\Betrayer\Binaries\Win32\ Betrayer.exe
              FirewallRules: [{DFDF93C6-D21F-42E3-8A41-B56CA7C3826F}] => (Allow) E:\Steam\steamapps\common\Betrayer\Binaries\Win32\ Betrayer.exe
              FirewallRules: [{E5C7965B-9AF7-4E1A-BB56-A77576D86147}] => (Allow) C:\Users\Alex\AppData\Local\Microsoft\OneDrive\One Drive.exe
              FirewallRules: [{727C172C-ED74-4700-ABB0-AFB2AC7D9945}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
              FirewallRules: [{080DF596-7203-4A93-9043-04A70CB70A8A}] => (Allow) E:\Steam\Steam.exe
              FirewallRules: [{465E9387-B3EE-4411-B1AD-6590229DF0C3}] => (Allow) E:\Steam\Steam.exe
              FirewallRules: [{78D55DC1-318C-4CCF-96AD-466B34F9BD3B}] => (Allow) E:\Steam\steamapps\common\American Truck Simulator\bin\win_x64\amtrucks.exe
              FirewallRules: [{82A7C749-EFF2-4FC8-BEA2-F60234722A3E}] => (Allow) E:\Steam\steamapps\common\American Truck Simulator\bin\win_x64\amtrucks.exe
              FirewallRules: [{9289FCA1-40AE-4A93-B3D4-EB855DE9B8FF}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
              FirewallRules: [{6A684CB5-FA9F-46D5-8EB9-42B1A50241FC}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
              FirewallRules: [{3FAE821B-F0C8-4AD1-9F0C-33CD07C80D13}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
              FirewallRules: [{DC8BBF33-0B86-4200-9305-42A8F751ECF9}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
              FirewallRules: [{31CB8B80-E386-428D-87FD-0516F871FCDC}] => (Allow) E:\Steam\steamapps\common\Reus\Reus.exe
              FirewallRules: [{DAD8A397-D99A-416E-9581-4672D4456CBB}] => (Allow) E:\Steam\steamapps\common\Reus\Reus.exe
              FirewallRules: [{3C406D74-9AAD-41CD-938F-D817F2A51B38}] => (Allow) E:\Steam\steamapps\common\FTL Faster Than Light\FTLGame.exe
              FirewallRules: [{CAF31C4F-7A74-41F3-8DDD-E12903D2645A}] => (Allow) E:\Steam\steamapps\common\FTL Faster Than Light\FTLGame.exe
              FirewallRules: [{F1B3BD40-3A40-438D-9CBF-03F463B6E564}] => (Allow) E:\Steam\steamapps\common\Verdun\Verdun.exe
              FirewallRules: [{E04E4B65-01E2-4C95-9C3A-4C7B22E90D37}] => (Allow) E:\Steam\steamapps\common\Verdun\Verdun.exe
              FirewallRules: [{4B9C5204-0B03-45DC-86BD-F0114E09098A}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
              FirewallRules: [{A3CF985B-8C0F-4F3E-A71C-40FD10804A60}] => (Allow) E:\Steam\steamapps\common\Beholder\Beholder.exe
              FirewallRules: [{FA67FAE5-3293-4611-96D4-09CF58E2ECCE}] => (Allow) E:\Steam\steamapps\common\Beholder\Beholder.exe
              FirewallRules: [{2F540637-86A1-4C2D-BF3E-1C27CB81DC51}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
              FirewallRules: [{46C7AABE-DCB5-46A4-B965-A9F509607A80}] => (Allow) E:\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe
              FirewallRules: [{12C7ACC7-5533-49BB-B8BC-363B493E5DC5}] => (Allow) E:\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe
              FirewallRules: [{F50FD054-5F20-408A-B270-ABB2A7EB1D96}] => (Allow) E:\Steam\steamapps\common\Total War Attila\launcher\launcher.exe
              FirewallRules: [{D43A379E-E6DF-4504-BBB1-9AB9E29A0FD1}] => (Allow) E:\Steam\steamapps\common\Total War Attila\launcher\launcher.exe
              FirewallRules: [{AFD591AC-CACE-4CC4-ADE9-79A000FD507C}] => (Allow) E:\Steam\steamapps\common\Total War Rome II\launcher\launcher.exe
              FirewallRules: [{A40E91AC-62A0-4025-A742-323663882DD5}] => (Allow) E:\Steam\steamapps\common\Total War Rome II\launcher\launcher.exe
              FirewallRules: [{628766E9-4C93-450D-A313-BB0144C22DCB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
              FirewallRules: [{22FBB92E-EEFA-4804-A0C7-444B82579374}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
              FirewallRules: [{C97E9772-ECBD-4C90-A901-9FF60D660467}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
              FirewallRules: [{B97361DA-040D-430F-BD5F-88EF314620D7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
              FirewallRules: [{8E70DF23-42C8-432D-B18B-A1808B97E212}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
              FirewallRules: [{10AB831B-C889-490C-8F60-96AB1C7502C1}] => (Allow) E:\Steam\steamapps\common\Verdun\1914-1918 Series.exe
              FirewallRules: [{A9AB1628-93F0-4387-8935-76B8F7B87FB0}] => (Allow) E:\Steam\steamapps\common\Verdun\1914-1918 Series.exe

