Many games and apps broken

**10months** · 09-08-2017, 03:20 PM

Sorry for the response time. As it stands the install for nvidia is still failing the same way as always, that being the monitors losing connection and a sound similar to what it makes on a bluescreen. Have not yet tested any games, will do now, will post again or edit this if they work, if not I won’t.

JRT log (first one ran):

File System: 13

Successfully deleted: C:\Users\Dan\AppData\Roaming\3909 (Folder)
Successfully deleted: C:\Users\Dan\AppData\Local\Microsoft\Windows\Tempo rary Internet Files\Content.IE5\23XGC66Y (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Dan\AppData\Local\Microsoft\Windows\Tempo rary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Dan\AppData\Local\Microsoft\Windows\Tempo rary Internet Files\Content.IE5\84J2O671 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Dan\AppData\Local\Microsoft\Windows\Tempo rary Internet Files\Content.IE5\8EO9XVOP (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Dan\AppData\Local\Microsoft\Windows\Tempo rary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Dan\AppData\Local\Microsoft\Windows\Tempo rary Internet Files\Content.IE5\GS2931V0 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\23XGC66Y (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\84J2O671 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\8EO9XVOP (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\GS2931V0 (Temporary Internet Files Folder)

Registry: 1

Successfully deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Run \GoogleChromeAutoLaunch_AD2529C7DB5B63D28C23362385 276129 (Registry Value)

Rogue Killer log:
RogueKiller V12.11.13.0 (x64) [Sep 4 2017] (Free) by Adlice Software
mail : Support Form | Contact • Adlice Software
Feedback : https://forum.adlice.com
Website : Free Virus Cleaner | RogueKiller AntiMalware • Adlice Software
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Dan[Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Delete – Date : 09/08/2017 15:47:26 (Duration : 00:10:04)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 10 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.symantec.com/redirects/se...vid=22.6.0.142 → Replaced ( MSN )
[PUM.HomePage] (X86) HKEY_USERS.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.symantec.com/redirects/se...vid=22.6.0.142 → Replaced ( MSN )
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\Main | Start Page : C:\Program Files\Internet Explorer\pcspecialist.html → Replaced ( MSN )
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\Main | Start Page : C:\Program Files\Internet Explorer\pcspecialist.html → Replaced ( MSN )
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.symantec.com/redirects/se...vid=22.6.0.142 → Replaced ( MSN )
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.symantec.com/redirects/se...vid=22.6.0.142 → Replaced ( MSN )
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : C:\Program Files\Internet Explorer\pcspecialist.html → Replaced ( http://www.microsoft.com/isapi/redir...r=6&ar=msnhome )
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : C:\Program Files\Internet Explorer\pcspecialist.html → Replaced ( http://www.microsoft.com/isapi/redir...r=6&ar=msnhome )
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Advanced | Start_ShowMyGames : 0 → Replaced (1)
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Advanced | Start_ShowMyGames : 0 → Replaced (1)

¤¤¤ Tasks : 2 ¤¤¤
[Hj.Shortcut] {B28C17EA-9931-456C-BCA8-E7A7B96573AA} – “c:\program files (x86)\google\chrome\application\chrome.exe” ( https://ui.skype.com/ui/0/7.35.0.103...LastError=1601 ) → Deleted
[Hj.Shortcut] {DF1C8261-E1FE-4965-82AF-80E17E609D25} – “c:\program files (x86)\google\chrome\application\chrome.exe” ( https://ui.skype.com/ui/0/7.35.0.103...ll?page=tsMain ) → Deleted

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤
[PUM.HomePage][Chrome:Config] Default [SecurePrefs] : session.startup_urls [chrome://history/| https://www.youtube.com/feed/subscriptions|http://www.netflix.com/browse/|https://twitter.com/|(This bit was a homework website for my old school, with the name of the school and my name)] → Deleted

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: Samsung SSD 850 EVO 250G SCSI Disk Device +++++
— User —
[MBR] 445ece1ef00c4fea7064762733615a31
[BSP] 515c49d6bfb6bcdbd6dd3b39a751d596 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 6000 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 12290048 | Size: 232473 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 … OK
User = LL2 … OK

+++++ PhysicalDrive1: ST2000DM 001-1ER164 SCSI Disk Device +++++
— User —
[MBR] 69b904a40fa89ed5aa5551478168ff5b
[BSP] f8d1dc82b54682bb89bdb7ebae5a1b81 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1907727 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 … OK
User = LL2 … OK

Adware cleaner log:
[HEADING=1]Updated on 2017/29/08 by Malwarebytes[/HEADING]
[HEADING=1]Database: 09-01-2017.2[/HEADING]
[HEADING=1]Running on Windows 7 Professional (X64)[/HEADING]
[HEADING=1]Mode: scan[/HEADING]
[HEADING=1]Support: https://www.malwarebytes.com/support[/HEADING]
***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

PUP.Optional.Legacy, C:\Users\Alex\Documents\Product Key

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

PUP.Optional.Legacy, [Value] - HKCU\Software\Microsoft\Internet Explorer\SearchScopes | DoNotAskAgain
PUP.Optional.Legacy, [Value] - HKCU\Software\Microsoft\Internet Explorer\SearchScopes | DoNotAskAgain
PUP.Optional.Legacy, [Value] - HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\SearchScopes | DoNotAskAgain
PUP.Optional.Legacy, [Value] - HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\SearchScopes | DoNotAskAgain
PUP.Optional.Legacy, [Value] - HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\SearchScopes | DoNotAskAgain
PUP.Optional.Legacy, [Value] - HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\SearchScopes | DoNotAskAgain
PUP.Optional.Legacy, [Value] - HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes | DoNotAskAgain
PUP.Optional.Legacy, [Value] - HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes | DoNotAskAgain
PUP.Optional.SaferBrowser, [Key] - HKLM\SOFTWARE\Safer Technologies
PUP.Optional.SaferBrowser, [Key] - HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Safer Technologies
PUP.Optional.SaferBrowser, [Key] - HKCU\Software\Safer Technologies

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt ##########

**jmarket** · 09-10-2017, 02:15 AM

Hello 10months, my name is Gus and I’ll be helping out till Malnutrition is able to return. Thank you for your JRT, Rogue Killer and Adwcleaner logs, unfortunately the Adwcleaner log shows you have scanned only and not actually cleaned the items found. Can you please run Adwcleaner again following the instructions given remembering to use the clean button after scanning.

Have copied the instruction below for you

Adware Cleaner Scan.

Please download AdwCleaner by Malwarebytes onto your desktop.

[ul]
[li]Close all open programs and internet browsers.[/li][li]Double click on adwcleaner.exe to run the tool.[/li][li]Click on Scan button.[/li][li]When the scan has finished click on Clean button.[/li][li]Your computer will be rebooted automatically. A text file will open after the restart.[/li][li]Please post the contents of that logfile with your next reply.[/li][li]You can find the logfile at C:\AdwCleaner[S1].txt as well.[/li][/ul]
Thanks:thumbsup:

**10months** · 09-10-2017, 10:11 AM

Hi Gus, this time when run it didn’t find anything (“No unwanted element found!” “No malicious x found”), I think I might have hit clean after copying the log last time?

**jmarket** · 09-11-2017, 03:16 AM

Can you post the “Clean” log please?

You can find the logfile at C:\AdwCleaner[C1].txt as well.

**10months** · 09-11-2017, 06:42 AM

Most recent
[HEADING=1]AdwCleaner 7.0.2.1 - Logfile created on Sun Sep 10 10:02:44 2017[/HEADING]
[HEADING=1]Updated on 2017/29/08 by Malwarebytes[/HEADING]
[HEADING=1]Database: 09-08-2017.1[/HEADING]
[HEADING=1]Running on Windows 7 Professional (X64)[/HEADING]
[HEADING=1]Mode: scan[/HEADING]
[HEADING=1]Support: https://www.malwarebytes.com/support[/HEADING]
***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

C:/AdwCleaner/AdwCleaner[C0].txt - [2206 B] - [2017/9/8 15:4:51]
C:/AdwCleaner/AdwCleaner[S0].txt - [2203 B] - [2017/9/8 15:2:58]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt ##########

AdwCleaner[C0].txt (there is no C1)

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

Deleted: [Value] - HKCU\Software\Microsoft\Internet Explorer\SearchScopes|DoNotAskAgain
Deleted: [Value] - HKCU\Software\Microsoft\Internet Explorer\SearchScopes|DoNotAskAgain
Deleted: [Value] - HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\SearchScopes|DoNotAskAgain
Deleted: [Value] - HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\SearchScopes|DoNotAskAgain
Deleted: [Value] - HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\SearchScopes|DoNotAskAgain
Deleted: [Value] - HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\SearchScopes|DoNotAskAgain
Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|DoNotAskAgain
Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|DoNotAskAgain
Deleted: [Key] - HKLM\SOFTWARE\Safer Technologies
Deleted: [Key] - HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Safer Technologies
Deleted: [Key] - HKCU\Software\Safer Technologies

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

C:/AdwCleaner/AdwCleaner[S0].txt - [2203 B] - [2017/9/8 15:2:58]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

**jmarket** · 09-12-2017, 12:20 AM

Hi 10months and thank you for the Adwcleaner “clean” log. We now need you to remove some stuff the previous ZHPdiag log contained. Please follow the instructions below and post the log that the tool generates

Please go HERE and click the blue [MEDIA=imgur]fQO1SSi[/MEDIA] link (French for download) and save the file to your desktop.

Please note is it important to disable your antivirus before running this tool. If you are uncertain how to do this please ask?

Right click the desktop icon [MEDIA=imgur]h5QXsXi[/MEDIA] and choose “Run as Administrator”. You can safely ignore any security warnings when running this tool.

On the main interface select IMPORT

[MEDIA=imgur]I3yMa37[/MEDIA]

If a box appears similar to that below, click OK or just X out of it.

[MEDIA=imgur]v6smBPj[/MEDIA]

Copy the contents of the box below
Script Zhpfix
G0 - GCSP: Preferences [User Data\Default][HomePage] http://api.ciuvo.com =>PUP.Optional.PriceSparrow
[HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\E xplorer\Browser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] =>.SUP.Orphan
[HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\E xplorer\Browser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}] =>.SUP.Orphan
C:\Users\Dan\AppData\Roaming\OpenCandy =>Adware.OpenCandy
HKCU\Software\Microsoft\Internet Explorer\SearchScopes{E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} =>.SUP.AkamaiHD
HKLM64\Software\Microsoft\Internet Explorer\SearchScopes{E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} =>.SUP.AkamaiHD
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_battlefield-1942.en.softonic.com_0.localstorage =>.SUP.Softonic
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_battlefield-1942.en.softonic.com_0.localstorage-journal =>.SUP.Softonic
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_support.solvusoft.com_0.localstorage =>.SUP.Solvusoft
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_support.solvusoft.com_0.localstorage-journal =>.SUP.Solvusoft
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.putlocker-movies.cc_0.localstorage =>PUP.Optional.PutLocker
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.putlocker-movies.cc_0.localstorage-journal =>PUP.Optional.PutLocker
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_st.chatango.com_0.localstorage =>PUP.Optional.Chatango
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_st.chatango.com_0.localstorage-journal =>PUP.Optional.Chatango
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.putlocker-movies.cc_0.localstorage =>PUP.Optional.PutLocker
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.putlocker-movies.cc_0.localstorage-journal =>PUP.Optional.PutLocker
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.solvusoft.com_0.localstorage =>.SUP.Solvusoft
C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.solvusoft.com_0.localstorage-journal =>.SUP.Solvusoft
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\1916A2AF346D399F50313C393200F1414 0456616] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\2A83E9020591A55FC6DDAD3FB102794C5 2B24E70] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\2B84BFBB34EE2EF949FE1CBE30AA02641 6EB2216] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\305F8BD17AA2CBC483A4C41B19A39A0C7 5DA39D6] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\367D4B3B4FCBBC0B767B2EC0CDB2A36EA B71A4EB] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\3A850044D8A195CD401A680C012CB0A3B 5F8DC08] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\40AA38731BD189F9CDB5B9DC35E2136F3 8777AF4] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\43D9BCB568E039D073A74A71D8511F747 6089CC3] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\471C949A8143DB5AD5CDF1C972864A250 4FA23C9] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\51C3247D60F356C7CA3BAF4C3F429DAC9 3EE7B74] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\5DE83EE82AC5090AEA9D6AC4E7A6E213F 946E179] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\61793FCBFA4F9008309BBA5FF12D2CB29 CD4151A] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1 C52EAC6] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\63FEAE960BAA91E343CE2BD8B71798C76 BDB77D0] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\6431723036FD26DEA502792FA59592249 3030F97] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD7 8375931] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\80962AE4D6C5B442894E95A13E4A699E0 7D694CF] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\86E817C81A5CA672FE000F36F878C1951 8D6F844] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\8E5BD50D6AE686D65252F843A9D4B96D1 97730AB] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\9845A431D51959CAF225322B4A4FE9F22 3CE6D15] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\B533345D06F64516403C00DA03187D3BF EF59156] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\B86E791620F759F17B8D25E38CA8BE32E 7D5EAC2] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8 167478C] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\CEA586B2CE593EC7D939898337C578147 08AB2BE] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\D018B62DC518907247DF50925BB09ACF4 A5CB3AD] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\F8A54E03AADC5692B850496A4C4630FFE AA29D83] =>PUM.Misplaced.Certificate [Avast Software]
[HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\FA6660A94AB45F6A88C0D7874D89A863D 74DEE97] =>PUM.Misplaced.Certificate [Avast Software]
EmptyPrefetch
ShortcutFix
Emptytemp
EmptyClsid

And paste it into the blank ZHP Fix interface screen, then click GO.

[MEDIA=imgur]CiyzY6j[/MEDIA]

Accept the cleaning process by clicking “Oui” (yes)

http://i.imgur.com/qcen9tq.jpg

The cleanup will run and will again ask for permission to complete, again select “Oui”.

At the conclusion of cleaning a file notepad will open and be saved to your desktop. Please Copy and Paste the contents of this file in your next reply

**10months** · 09-13-2017, 10:59 PM

Sorry for slow response again

Rapport de ZHPFix 2017.06.13.1 par Nicolas Coolman, Update du 13/06/2017
Fichier d’export Registre :
Run by Alex at 13/09/2017 23:55:09
High Elevated Privileges : OK
Windows 7 Business Edition, 64-bit Service Pack 1 (Build 7601)

Recycle Bin emptied (00mn 04s)
Prefetcher emptied
Repair of browser shortcuts

========== Registry keys ==========
REMOVES: HKCU\Software\Microsoft\Internet Explorer\SearchScopes{E5C08DF4-F5F1-4F74-B779-C18750CDCC3F}
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\1916A2AF346D399F50313C393200F1414 0456616
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\2A83E9020591A55FC6DDAD3FB102794C5 2B24E70
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\2B84BFBB34EE2EF949FE1CBE30AA02641 6EB2216
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\305F8BD17AA2CBC483A4C41B19A39A0C7 5DA39D6
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\367D4B3B4FCBBC0B767B2EC0CDB2A36EA B71A4EB
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\3A850044D8A195CD401A680C012CB0A3B 5F8DC08
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\40AA38731BD189F9CDB5B9DC35E2136F3 8777AF4
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\43D9BCB568E039D073A74A71D8511F747 6089CC3
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\471C949A8143DB5AD5CDF1C972864A250 4FA23C9
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\51C3247D60F356C7CA3BAF4C3F429DAC9 3EE7B74
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\5DE83EE82AC5090AEA9D6AC4E7A6E213F 946E179
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\61793FCBFA4F9008309BBA5FF12D2CB29 CD4151A
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1 C52EAC6
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\63FEAE960BAA91E343CE2BD8B71798C76 BDB77D0
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\6431723036FD26DEA502792FA59592249 3030F97
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD7 8375931
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\80962AE4D6C5B442894E95A13E4A699E0 7D694CF
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\86E817C81A5CA672FE000F36F878C1951 8D6F844
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\8E5BD50D6AE686D65252F843A9D4B96D1 97730AB
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\9845A431D51959CAF225322B4A4FE9F22 3CE6D15
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\B533345D06F64516403C00DA03187D3BF EF59156
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\B86E791620F759F17B8D25E38CA8BE32E 7D5EAC2
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8 167478C
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\CEA586B2CE593EC7D939898337C578147 08AB2BE
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\D018B62DC518907247DF50925BB09ACF4 A5CB3AD
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\F8A54E03AADC5692B850496A4C4630FFE AA29D83
REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallo wed\Certificates\FA6660A94AB45F6A88C0D7874D89A863D 74DEE97