              ==================== Restore Points =========================

              11-09-2017 03:00:20 Windows Update
              12-09-2017 03:00:20 Windows Update
              13-09-2017 03:00:19 Windows Update
              14-09-2017 03:00:20 Windows Update
              15-09-2017 03:00:19 Windows Update
              17-09-2017 03:00:10 Windows Update
              17-09-2017 15:37:30 Windows Update

              ==================== Faulty Device Manager Devices =============

              ==================== Event log errors: =========================
              [HEADING=1]Application errors:[/HEADING]
              Error: (09/17/2017 05:29:28 PM) (Source: SideBySide) (EventID: 35) (User: )
              Description: Activation context generation failed for “C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest”.Error in manifest or policy file “C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL” on line 1.
              Component identity found in manifest does not match the identity of the component requested.
              Reference is UccApi,processorArchitecture=“AMD64”,type=“win32”, version=“16.0.0.0”.
              Definition is UccApi,processorArchitecture=“x86”,type=“win32”,ve rsion=“16.0.0.0”.
              Please use sxstrace.exe for detailed diagnosis.

              Error: (09/17/2017 05:29:28 PM) (Source: SideBySide) (EventID: 35) (User: )
              Description: Activation context generation failed for “C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest”.Error in manifest or policy file “C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL” on line 1.
              Component identity found in manifest does not match the identity of the component requested.
              Reference is UccApi,processorArchitecture=“AMD64”,type=“win32”, version=“16.0.0.0”.
              Definition is UccApi,processorArchitecture=“x86”,type=“win32”,ve rsion=“16.0.0.0”.
              Please use sxstrace.exe for detailed diagnosis.

              Error: (09/17/2017 05:19:36 PM) (Source: WinMgmt) (EventID: 10) (User: )
              Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

              Error: (09/17/2017 05:08:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
              Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

              Error: (09/17/2017 05:01:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
              Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

              Error: (09/17/2017 04:10:41 PM) (Source: SideBySide) (EventID: 80) (User: )
              Description: Activation context generation failed for “c:\program files (x86)\Adobe\adobe creative cloud\Utils\Creative Cloud Uninstaller.exe”.Error in manifest or policy file “” on line .
              A component version required by the application conflicts with another component version already active.
              Conflicting components are:.
              Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows. common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e8 55142bd5705d.manifest.
              Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.window s.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b 1e3d17594757.manifest.

              Error: (09/17/2017 04:09:08 PM) (Source: SideBySide) (EventID: 35) (User: )
              Description: Activation context generation failed for “c:\program files (x86)\microsoft office\root\Office16\lync.exe.Manifest”.Error in manifest or policy file “c:\program files (x86)\microsoft office\root\Office16\UccApi.DLL” on line 1.
              Component identity found in manifest does not match the identity of the component requested.
              Reference is UccApi,processorArchitecture=“AMD64”,type=“win32”, version=“16.0.0.0”.
              Definition is UccApi,processorArchitecture=“x86”,type=“win32”,ve rsion=“16.0.0.0”.
              Please use sxstrace.exe for detailed diagnosis.