========== Preferences browser ==========
NOW Chrome File: C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Preferences
ABSENT Chrome Site: http://api.ciuvo.com

========== Folders ==========
No folders empty CLSID Local user

========== Files ==========
Deletes temporary Windows (14) (6,334,998 octets)

========== Other ==========
NON-TREATY [HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\E xplorer\Browser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
NON-TREATY [HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\E xplorer\Browser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
NON-TREATY [HKLM64\Software\Microsoft\Internet Explorer\SearchScopes{E5C08DF4-F5F1-4F74-B779-C18750CDCC3F}]

========== Summary ==========
28 : Registry keys
1 : Folders
1 : Files
2 : Preferences browser
3 : Other

End of clean in 00mn 06s

========== Path to file report ==========
C:\Users\Alex\AppData\Roaming\ZHP\ZHPFix[R1].txt - 13/09/2017 23:55:13 [4573]

**jmarket** · 09-14-2017, 12:44 AM

Hello 10months and thanks for the log. Can you now follow these instructions and post the 2 logs from this tool?

We need a log from Farbar Recovery Scan Tool (FRST) to examine your system.

Please download the FRST 32 bit or FRST 64bit version to suit your operating system. It is important FRST is downloaded to your desktop.

If you are unsure if your operating system is 32 or 64 Bit please go HERE.

Once downloaded right click the FRST desktop icon and select “Run as administrator” from the menu"

Forums - PC Help Forum

https://pchelpforum.net/attachments/icon2-jpg.112/

PCHF Forums

If you receive any security warnings, or the User Account Control warning opens at any time whilst using FRST you can safely allow FRST to proceed.
Frst will open with two dialogue boxes, accept the disclaimer.

Forums - PC Help Forum

https://pchelpforum.net/attachments/frst-disclaimer-jpg.113/

PCHF Forums

[ol]
[li]Accept the default whitelist options,[/li][li]If the additions.txt options box is not checked please select it. [/li]
[li]Then select “Scan”[/li][/ol]

Forums - PC Help Forum

https://pchelpforum.net/attachments/frst-jpg.114/

PCHF Forums

Frst will take a few minutes to scan your computer, and when finished will produce two log files on your desktop, FRST.txt, and Addition.txt. They will display immediately on the desktop, but can be reopened later as a notepad file.

Forums - PC Help Forum

https://pchelpforum.net/attachments/2016-08-12_152002-jpg.115/

PCHF Forums

Please COPY and PASTE the contents of these two files in your next post.