              Error: (09/17/2017 03:41:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
              Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

              Error: (09/17/2017 03:28:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
              Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

              Error: (09/17/2017 03:27:51 PM) (Source: Application Error) (EventID: 1000) (User: )
              Description: Faulting application name: nvstreamsvc.exe, version: 4.0.1000.0, time stamp: 0x54b5dc94
              Faulting module name: nvstreamsvc.exe, version: 4.0.1000.0, time stamp: 0x54b5dc94
              Exception code: 0x40000015
              Fault offset: 0x00000000003e81fa
              Faulting process id: 0x60c
              Faulting application start time: 0x01d32fc11ba29c1e
              Faulting application path: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
              Faulting module path: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
              Report Id: 6282a7ce-9bb4-11e7-9896-fcaa14c32797
              [HEADING=1]System errors:[/HEADING]
              Error: (09/17/2017 05:19:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
              Description: The Origin Web Helper Service service failed to start due to the following error:
              The service did not respond to the start or control request in a timely fashion.

              Error: (09/17/2017 05:19:35 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
              Description: A timeout was reached (30000 milliseconds) while waiting for the Origin Web Helper Service service to connect.

              Error: (09/17/2017 05:19:04 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT AUTHORITY)
              Description: WLAN Extensibility Module has failed to start.

              Module Path: C:\Windows\system32\Rtlihvs.dll
              Error Code: 126

              Error: (09/17/2017 05:19:04 PM) (Source: EventLog) (EventID: 6008) (User: )
              Description: The previous system shutdown at 5:18:25 PM on ‎9/‎17/‎2017 was unexpected.

              Error: (09/17/2017 05:08:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
              Description: The Origin Web Helper Service service failed to start due to the following error:
              The service did not respond to the start or control request in a timely fashion.

              Error: (09/17/2017 05:08:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
              Description: A timeout was reached (30000 milliseconds) while waiting for the Origin Web Helper Service service to connect.

              Error: (09/17/2017 05:08:26 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT AUTHORITY)
              Description: WLAN Extensibility Module has failed to start.

              Module Path: C:\Windows\system32\Rtlihvs.dll
              Error Code: 126

              Error: (09/17/2017 05:08:25 PM) (Source: EventLog) (EventID: 6008) (User: )
              Description: The previous system shutdown at 5:07:20 PM on ‎9/‎17/‎2017 was unexpected.

              Error: (09/17/2017 05:01:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
              Description: The Origin Web Helper Service service failed to start due to the following error:
              The service did not respond to the start or control request in a timely fashion.

              Error: (09/17/2017 05:01:51 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
              Description: A timeout was reached (30000 milliseconds) while waiting for the Origin Web Helper Service service to connect.

              ==================== Memory info ===========================

              Processor: Intel(R) Core™ i7-4790K CPU @ 4.00GHz
              Percentage of memory in use: 18%
              Total physical RAM: 32629.22 MB
              Available physical RAM: 26603.08 MB
              Total Virtual: 65256.63 MB
              Available Virtual: 57121.63 MB

              ==================== Drives ================================

              Drive c: (Windows) (Fixed) (Total:227.02 GB) (Free:61.35 GB) NTFS
              Drive e: () (Fixed) (Total:1863.01 GB) (Free:1209.1 GB) NTFS

              ==================== MBR & Partition Table ==================

              ================================================== ======
              Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 6D21D437)
              Partition 1: (Active) - (Size=5.9 GB) - (Type=27)
              Partition 2: (Not Active) - (Size=227 GB) - (Type=07 NTFS)

              ================================================== ======
              Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: A0B47ED7)
              Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

              ==================== End of Addition.txt ============================

              Comment

              • system
                PCHF Owner
                • Jan 2015
                • 7634

                #37
                Hi 10months, Thank you for the log, whilst I check it would recommend you remove some newly acquired junk. Unfortunately when you install Nvidia drivers these days you get some bundled junk that sends information back to Nvidia. It’s no big deal but you might like to follow this guide and remove their telemetry?

                The guide is HERE

                Comment

                • system
                  PCHF Owner
                  • Jan 2015
                  • 7634

                  #38
                  Please left click on the attached Fixlist.txt file at the bottom of this post. On the dialogue box that opens click “Save File” and then “OK”

                  [MEDIA=imgur]vzol8OV[/MEDIA]

                  Select a location then save the file. IMPORTANT the fixlist.txt file must be in the same location as the FRST program otherwise the fix will not work.

                  [MEDIA=imgur]pjsQ8XB[/MEDIA]

                  To run the fix right click the FRST icon and choose “Run as Administrator” then click on “Fix”

                  [MEDIA=imgur]cp0349X[/MEDIA]

                  Depending on the amount of data to be moved it may take a few minutes to complete, and the computer may reboot. When the fix is complete and/or the computer has rebooted the “Fixlist.txt” file you created will be renamed “Fixlog.txt”

                  Please COPY and PASTE the contents of this new file in your next post:slight_smile:

                  Comment

                  • system
                    PCHF Owner
                    • Jan 2015
                    • 7634

                    #39
                    Hi 10months, any update for us?