**10months** · 09-14-2017, 09:28 PM

FRST.txt
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-09-2017 01
Ran by Alex (administrator) on LUCY (14-09-2017 22:23:19)
Running from C:\Users\Alex\Downloads
Loaded Profiles: Alex (Available Profiles: Alex)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\ns.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
() C:\Windows\runSW.exe
() C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Realtek) C:\Windows\SwUSB.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.ex e
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64. exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\ns.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\Pres entationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Discord Inc.) C:\Users\Alex\AppData\Local\Discord\app-0.0.298\Discord.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Valve Corporation) E:\Steam\Steam.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
() E:\1A\TWCU.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Discord Inc.) C:\Users\Alex\AppData\Local\Discord\app-0.0.298\Discord.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Discord Inc.) C:\Users\Alex\AppData\Local\Discord\app-0.0.298\Discord.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7611608 2014-05-27] (Realtek Semiconductor)
HKLM...\Run: [ShadowPlay] => “C:\Windows\system32\rundll32.exe” C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSyst emStart
HKLM...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)
HKLM-x32...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2383040 2016-08-24] (Adobe Systems Incorporated)
HKLM-x32...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-21] (Oracle Corporation)
HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Run: [Discord] => C:\Users\Alex\AppData\Local\Discord\app-0.0.298\Discord.exe [57477112 2017-08-08] (Discord Inc.)
HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27716568 2017-05-04] (Skype Technologies S.A.)
HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Run: [Steam] => E:\Steam\steam.exe [3071776 2017-09-07] (Valve Corporation)
HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Run: [GoogleChromeAutoLaunch_AD2529C7DB5B63D28C233623852 76129] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1301848 2017-08-23] (Google Inc.)
HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Configuration Utility.lnk [2015-09-23]
ShortcutTarget: TP-LINK Wireless Configuration Utility.lnk → E:\TWCU.exe (No File)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip..\Interfaces{D6FE7615-E3F4-4DBD-B664-C7231B00AA05}: [DhcpNameServer] 192.168.0.5
Tcpip..\Interfaces{DE19D148-F66E-4E70-9848-0E911A76D5E4}: [DhcpNameServer] 192.168.1.254
[HEADING=1]Internet Explorer:[/HEADING]
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
SearchScopes: HKLM → DefaultScope {E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQxcUwFIFAEUbQsNVFxcFQATIRRZA FtDDAxFcg4PWV1HEAIVdB9aFQQTSEcFME0FCFwEURNNfWtdEkw dVUZrNVs=&q={searchTerms}
SearchScopes: HKLM → OldSearch URL = hxxp://uk.yhs4.search.yahoo.com/yhs/search?hspart=appattach&hsimp=yhs-appattach&type=493&p={searchTerms}
SearchScopes: HKLM → {E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQxcUwFIFAEUbQsNVFxcFQATIRRZA FtDDAxFcg4PWV1HEAIVdB9aFQQTSEcFME0FCFwEURNNfWtdEkw dVUZrNVs=&q={searchTerms}
SearchScopes: HKLM-x32 → DefaultScope {E5C08DF4-F5F1-4F74-B779-C18750CDCC3F} URL =
SearchScopes: HKU\S-1-5-21-630333582-4039751370-1614634531-1000 → OldSearch URL =
SearchScopes: HKU\S-1-5-21-630333582-4039751370-1614634531-1000 → {A6A1D0B1-E2C0-425C-9FA5-600268E3E449} URL = hxxp://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=bl-bir-dd__alt__ddc_dss_bd_com&p={searchTerms}
BHO: Lync Browser Helper → {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} → C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-09-03] (Microsoft Corporation)
BHO: Norton Identity Safety → {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} → C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\coIEPlg.dll [2017-08-24] (Symantec Corporation)
BHO: Java™ Plug-In SSV Helper → {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} → C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll [2017-08-14] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper → {9030D464-4C02-4ABF-8ECC-5164760863C6} → C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler → {B4F3A835-0E21-4959-BA22-42B3008E02FF} → C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2017-09-03] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper → {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} → C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-09-03] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper → {DBC80044-A445-435b-BC74-9C25C1C588A9} → C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-08-14] (Oracle Corporation)
BHO-x32: Lync Browser Helper → {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} → C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-09-03] (Microsoft Corporation)
BHO-x32: Norton Identity Safety → {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} → C:\Program Files (x86)\Norton Security\Engine32\22.10.1.10\coIEPlg.dll [2017-08-24] (Symantec Corporation)
BHO-x32: Windows Live ID Sign-in Helper → {9030D464-4C02-4ABF-8ECC-5164760863C6} → C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler → {B4F3A835-0E21-4959-BA22-42B3008E02FF} → C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2017-09-03] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper → {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} → C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-09-03] (Microsoft Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\coIEPlg.dll [2017-08-24] (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine32\22.10.1.10\coIEPlg.dll [2017-08-24] (Symantec Corporation)
Toolbar: HKU\S-1-5-21-630333582-4039751370-1614634531-1000 → Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\coIEPlg.dll [2017-08-24] (Symantec Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-03] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-03] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-03] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-03] (Microsoft Corporation)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-12-10] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-12-10] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-12-10] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-12-10] (Microsoft Corporation)
[HEADING=1]FireFox:[/HEADING]
FF DefaultProfile: h90wxnqo.default
FF ProfilePath: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Prof iles\h90wxnqo.default [2017-09-07]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\h90wxnqo.default → Bing
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\h90wxnqo.default → Bing
FF SearchEngineOrder.3: Mozilla\Firefox\Profiles\h90wxnqo.default → Bing
FF Keyword.URL: Mozilla\Firefox\Profiles\h90wxnqo.default → hxxp://www.bing.com/search?FORM=SK216DF&PC=SK216&q=
FF Homepage: Mozilla\Firefox\Profiles\h90wxnqo.default → hxxp://www.msn.com/?pc=SK216&ocid=SK216DHP&osmkt=en-gb
FF Extension: (Bing Search) - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Prof iles\h90wxnqo.default\Extensions\bingsearch.full@microsoft.com.xpi [2016-11-23]
FF SearchPlugin: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Prof iles\h90wxnqo.default\searchplugins\bing-.xml [2016-11-23]
FF HKLM...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.6.0.142\coFFAddon
FF Extension: (Norton Security Toolbar) - C:\ProgramData\Norton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.6.0.142\coFFAddon [2017-09-05]
FF HKLM-x32...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.6.0.142\coFFAddon
FF Plugin: @java.com/DTPlugin,version=11.144.2 → C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1 .dll [2017-08-14] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.144.2 → C:\Program Files\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-08-14] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE → disabled [No File]
FF Plugin: adobe.com/AdobeAAMDetect → C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-08-24] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer → C:\Windows\system32\Macromed\Flash\NPSWF32.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE → disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 → C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-09-03] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 → C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-09-03] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 → C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 → C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-08-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 → C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-08-11] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect → C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-08-24] (Adobe Systems)
FF Plugin HKU\S-1-5-21-630333582-4039751370-1614634531-1000: SkypePlugin → C:\Users\Alex\AppData\Local\SkypePlugin\7.27.0.105 \npGatewayNpapi.dll [2016-10-20] (Skype Technologies S.A.)
FF Plugin HKU\S-1-5-21-630333582-4039751370-1614634531-1000: SkypePlugin64 → C:\Users\Alex\AppData\Local\SkypePlugin\7.27.0.105 \npGatewayNpapi-x64.dll [2016-10-20] (Skype Technologies S.A.)
[HEADING=1]Chrome:[/HEADING]
CHR DefaultProfile: Default
CHR RestoreOnStartup: Default → “hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRggWJAsAWAxFFhgRdQxdTA1EEVQOIVhaU xRIRwcUdwFcVwhGFwEFIk0FA1oDB0VXfV5bFElXTwhxJUpNDU0 CaUBB”
CHR StartupUrls: Default → “chrome://history/”,“hxxps://www.youtube.com/feed/subscriptions”,“hxxp://www.netflix.com/browse/”,“hxxps://twitter.com/”,“hxxp://www.schoolplannerbook.com/tanbridge/homework/?email=12afarr%40ths.uk.net&action=homeworkfromema il&view=due&as=list”,“hxxp://vle.ths.uk.net/”
CHR Profile: C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default [2017-09-14]
CHR Extension: (Google Docs) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfi lokake [2017-08-13]
CHR Extension: (Google Drive) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigk jlhalf [2017-08-13]
CHR Extension: (Skype Calling) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blakpkgjpemejpbmfiglncklih nhjkij [2017-08-13]
CHR Extension: (YouTube) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldk acnbeo [2017-08-13]
CHR Extension: (Norton Security Toolbar) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjabmdjcfcfdmffimndhafhblf mpjdpe [2017-09-05]
CHR Extension: (Google Search) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljnie djpjpf [2017-08-13]
CHR Extension: (ZenMate VPN - Best Cyber Security & Unblock) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfo mcebme [2017-08-13]
CHR Extension: (Google Docs Offline) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdl olhkhi [2017-08-13]
CHR Extension: (AdBlock) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbi glidom [2017-08-13]
CHR Extension: (Norton Identity Safe) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdal ibjnif [2017-08-13]
CHR Extension: (Skype) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfg npldfl [2017-08-13]
CHR Extension: (Take Webpage Screenshots Entirely - FireShot) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbpblocgmgfnpjjppndjkmgja ogfceg [2017-08-29]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccm gmieda [2017-08-25]
CHR Extension: (Gmail) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoe jaedia [2017-08-13]
CHR Extension: (Chrome Media Router) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcj beemfm [2017-08-13]
CHR HKLM...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\Exts\Chrome.crx
CHR HKLM...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\Exts\Chrome.crx
CHR HKLM-x32...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [744640 2016-08-24] (Adobe Systems Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2246256 2017-05-18] (Adobe Systems, Incorporated)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1517576 2017-04-18] ()
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [4424384 2017-08-28] (Microsoft Corporation)
S3 IEEtwCollectorService; C:\Windows\system32\IEEtwCollector.exe [116224 2017-07-14] (Microsoft Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation)
R2 NS; C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\NS.exe [326144 2017-08-24] (Symantec Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation)
S2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Containe r.exe [462784 2017-08-09] () [File not signed]
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833360 2015-03-13] (NVIDIA Corporation)
S3 Origin Client Service; E:\Origin\OriginClientService.exe [2142728 2016-10-26] (Electronic Arts)
S2 Origin Web Helper Service; E:\Origin\OriginWebHelperService.exe [2209296 2016-10-26] (Electronic Arts)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1450824 2017-09-10] (Overwolf LTD)
R2 RunSwUSB; C:\Windows\runSW.exe [48856 2013-10-18] ()
R2 TunnelBearMaintenance; C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe [39424 2016-02-10] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [36608 2013-12-13] (Advanced Micro Devices, Inc.)
R1 BHDrvx64; C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\BASHDef s\20170906.001\BHDrvx64.sys [1862816 2017-08-07] (Symantec Corporation)
R1 ccSet_NS; C:\Windows\system32\drivers\NSx64\160A010.00A\ccSe tx64.sys [187520 2017-07-14] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [508032 2017-08-12] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [158336 2017-08-12] (Symantec Corporation)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2014-04-11] (Intel Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\IPSDefs \20170909.001\IDSvia64.sys [1056920 2017-09-01] (Symantec Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-03-13] (NVIDIA Corporation)
S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2015-03-13] (NVIDIA Corporation)
S3 RdpVideoMiniport; C:\Windows\System32\drivers\rdpvideominiport.sys [19456 2013-08-30] (Microsoft Corporation) [File not signed]
R3 RtlWlanu; C:\Windows\System32\DRIVERS\rtwlanu.sys [2978520 2013-11-14] (Realtek Semiconductor Corporation )
S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [12464 2015-10-31] (Macrovision Europe Ltd) [File not signed]
R3 SRTSP; C:\Windows\System32\Drivers\NSx64\160A010.00A\SRTS P64.SYS [810136 2017-07-14] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NSx64\160A010.00A\SRTS PX64.SYS [49304 2017-07-14] (Symantec Corporation)
R0 SymEFASI; C:\Windows\System32\drivers\NSx64\160A010.00A\SYME FASI64.SYS [1868416 2017-07-14] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [102568 2017-09-04] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NSx64\160A010.00A\Iron x64.SYS [301288 2017-07-14] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NSx64\160A010.00A\SYMN ETS.SYS [566912 2017-07-14] (Symantec Corporation)
S3 terminpt; C:\Windows\system32\drivers\terminpt.sys [29696 2013-08-30] (Microsoft Corporation) [File not signed]
S3 NAVENG; ??\C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\SDSDefs \20170903.001\NAVENG.SYS
S3 NAVEX15; ??\C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\SDSDefs \20170903.001\NAVEX15.SYS
S4 NVHDA; system32\drivers\nvhda64v.sys

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-09-14 22:23 - 2017-09-14 22:23 - 000025397 _____ C:\Users\Alex\Downloads\FRST.txt
2017-09-14 22:22 - 2017-09-14 22:23 - 000000000 ____D C:\FRST
2017-09-14 22:21 - 2017-09-14 22:21 - 002398208 _____ (Farbar) C:\Users\Alex\Downloads\FRST64.exe
2017-09-14 21:29 - 2017-09-14 21:29 - 000000000 ____D C:\Windows\System32\Tasks\Remediation
2017-09-13 23:55 - 2017-09-13 23:55 - 000004652 _____ C:\Users\Alex\Desktop\ZHPFixReport.txt
2017-09-13 23:50 - 2017-09-13 23:50 - 000417344 _____ C:\Windows\Minidump\091317-6692-01.dmp
2017-09-13 23:43 - 2017-09-13 23:43 - 000000000 ____D C:\Users\Alex\Downloads\Quarantine
2017-09-13 23:42 - 2017-09-13 23:42 - 003061760 _____ (Nicolas Coolman) C:\Users\Alex\Downloads\ZHPFix.exe
2017-09-13 03:05 - 2017-08-19 16:28 - 000197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2017-09-13 03:05 - 2017-08-19 16:10 - 000180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2017-09-13 03:05 - 2017-08-16 16:29 - 000806912 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-09-13 03:05 - 2017-08-16 16:10 - 000629760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2017-09-13 03:05 - 2017-08-16 15:57 - 003224576 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-09-13 03:05 - 2017-08-15 16:29 - 014182400 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-09-13 03:05 - 2017-08-15 16:29 - 001867264 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-09-13 03:05 - 2017-08-15 16:10 - 012880896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-09-13 03:05 - 2017-08-15 16:10 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2017-09-13 03:05 - 2017-08-14 18:35 - 003203584 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
2017-09-13 03:05 - 2017-08-14 18:35 - 002150912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcndmgr.dll
2017-09-13 03:05 - 2017-08-14 18:35 - 000355328 _____ (Microsoft Corporation) C:\Windows\system32\mmcbase.dll
2017-09-13 03:05 - 2017-08-14 18:35 - 000303104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcbase.dll
2017-09-13 03:05 - 2017-08-14 18:35 - 000172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cic.dll
2017-09-13 03:05 - 2017-08-14 18:35 - 000131072 _____ (Microsoft Corporation) C:\Windows\system32\mmcshext.dll
2017-09-13 03:05 - 2017-08-14 18:35 - 000128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcshext.dll
2017-09-13 03:05 - 2017-08-14 18:34 - 000211968 _____ (Microsoft Corporation) C:\Windows\system32\cic.dll
2017-09-13 03:05 - 2017-08-13 22:37 - 002144256 _____ (Microsoft Corporation) C:\Windows\system32\mmc.exe
2017-09-13 03:05 - 2017-08-13 22:30 - 001401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmc.exe
2017-09-13 03:05 - 2017-08-11 07:42 - 000631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-09-13 03:05 - 2017-08-11 07:38 - 005547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-09-13 03:05 - 2017-08-11 07:38 - 000706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-09-13 03:05 - 2017-08-11 07:38 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-09-13 03:05 - 2017-08-11 07:38 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-09-13 03:05 - 2017-08-11 07:36 - 001732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 002065408 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000757248 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000346112 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000313856 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\nsisvc.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\winnsi.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-09-13 03:05 - 2017-08-11 07:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\nsi.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000971776 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000166400 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:24 - 004001000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-09-13 03:05 - 2017-08-11 07:24 - 003945704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-09-13 03:05 - 2017-08-11 07:21 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-09-13 03:05 - 2017-08-11 07:20 - 000071680 _____ C:\Windows\system32\PrintBrmUi.exe
2017-09-13 03:05 - 2017-08-11 07:20 - 000061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
2017-09-13 03:05 - 2017-08-11 07:20 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe
2017-09-13 03:05 - 2017-08-11 07:19 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000299008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winnsi.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nsi.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 07:12 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2017-09-13 03:05 - 2017-08-11 07:09 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe
2017-09-13 03:05 - 2017-08-11 07:07 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 03:05 - 2017-08-11 07:07 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-09-13 03:05 - 2017-08-11 07:07 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 03:05 - 2017-08-11 07:06 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-09-13 03:05 - 2017-08-11 07:03 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-09-13 03:05 - 2017-08-11 07:03 - 000026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2017-09-13 03:05 - 2017-08-11 07:02 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-09-13 03:05 - 2017-08-11 07:01 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2017-09-13 03:05 - 2017-08-11 07:00 - 000262656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2017-09-13 03:05 - 2017-08-11 07:00 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-09-13 03:05 - 2017-08-11 07:00 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-09-13 03:05 - 2017-08-11 06:59 - 000460800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-09-13 03:05 - 2017-08-11 06:59 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-09-13 03:05 - 2017-08-11 06:59 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-09-13 03:05 - 2017-08-11 06:59 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-09-13 03:05 - 2017-08-11 06:59 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-09-13 03:05 - 2017-08-11 06:58 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-09-13 03:05 - 2017-08-11 06:58 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-09-13 03:05 - 2017-08-11 06:58 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nsiproxy.sys
2017-09-13 03:05 - 2017-08-11 06:56 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-09-13 03:05 - 2017-08-11 06:56 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-09-13 03:05 - 2017-08-11 06:56 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-09-13 03:05 - 2017-08-11 06:56 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-09-13 03:05 - 2017-08-11 06:55 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-09-13 03:05 - 2017-08-11 06:55 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 06:55 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 06:55 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 03:05 - 2017-08-11 06:55 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-09-13 03:05 - 2017-07-07 16:29 - 001143296 _____ (Microsoft Corporation) C:\Windows\system32\DXPTaskRingtone.dll