                    Comment

                    • 10months
                      PCHF Member
                      • Aug 2017
                      • 23

                      #40
                      Hey, sorry again (again) for the slow responses
                      I haven’t done the telemetry removal, I don’t particularly mind it if it won’t cause any performance issues.
                      My Chrome extensions were removed with the fix, is it fine to reinstall them?
                      [HEADING=1]Fix result of Farbar Recovery Scan Tool (x64) Version: 20-09-2017
                      Ran by Alex (21-09-2017 21:51:02) Run:1
                      Running from C:\Users\Alex\Downloads
                      Loaded Profiles: Alex (Available Profiles: Alex)
                      Boot Mode: Normal[/HEADING]
                      fixlist content:


                      Start
                      CreateRestorepoint:
                      CloseProcesses:
                      HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
                      SearchScopes: HKLM → DefaultScope {E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQxcUwFIFAEUbQsNVFxcFQATIRRZA FtDDAxFcg4PWV1HEAIVdB9aFQQTSEcFME0FCFwEURNNfWtdEkw dVUZrNVs=&q={searchTerms}
                      SearchScopes: HKLM → OldSearch URL = hxxp://uk.yhs4.search.yahoo.com/yhs/search?hspart=appattach&hsimp=yhs-appattach&type=493&p={searchTerms}
                      SearchScopes: HKLM → {E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQxcUwFIFAEUbQsNVFxcFQATIRRZA FtDDAxFcg4PWV1HEAIVdB9aFQQTSEcFME0FCFwEURNNfWtdEkw dVUZrNVs=&q={searchTerms}
                      SearchScopes: HKLM-x32 → DefaultScope {E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} URL =
                      SearchScopes: HKU\S-1-5-21-630333582-4039751370-1614634531-1000 → OldSearch URL =
                      SearchScopes: HKU\S-1-5-21-630333582-4039751370-1614634531-1000 → {A6A1D0B1-E2C0-425C-9FA5-600268E3E449} URL = hxxp://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=bl-bir-dd__alt__ddc_dss_bd_com&p={searchTerms}
                      FF Plugin-x32: @microsoft.com/GENUINE → disabled [No File]
                      FF Plugin: @microsoft.com/GENUINE → disabled [No File]
                      CHR RestoreOnStartup: Default → “hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRggWJAsAWAxFFhgRdQxdTA1EEVQOIVhaU xRIRwcUdwFcVwhGFwEFIk0FA1oDB0VXfV5bFElXTwhxJUpNDU0 CaUBB”
                      CHR StartupUrls: Default → “chrome://history/”,“hxxps://www.youtube.com/feed/subscriptions”,“hxxp://www.netflix.com/browse/”,“hxxps://twitter.com/”,“hxxp://www.schoolplannerbook.com/tanbridge/homework/?email=12afarr%40ths.uk.net&action=homeworkfromema il&view=due&as=list”,“hxxp://vle.ths.uk.net/”
                      CHR HKLM-x32...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
                      CHR HKLM...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
                      S3 NAVENG; ??\C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\SDSDefs \20170903.001\NAVENG.SYS
                      S3 NAVEX15; ??\C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\SDSDefs \20170903.001\NAVEX15.SYS
                      Task: {0E10E79B-1E11-4FE0-8E62-AA7A2FEBDEBB} - System32\Tasks\Games\UpdateCheck_S-1-5-21-630333582-4039751370-1614634531-1000
                      Task: {0E2760F8-3F8C-475B-857C-6F966EB51CFD} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-09-16] (Microsoft Corporation)
                      Task: {333417FE-D85C-41DA-A0E4-3570F2DB8D8E} - System32\Tasks\Microsoft\Office\OfficeTelemetryAge ntLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-09-16] (Microsoft Corporation)
                      Task: {3C6655B2-C4F1-48D6-8626-C00343860F72} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-08-22] (NVIDIA Corporation)
                      Task: {4C621390-2ED0-4DC8-8214-3CC44517B6F5} - \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser → No File <==== ATTENTION
                      Task: {545B86B2-596D-4117-AB6D-E9F723D954F9} - System32\Tasks\Microsoft\Office\OfficeBackgroundTa skHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.e xe [2017-09-16] ()
                      Task: {6C64553E-F232-4DE0-972A-F5275F25F314} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-09-08] (Microsoft Corporation)
                      Task: {6F344BC0-2C6B-4B4F-8420-06B6452BD820} - System32\Tasks\Microsoft\Office\OfficeTelemetryAge ntFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-09-16] (Microsoft Corporation)
                      Task: {7A180518-D8DF-41D3-8C8F-E1D26DA021C7} - System32\Tasks\DllKitPRO => C:\Program Files (x86)\DllKitPRO\dllkitpro.exe
                      Task: {9350ECA1-A41C-4A0D-B77D-1A79EF41587F} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-09-10] (Overwolf LTD)
                      Task: {CA7A9A3C-D0EB-4DB4-BD2D-FB2E4D3A6DAC} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-09-08] (Microsoft Corporation)
                      Task: {E8FDE3AE-AC85-4A31-9C6A-FEF251529C48} - System32\Tasks\Microsoft\Office\OfficeBackgroundTa skHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.e xe [2017-09-16] ()
                      Task: {F50F6D2F-D9C1-4765-801D-ACFDDD8EEE31} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-08-22] (NVIDIA Corporation)
                      Task: {F7833A2D-DC5B-4F58-B533-AF4B948C8207} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-08-22] (NVIDIA Corporation)
                      C:\Program Files (x86)\DllKitPRO\dllkitpro.exe
                      C:\ProgramData\DP45977C.lfl
                      CMD: netsh advfirewall reset
                      CMD: netsh advfirewall set allprofiles state Off
                      CMD: ipconfig /flushdns
                      reboot:
                      end