2017-09-13 03:05 - 2017-07-07 16:10 - 000973312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DXPTaskRingtone.dll
2017-09-11 07:41 - 2017-09-11 07:41 - 000000000 ____D C:\Windows\System32\Tasks\Norton Security
2017-09-11 07:35 - 2017-09-11 07:35 - 000417368 _____ C:\Windows\Minidump\091117-6676-01.dmp
2017-09-11 07:35 - 2017-09-11 07:35 - 000003218 _____ C:\Windows\System32\Tasks\Norton WSC Integration
2017-09-10 23:40 - 2017-09-10 23:40 - 001422530 _____ C:\Users\Alex\Documents\STARTING WITH CONFIDENCE 2017 final.pdf
2017-09-10 20:39 - 2017-09-10 20:39 - 000037726 _____ C:\Users\Alex\Documents\Student Timetable SY170200.pdf
2017-09-09 22:11 - 2017-09-09 22:11 - 000000000 ____D C:\Users\Alex\Documents\Fear Equation
2017-09-09 22:11 - 2017-09-09 22:11 - 000000000 ____D C:\Users\Alex\AppData\LocalLow\Screwfly Studios
2017-09-09 20:13 - 2017-09-09 20:13 - 000417384 _____ C:\Windows\Minidump\090917-6723-01.dmp
2017-09-09 10:52 - 2017-09-09 10:52 - 000037726 _____ C:\Users\Alex\Downloads\Student Timetable SY170200.pdf
2017-09-08 16:02 - 2017-09-10 11:08 - 000000000 ____D C:\AdwCleaner
2017-09-08 16:01 - 2017-09-08 16:01 - 008182736 _____ (Malwarebytes) C:\Users\Alex\Downloads\adwcleaner_7.0.2.1.exe
2017-09-08 15:58 - 2017-09-08 15:58 - 000009674 _____ C:\Users\Alex\Documents\roguekiller.txt
2017-09-08 15:47 - 2017-09-08 15:47 - 000028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-09-08 15:45 - 2017-09-08 15:59 - 000000000 ____D C:\ProgramData\RogueKiller
2017-09-08 15:44 - 2017-09-08 15:44 - 035802208 _____ (Adlice Software ) C:\Users\Alex\Downloads\setup.exe
2017-09-08 13:04 - 2017-09-08 13:04 - 000000000 ____D C:\Users\Alex\AppData\Roaming\3909
2017-09-08 12:45 - 2017-09-13 23:50 - 1771412084 _____ C:\Windows\MEMORY.DMP
2017-09-08 12:43 - 2017-08-10 01:22 - 009982968 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvptxJitCompiler.dll
2017-09-08 12:43 - 2017-08-10 01:22 - 000578056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvfatbinaryLoader.dll
2017-09-08 12:43 - 2017-08-10 01:22 - 000000669 _____ C:\Windows\SysWOW64\nv-vk32.json
2017-09-08 12:39 - 2017-09-08 12:54 - 000002733 _____ C:\Users\Alex\Desktop\JRT.txt
2017-09-08 12:36 - 2017-09-08 12:36 - 001790024 _____ (Malwarebytes) C:\Users\Alex\Downloads\JRT.exe
2017-09-05 13:01 - 2017-09-05 13:01 - 000176813 _____ C:\Users\Alex\Documents\ZHPDiag.txt
2017-09-05 12:51 - 2017-09-05 12:51 - 000177419 _____ C:\Users\Alex\Desktop\ZHPDiag.txt
2017-09-05 12:48 - 2017-09-13 23:55 - 000000000 ____D C:\Users\Alex\AppData\Roaming\ZHP
2017-09-05 12:48 - 2017-09-05 12:49 - 000000000 ____D C:\Users\Alex\AppData\Local\ZHP
2017-09-05 12:48 - 2017-09-05 12:48 - 002831744 _____ C:\Users\Alex\Downloads\zhpdiag3.exe
2017-09-05 12:48 - 2017-09-05 12:48 - 000000788 _____ C:\Users\Alex\Desktop\ZHPDiag.lnk
2017-08-31 00:01 - 2017-08-31 00:01 - 005916576 _____ C:\Users\Alex\Downloads\econ around you - intro to econ vle.pptx
2017-08-30 13:23 - 2017-08-30 13:23 - 000993632 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2017-08-30 13:23 - 2017-08-30 13:23 - 000987840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2017-08-30 13:23 - 2017-08-30 13:23 - 000690008 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2017-08-30 13:23 - 2017-08-30 13:23 - 000485576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
2017-08-29 18:33 - 2017-08-29 18:33 - 000000000 ____D C:\Users\Alex\Documents\Warm Lamp Games
2017-08-20 22:13 - 2017-08-20 22:13 - 000094696 _____ C:\Windows\ntbtlog.txt
2017-08-18 15:33 - 2017-08-18 15:33 - 000001144 _____ C:\Users\Alex\Documents\EUVC list.txt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-09-14 22:20 - 2017-08-13 19:15 - 000000000 ____D C:\ProgramData\NVIDIA
2017-09-14 22:20 - 2015-09-23 17:35 - 000000000 ____D C:\Users\Alex\AppData\Roaming\Skype
2017-09-14 22:20 - 2015-09-23 02:28 - 000000000 __SHD C:\Users\Alex\IntelGraphicsProfiles
2017-09-14 22:19 - 2009-07-14 05:45 - 000035312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-09-14 22:19 - 2009-07-14 05:45 - 000035312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-09-14 21:28 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\rescache
2017-09-14 21:07 - 2009-07-14 06:13 - 000781298 _____ C:\Windows\system32\PerfStringBackup.INI
2017-09-14 21:07 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
2017-09-14 21:03 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-09-14 21:03 - 2009-07-14 05:45 - 005049072 _____ C:\Windows\system32\FNTCACHE.DAT
2017-09-13 23:53 - 2017-08-11 12:36 - 000000000 ____D C:\Users\Alex\AppData\Roaming\discord
2017-09-13 23:50 - 2017-08-14 15:12 - 000000000 ____D C:\Windows\Minidump
2017-09-13 18:16 - 2015-12-06 18:16 - 000000000 ____D C:\Program Files (x86)\Overwolf
2017-09-13 11:47 - 2016-02-29 02:41 - 000000000 ____D C:\Program Files (x86)\TunnelBear
2017-09-12 17:07 - 2015-09-24 17:53 - 000000000 ____D C:\Users\Alex\AppData\Local\ElevatedDiagnostics
2017-09-11 08:01 - 2016-04-23 15:45 - 000000000 ____D C:\Program Files\Common Files\AV
2017-09-11 07:35 - 2016-04-23 15:44 - 000002308 _____ C:\Users\Public\Desktop\Norton Security.lnk
2017-09-11 07:35 - 2016-04-23 15:44 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security
2017-09-11 07:35 - 2016-04-23 15:44 - 000000000 ____D C:\Windows\system32\Drivers\NSx64
2017-09-08 16:07 - 2016-10-10 16:48 - 000000000 ____D C:\Users\Alex\AppData\Local\CrashDumps
2017-09-08 12:49 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\system32\NDF
2017-09-05 12:19 - 2015-09-18 22:28 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2017-09-04 03:38 - 2016-04-23 15:44 - 000102568 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2017-09-04 03:38 - 2016-04-23 15:44 - 000008309 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2017-09-03 13:19 - 2015-09-18 22:28 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-08-29 01:36 - 2017-08-11 12:30 - 000002212 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-08-29 01:36 - 2017-08-11 12:30 - 000002200 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-08-26 21:20 - 2017-08-13 20:01 - 001281162 ____N C:\Windows\Minidump\082617-6957-01.dmp
2017-08-18 01:22 - 2009-07-14 06:09 - 000000000 ____D C:\Windows\System32\Tasks\WPD
2017-08-17 23:34 - 2015-12-06 18:16 - 000000000 ____D C:\Users\Alex\AppData\Roaming\TS3Client
2017-08-17 03:44 - 2015-09-26 23:06 - 000000000 ____D C:\Users\Alex\AppData\Local\Ubisoft Game Launcher
2017-08-16 21:21 - 2016-02-06 22:09 - 000000000 ____D C:\Users\Alex\Documents\Bandicam