                      Restore point was successfully created.
                      Processes closed successfully.
                      HKLM\Software\Microsoft\Internet Explorer\Main\Start Page => value restored successfully
                      HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope => value restored successfully
                      HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\OldSearch => key removed successfully
                      HKLM\Software\Classes\CLSID\OldSearch => key not found.
                      HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} => key removed successfully
                      HKLM\Software\Classes\CLSID{E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} => key not found.
                      HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope => value restored successfully
                      HKU\S-1-5-21-630333582-4039751370-1614634531-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\OldSearch => key removed successfully
                      HKLM\Software\Classes\CLSID\OldSearch => key not found.
                      HKU\S-1-5-21-630333582-4039751370-1614634531-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{A6A1D0B1-E2C0-425C-9FA5-600268E3E449} => key removed successfully
                      HKLM\Software\Classes\CLSID{A6A1D0B1-E2C0-425C-9FA5-600268E3E449} => key not found.
                      HKLM\Software\Wow6432Node\MozillaPlugins@microsoft.com/GENUINE => key removed successfully
                      HKLM\Software\MozillaPlugins@microsoft.com/GENUINE => key removed successfully
                      Chrome RestoreOnStartup => removed successfully
                      Chrome StartupUrls => removed successfully
                      HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions \iikflkcanblccfahdhdonehdalibjnif => key removed successfully
                      HKLM\SOFTWARE\Google\Chrome\Extensions\iikflkcanbl ccfahdhdonehdalibjnif => key removed successfully
                      HKLM\System\CurrentControlSet\Services\NAVENG => key could not remove. Access Denied.
                      HKLM\System\CurrentControlSet\Services\NAVEX15 => key could not remove. Access Denied.
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon{0E10E79 B-1E11-4FE0-8E62-AA7A2FEBDEBB} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{0E10E79 B-1E11-4FE0-8E62-AA7A2FEBDEBB} => key removed successfully
                      C:\Windows\System32\Tasks\Games\UpdateCheck_S-1-5-21-630333582-4039751370-1614634531-1000 => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Games\Up dateCheck_S-1-5-21-630333582-4039751370-1614634531-1000 => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{0E2760F 8-3F8C-475B-857C-6F966EB51CFD} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{0E2760F 8-3F8C-475B-857C-6F966EB51CFD} => key removed successfully
                      C:\Windows\System32\Tasks\Microsoft\Office\Office Subscription Maintenance => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsof t\Office\Office Subscription Maintenance => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon{333417F E-D85C-41DA-A0E4-3570F2DB8D8E} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{333417F E-D85C-41DA-A0E4-3570F2DB8D8E} => key removed successfully
                      C:\Windows\System32\Tasks\Microsoft\Office\OfficeT elemetryAgentLogOn2016 => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsof t\Office\OfficeTelemetryAgentLogOn2016 => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon{3C6655B 2-C4F1-48D6-8626-C00343860F72} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{3C6655B 2-C4F1-48D6-8626-C00343860F72} => key removed successfully