==================== Files in the root of some directories =======

2017-08-13 19:15 - 2017-08-13 19:15 - 000000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-09-12 16:06

==================== End of FRST.txt ============================
[HEADING=1]Addition.txt
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-09-2017 01
Ran by Alex (14-09-2017 22:23:33)
Running from C:\Users\Alex\Downloads
Windows 7 Professional Service Pack 1 (X64) (2017-08-13 18:40:16)
Boot Mode: Normal[/HEADING]
==================== Accounts: =============================

Administrator (S-1-5-21-630333582-4039751370-1614634531-500 - Administrator - Disabled)
Alex (S-1-5-21-630333582-4039751370-1614634531-1000 - Administrator - Enabled) => C:\Users\Alex
Guest (S-1-5-21-630333582-4039751370-1614634531-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton Security (Enabled - Up to date) {30744133-1E94-7B35-F4A3-82A5AEF1CBAA}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Security (Enabled - Up to date) {8B15A0D7-38AE-74BB-CE13-B9D7D5768117}
FW: Norton Security (Enabled) {084FC016-54FB-7A6D-DFFC-2B9050228CD1}

==================== Installed Programs ======================

(Only the adware programs with “Hidden” flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

A Game of Thrones version 1.2 (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...{7C82709E-75FE-4C3A-976A-8C97908DDD7B}_is1) (Version: 1.2 - AGOT TEAM)
Adobe AIR (HKLM-x32...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32...\Adobe Creative Cloud) (Version: 3.8.0.310 - Adobe Systems Incorporated)
Adobe Flash Player Plugin (HKLM-x32...\Adobe Flash Player Plugin) (Version: 9.0.124.0 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8C E.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Photoshop CS6 version 13.0.1 (HKLM-x32...{A724DC44-6241-42D3-BA57-778B178ABC17}_is1) (Version: 13.0.1 - Adobe Systems, Inc.)
Age of Empires® III: Complete Collection (HKLM-x32...\Steam App 105450) (Version: - Ensemble Studios)
Alien: Isolation (HKLM-x32...\Steam App 214490) (Version: - Creative Assembly)
American Truck Simulator (HKLM...\Steam App 270880) (Version: - SCS Software)
Ansel (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Ansel) (Version: 378.66 - NVIDIA Corporation) Hidden
ARK: Survival Evolved (HKLM...\Steam App 346110) (Version: - Studio Wildcard)
ARK: Survival Evolved (HKLM-x32...\Steam App 346110) (Version: - Studio Wildcard)
Arma 3 (HKLM...\Steam App 107410) (Version: - Bohemia Interactive)
Assassin’s Creed III (HKLM-x32...\Uplay Install 54) (Version: - Ubisoft)
Assassin’s Creed IV Black Flag (HKLM...\Steam App 242050) (Version: - Ubisoft Montreal)
Astroloco: Worst Contact (HKLM...\Steam App 357490) (Version: - Hungry Planet Games)
Audacity 2.1.2 (HKLM-x32...\Audacity®_is1) (Version: 2.1.2 - Audacity Team)
Audiosurf (HKLM...\Steam App 12900) (Version: - Dylan Fitterer)
Audiosurf 2 (HKLM...\Steam App 235800) (Version: - Dylan Fitterer)
Bandicam (HKLM-x32...\Bandicam) (Version: 3.0.2.1014 - Bandisoft.com)
Bandisoft MPEG-1 Decoder (HKLM-x32...\BandiMPEG1) (Version: - Bandisoft.com)
Banished (HKLM...\Steam App 242920) (Version: - Shining Rock Software LLC)
Batman: Arkham City GOTY (HKLM-x32...\Steam App 200260) (Version: - Rocksteady Studios)
Battlefield 1942 (HKLM-x32...{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}) (Version: - )
Battlefield 1942: Secret Weapons of WWII (HKLM-x32...{B73B4A99-4173-4747-BBEC-0F05E966F9D2}) (Version: - )
Battlefield 1942: The Road To Rome (HKLM-x32...{D057AA08-8CBF-42E3-9EAB-23B8FED1C279}) (Version: - )
Beholder (HKLM...\Steam App 475550) (Version: - Warm Lamp Games)
Besiege (HKLM-x32...\Steam App 346010) (Version: - Spiderling Studios)
Betrayer (HKLM-x32...\Steam App 243120) (Version: - Blackpowder Games)
BioShock Infinite (HKLM-x32...\Steam App 8870) (Version: - Irrational Games)
Blackwake (HKLM...\Steam App 420290) (Version: - Mastfire Studios Pty Ltd)
Borderlands 2 (HKLM-x32...\Steam App 49520) (Version: - Gearbox Software)
Braid (HKLM...\Steam App 26800) (Version: - Number None)
Broforce (HKLM-x32...\Steam App 274190) (Version: - Free Lives)
Call of Duty: Black Ops II - Multiplayer (HKLM-x32...\Steam App 202990) (Version: - Treyarch)
Call of Duty: Black Ops II - Zombies (HKLM-x32...\Steam App 212910) (Version: - )
Call of Duty: Black Ops II (HKLM-x32...\Steam App 202970) (Version: - Treyarch)
Call of Duty: Modern Warfare 2 - Multiplayer (HKLM-x32...\Steam App 10190) (Version: - Infinity Ward)
Call of Duty: Modern Warfare 2 (HKLM-x32...\Steam App 10180) (Version: - Infinity Ward)
Call of Juarez Gunslinger (HKLM-x32...\Steam App 204450) (Version: - Techland)
Chivalry: Medieval Warfare (HKLM-x32...\Steam App 219640) (Version: - Torn Banner Studios)
Cities: Skylines (HKLM-x32...\Steam App 255710) (Version: - Colossal Order Ltd.)
Clustertruck (HKLM...\Steam App 397950) (Version: - Landfall)
Counter-Strike: Global Offensive (HKLM-x32...\Steam App 730) (Version: - Valve)
Counter-Strike: Source (HKLM-x32...\Steam App 240) (Version: - Valve)
Crusader Kings II (HKLM...\Steam App 203770) (Version: - Paradox Development Studio)
D3DX10 (HKLM-x32...{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Darkest Dungeon (HKLM-x32...\Steam App 262060) (Version: - Red Hook Studios)
Darksiders (HKLM-x32...\Steam App 50620) (Version: - Vigil Games)
DarksidersInstaller (HKLM-x32...{B93EEE50-9C8F-45DF-95E4-3D85A6E242F3}) (Version: 1.00.1000 - THQ)
DarthMod: Shogun II (HKLM-x32...\DarthMod: Shogun II) (Version: - )
DEFCON (HKLM...\Steam App 1520) (Version: - Introversion Software)
Democracy 3 (HKLM...\Steam App 245470) (Version: - Positech Games)
Depth (HKLM-x32...\Steam App 274940) (Version: - Digital Confectioners)
Discord (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Discord) (Version: 0.0.298 - Discord Inc.)
Dishonored 2 (HKLM...\Steam App 403640) (Version: - Arkane Studios)
Domina (HKLM...\Steam App 535230) (Version: - DolphinBarn)
DOOM (HKLM...\Steam App 379720) (Version: - id Software)
Dying Light (HKLM...\Steam App 239140) (Version: - Techland)
Empire TV Tycoon (HKLM-x32...\Steam App 377900) (Version: - Dreamsite Games)
Euro Truck Simulator 2 (HKLM...\Steam App 227300) (Version: - SCS Software)
Euro Truck Simulator 2 (HKLM-x32...\Steam App 227300) (Version: - SCS Software)
Europa Universalis IV (HKLM...\Steam App 236850) (Version: - Paradox Development Studio)
F1 2016 (HKLM...\Steam App 391040) (Version: - Codemasters)
First Strike Final Hour (HKLM...\Steam App 587000) (Version: - Blindflug Studios AG)
FTL: Faster Than Light (HKLM...\Steam App 212680) (Version: - Subset Games)
Game of Thrones - A Telltale Games Series (HKLM-x32...\Steam App 330840) (Version: - Telltale Games)
Garry’s Mod (HKLM-x32...\Steam App 4000) (Version: - Facepunch Studios)
Google Chrome (HKLM-x32...\Google Chrome) (Version: 60.0.3112.113 - Google Inc.)
Google Update Helper (HKLM-x32...{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Grand Theft Auto V (HKLM...\Steam App 271590) (Version: - Rockstar North)
Hearts of Iron IV (HKLM...\Steam App 394360) (Version: - Paradox Development Studio)
Hell Yeah! (HKLM-x32...\Steam App 205230) (Version: - Arkedo)
Hexcells Infinite (HKLM-x32...\Steam App 304410) (Version: - Matthew Brown)
HITMAN™ (HKLM...\Steam App 236870) (Version: - Io-Interactive)
Injustice: Gods Among Us Ultimate Edition (HKLM...\Steam App 242700) (Version: - NetherRealm Studios)
Intel(R) Processor Graphics (HKLM-x32...{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4264 - Intel Corporation)
Java 8 Update 144 (64-bit) (HKLM...{26A24AE4-039D-4CA4-87B4-2F64180144F0}) (Version: 8.0.1440.1 - Oracle Corporation)
Jet Set Radio (HKLM-x32...\Steam App 205950) (Version: - Blit Software)
Just Cause 3 (HKLM-x32...\Steam App 225540) (Version: - Avalanche Studios)
Kerbal Space Program (HKLM...\Steam App 220200) (Version: - Squad)
KHOLAT (HKLM-x32...\Steam App 343710) (Version: - IMGN.PRO)
Kinect for Windows Speech Recognition Language Pack (en-AU) (HKLM-x32...{48CEC0A3-AE10-4EE3-AC62-76D3D58792E5}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-CA) (HKLM-x32...{9C5505DA-F9C1-46CB-9F8F-AC38F8EA518A}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-GB) (HKLM-x32...{A0186231-0A8B-455A-8A25-B64AABCC11A6}) (Version: 11.0.7400.336 - Microsoft Corporation)
Kinect for Windows Speech Recognition Language Pack (en-US) (HKLM-x32...{8AAA44BB-487E-4D01-AF76-484ACB90DBFE}) (Version: 11.0.7400.336 - Microsoft Corporation)
Left 4 Dead 2 (HKLM-x32...\Steam App 550) (Version: - Valve)
Mafia II (HKLM...\Steam App 50130) (Version: - 2K Czech)
Mafia III (HKLM...\Steam App 360430) (Version: - Hangar 13)
Medieval II: Total War (HKLM-x32...\Steam App 4700) (Version: - The Creative Assembly)
Medieval Kingdoms 1212 Part 1 (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Medieval Kingdoms 1212 Part 1) (Version: - )