                      C:\Windows\System32\Tasks\NvProfileUpdaterOnLogon_ {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NvProfil eUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{4C62139 0-2ED0-4DC8-8214-3CC44517B6F5} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{4C62139 0-2ED0-4DC8-8214-3CC44517B6F5} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsof t\Windows\Application Experience\Microsoft Compatibility Appraiser => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon{545B86B 2-596D-4117-AB6D-E9F723D954F9} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{545B86B 2-596D-4117-AB6D-E9F723D954F9} => key removed successfully
                      C:\Windows\System32\Tasks\Microsoft\Office\OfficeB ackgroundTaskHandlerLogon => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsof t\Office\OfficeBackgroundTaskHandlerLogon => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon{6C64553 E-F232-4DE0-972A-F5275F25F314} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{6C64553 E-F232-4DE0-972A-F5275F25F314} => key removed successfully
                      C:\Windows\System32\Tasks\Microsoft\Office\Office Automatic Updates => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsof t\Office\Office Automatic Updates => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon{6F344BC 0-2C6B-4B4F-8420-06B6452BD820} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{6F344BC 0-2C6B-4B4F-8420-06B6452BD820} => key removed successfully
                      C:\Windows\System32\Tasks\Microsoft\Office\OfficeT elemetryAgentFallBack2016 => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsof t\Office\OfficeTelemetryAgentFallBack2016 => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon{7A18051 8-D8DF-41D3-8C8F-E1D26DA021C7} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{7A18051 8-D8DF-41D3-8C8F-E1D26DA021C7} => key removed successfully
                      C:\Windows\System32\Tasks\DllKitPRO => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DllKitPR O => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{9350ECA 1-A41C-4A0D-B77D-1A79EF41587F} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{9350ECA 1-A41C-4A0D-B77D-1A79EF41587F} => key removed successfully
                      C:\Windows\System32\Tasks\Overwolf Updater Task => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Overwolf Updater Task => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{CA7A9A3 C-D0EB-4DB4-BD2D-FB2E4D3A6DAC} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{CA7A9A3 C-D0EB-4DB4-BD2D-FB2E4D3A6DAC} => key removed successfully
                      C:\Windows\System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsof t\Office\Office ClickToRun Service Monitor => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{E8FDE3A E-AC85-4A31-9C6A-FEF251529C48} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{E8FDE3A E-AC85-4A31-9C6A-FEF251529C48} => key removed successfully
                      C:\Windows\System32\Tasks\Microsoft\Office\OfficeB ackgroundTaskHandlerRegistration => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsof t\Office\OfficeBackgroundTaskHandlerRegistration => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{F50F6D2 F-D9C1-4765-801D-ACFDDD8EEE31} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{F50F6D2 F-D9C1-4765-801D-ACFDDD8EEE31} => key removed successfully
                      C:\Windows\System32\Tasks\NvDriverUpdateCheckDaily _{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NvDriver UpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{F7833A2 D-DC5B-4F58-B533-AF4B948C8207} => key removed successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{F7833A2 D-DC5B-4F58-B533-AF4B948C8207} => key removed successfully
                      C:\Windows\System32\Tasks\NvProfileUpdaterDaily_{B 2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => moved successfully
                      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NvProfil eUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => key removed successfully
                      “C:\Program Files (x86)\DllKitPRO\dllkitpro.exe” => not found.
                      C:\ProgramData\DP45977C.lfl => moved successfully

                      ========= netsh advfirewall reset =========

                      Ok.

                      ========= End of CMD: =========

                      ========= netsh advfirewall set allprofiles state Off =========

                      Ok.

                      ========= End of CMD: =========

                      ========= ipconfig /flushdns =========

                      Windows IP Configuration

                      Successfully flushed the DNS Resolver Cache.

                      ========= End of CMD: =========

                      Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 21-09-2017 21:52:16)

                      Result of scheduled keys to remove after reboot:

                      HKLM\System\CurrentControlSet\Services\NAVENG => key could not remove. Access Denied.
                      HKLM\System\CurrentControlSet\Services\NAVEX15 => key could not remove. Access Denied.

                      ==== End of Fixlog 21:52:16 ====

                      Comment

                      • system
                        PCHF Owner
                        • Jan 2015
                        • 7634

                        #41
                        Originally posted by 10months
                        I haven’t done the telemetry removal, I don’t particularly mind it if it won’t cause any performance issues.
                        My Chrome extensions were removed with the fix, is it fine to reinstall them?
                        Hi 10months,
                        It’s your call but removing telemetry will reduce overhead, albeit small, and the less useless system resources you have running the better performance you will have.
                        Some Chrome extensions were removed due to security risk, again your call.

                        What games and apps no longer work?

                        Comment

                        • 10months
                          PCHF Member
                          • Aug 2017
                          • 23

                          #42
                          Of the games I’ve tried I’ve not encountered any more crashes . The framerates are a little bit dodgy, but apart from that it’s looking good.
                          There’s a couple of little annoyances still, like the .gif “class not registered” and the invalid windows key… But no, thanks so much for your help - in spite of me tampering with the logs and taking three days to reply to certain things (sorry again)
                          I’ll test a few more games tomorrow when I’m free all day, and hopefully mark it solved

                          Comment

                          • system
                            PCHF Owner
                            • Jan 2015
                            • 7634

                            #43
                            Hi 10months.
                            Firstly let’s clean up the tools used in removal of stuff from your pc, and please follow the instructions exactly.

                            Please go HERE and download Delfix Save it to your desktop.
                            Right click the new Delfix desktop icon [MEDIA=imgur]3gArQoZ[/MEDIA] and then click “run as administrator”
                            Place a tick in the following checkboxes
                            [ol]
                            [li]Remove disinfection tools[/li][li]Create registry backup[/li][li]Purge system restore[/li][li]Then select “Run”[/li][/ol]
                            [MEDIA=imgur]tdR6h0N[/MEDIA]

                            Delfix will remove the tools used to clean your PC and remove itself. When finished a .txt file will display on your desktop. A copy of this file will be also located as C:\Delfix.txt.

                            Please post a copy of this file in your next post:slight_smile:

                            Comment

                            • 10months
                              PCHF Member
                              • Aug 2017
                              • 23

                              #44
                              ~ Removing disinfection tools …

                              Deleted : C:\FRST
                              Deleted : C:\AdwCleaner
                              Deleted : C:\Users\Alex\Downloads\FRST-OlderVersion
                              Deleted : C:\Users\Alex\Desktop\JRT.txt
                              Deleted : C:\Users\Alex\Desktop\ZHPDiag.lnk
                              Deleted : C:\Users\Alex\Desktop\ZHPDiag.txt
                              Deleted : C:\Users\Alex\Desktop\ZHPFixReport.txt
                              Deleted : C:\Users\Alex\Downloads\Addition.txt
                              Deleted : C:\Users\Alex\Downloads\adwcleaner_7.0.2.1.exe
                              Deleted : C:\Users\Alex\Downloads\Fixlog.txt
                              Deleted : C:\Users\Alex\Downloads\FRST.txt
                              Deleted : C:\Users\Alex\Downloads\FRST64.exe
                              Deleted : C:\Users\Alex\Downloads\JRT.exe
                              Deleted : C:\Users\Alex\Downloads\zhpdiag3.exe
                              Deleted : C:\Users\Alex\Downloads\ZHPFix.exe

                              ~ Creating registry backup … OK

                              ~ Cleaning system restore …

                              Deleted : RP #44 [Windows Update | 09/17/2017 14:37:30]
                              Deleted : RP #45 [Windows Update | 09/18/2017 02:00:19]
                              Deleted : RP #46 [Windows Update | 09/19/2017 02:00:19]
                              Deleted : RP #47 [Windows Update | 09/20/2017 02:00:20]
                              Deleted : RP #48 [Windows Update | 09/21/2017 02:00:20]
                              Deleted : RP #50 [Restore Point Created by FRST | 09/21/2017 20:51:03]
                              Deleted : RP #51 [Windows Update | 09/22/2017 02:00:20]
                              Deleted : RP #52 [Windows Update | 09/23/2017 02:00:20]

                              New restore point created !

                              ########## - EOF - ##########

                              Comment

                              • system
                                PCHF Owner
                                • Jan 2015
                                • 7634

                                #45
                                OK, can you check what happens when you right click on a .gif file, and then click “Open with” Do you have any options?

                                [ATTACH]2876[/ATTACH]

                                Comment

                                Working...