Medieval Kingdoms 1212 Part 2 (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\Medieval Kingdoms 1212 Part 2) (Version: - )
Metro 2033 Redux (HKLM-x32...\Steam App 286690) (Version: - 4A GAMES)
Metro: Last Light Redux (HKLM-x32...\Steam App 287390) (Version: - 4A Games)
Microsoft .NET Framework 4.6.1 (HKLM...{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32...{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (HKLM-x32...{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.30730.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32...{59E4543A-D49D-4489-B445-473D763C79AF}) (Version: 2.0.672.0 - Microsoft Corporation)
Microsoft Office 365 ProPlus - en-us (HKLM...\O365ProPlusRetail - en-us) (Version: 16.0.8326.2096 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation)
Microsoft Server Speech Platform Runtime (x64) (HKLM...{3B433087-E62E-4BF5-97F9-4AF6E1C2409C}) (Version: 11.0.7400.345 - Microsoft Corporation)
Microsoft Small Basic v1.1 (HKLM-x32...{7AAA27E4-CDB3-49C0-AA2D-41827C001BA3}) (Version: 1.1.0.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32...{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32...{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32...{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32...{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32...{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM...{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM...{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM...{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM...{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32...{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32...{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32...{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32...{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM...{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32...{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32...{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32...{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32...{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32...{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32...{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32...{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM...{D9C50188-12D5-4D3E-8F00-682346C2AA5F}) (Version: 1.20.146.0 - Microsoft)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32...{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Middle-earth: Shadow of Mordor (HKLM-x32...\Steam App 241930) (Version: - Monolith Productions, Inc.)
Minecraft (HKLM-x32...{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mini Metro (HKLM-x32...\Steam App 287980) (Version: - Dinosaur Polo Club)
Mirror’s Edge (HKLM-x32...\Steam App 17410) (Version: - DICE)
Mount & Blade: Warband (HKLM-x32...\Steam App 48700) (Version: - TaleWorlds Entertainment)
Mount & Blade: With Fire and Sword (HKLM...\Steam App 48720) (Version: - TaleWorlds Entertainment)
Movie Maker (HKLM-x32...{38F03569-A636-4CF3-BDDE-032C8C251304}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32...{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 42.0 (x86 en-GB) (HKLM-x32...\Mozilla Firefox 42.0 (x86 en-GB)) (Version: 42.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32...\MozillaMaintenanceService) (Version: 42.0 - Mozilla)
Napoleon: Total War (HKLM...\Steam App 34030) (Version: - The Creative Assembly)
Naval War: Arctic Circle (HKLM-x32...\Steam App 200050) (Version: - TURBO TAPE GAMES)
Next Car Game: Wreckfest (HKLM-x32...\Steam App 228380) (Version: - Bugbear)
Nexus Mod Manager (HKLM...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.61.16 - Black Tree Gaming)
Norton Security (HKLM-x32...\NS) (Version: 22.10.1.10 - Symantec Corporation)
NVIDIA Graphics Driver 347.88 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.88 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.16.0318 (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
NvNodejs (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NvNodejs) (Version: 3.4.0.70 - NVIDIA Corporation) Hidden
NvvHci (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NvvHci) (Version: 2.02.0.5 - NVIDIA Corporation) Hidden
Office 16 Click-to-Run Extensibility Component (HKLM-x32...{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8326.2096 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM...{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8326.2096 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM...{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8326.2096 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32...{90160000-008C-0409-0000-0000000FF1CE}) (Version: 16.0.8326.2096 - Microsoft Corporation) Hidden
One Finger Death Punch (HKLM...\Steam App 264200) (Version: - Silver Dollar Games)
OpenAL (HKLM-x32...\OpenAL) (Version: - )
Origin (HKLM-x32...\Origin) (Version: 10.2.1.38915 - Electronic Arts, Inc.)
ORION: Prelude (HKLM-x32...\Steam App 104900) (Version: - Spiral Game Studios)
Overgrowth (HKLM-x32...\Steam App 25000) (Version: - Wolfire)
Overwolf (HKLM-x32...\Overwolf) (Version: 0.107.36.0 - Overwolf Ltd.)
Painkiller Hell & Damnation (HKLM-x32...\Steam App 214870) (Version: - The Farm 51)
Painkiller Overdose (HKLM-x32...\Steam App 3270) (Version: - Mindware Studios)
Painkiller: Black Edition (HKLM-x32...\Steam App 39530) (Version: - People Can Fly)
Painkiller: Recurring Evil (HKLM-x32...\Steam App 206760) (Version: - Med-Art)
Painkiller: Redemption (HKLM-x32...\Steam App 65560) (Version: - Eggtooth Team)
Painkiller: Resurrection (HKLM-x32...\Steam App 39560) (Version: - Homegrown Games)
Panzermadels: Tank Dating Simulator (HKLM...\Steam App 379980) (Version: - DEVGRU-P)
Papers, Please (HKLM-x32...\Steam App 239030) (Version: - 3909)
Pivot Animator version 4.1.10 (HKLM-x32...\Pivot Animator_is1) (Version: 4.1.10 - Motus Software Ltd)
Plague Inc: Evolved (HKLM...\Steam App 246620) (Version: - Ndemic Creations)
Prison Architect (HKLM-x32...\Steam App 233450) (Version: - Introversion Software)
Project Zomboid (HKLM...\Steam App 108600) (Version: - The Indie Stone)
PunkBuster for Battlefield 1942 (HKLM-x32...{127B684B-A002-44C8-99A7-6CF8F1E26873}) (Version: - )
PunkBuster Services (HKLM-x32...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
Python 3.5.0 (32-bit) (HKU\S-1-5-21-630333582-4039751370-1614634531-1000...{1197d2bb-6cf8-488a-b994-d5bf6d7efe7b}) (Version: 3.5.150.0 - Python Software Foundation)
Python 3.5.0 Core Interpreter (32-bit) (HKLM-x32...{E9E55FC3-A47F-4ACA-8691-C22469450FB1}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
Python 3.5.0 Development Libraries (32-bit) (HKLM-x32...{D5A057BD-471E-40D6-B7E0-79E08210D8F6}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
Python 3.5.0 Documentation (32-bit) (HKLM-x32...{169B7A58-FE29-48E8-8773-9D6390815C8C}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
Python 3.5.0 Executables (32-bit) (HKLM-x32...{CE48771A-4CC2-4F35-A7B3-D136E91D04F3}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
Python 3.5.0 Launcher (32-bit) (HKLM-x32...{CAA5FC80-DEF6-4DFA-9C06-23921A87F092}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
Python 3.5.0 pip Bootstrap (32-bit) (HKLM-x32...{11187860-0D92-490D-86EC-3A941C98D451}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
Python 3.5.0 Standard Library (32-bit) (HKLM-x32...{0740B2CD-63EC-44C7-B39E-B6EB579773E6}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
Python 3.5.0 Tcl/Tk Support (32-bit) (HKLM-x32...{7AB85182-2EE4-4137-A5C6-D8C03958DCBA}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
Python 3.5.0 Test Suite (32-bit) (HKLM-x32...{2234BC4D-E95D-40C2-818D-7845760C510F}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
Python 3.5.0 Utility Scripts (32-bit) (HKLM-x32...{4A69B338-2C0C-4726-A261-44DBCF0DA94A}) (Version: 3.5.150.0 - Python Software Foundation) Hidden
Realtek High Definition Audio Driver (HKLM-x32...{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7256 - Realtek Semiconductor Corp.)
Reigns (HKLM...\Steam App 474750) (Version: - Nerial)
Reus (HKLM...\Steam App 222730) (Version: - Abbey Games)
Rising Storm 2: Vietnam (HKLM...\Steam App 418460) (Version: - Antimatter Games)
Rising Storm/Red Orchestra 2 Multiplayer (HKLM-x32...\Steam App 35450) (Version: - Tripwire Interactive)
Rocket League (HKLM...\Steam App 252950) (Version: - Psyonix, Inc.)
Rockstar Games Social Club (HKLM-x32...\Rockstar Games Social Club) (Version: 1.2.1.2 - Rockstar Games)
Rodina (HKLM-x32...\Steam App 314230) (Version: - Elliptic Games)
Scourge of War: Waterloo (HKLM...\Steam App 369390) (Version: - NorbSoftDev)
SEGA Genesis & Mega Drive Classics (HKLM-x32...\Steam App 34270) (Version: - Sega)
Shadow Warrior (HKLM-x32...\Steam App 233130) (Version: - Flying Wild Hog)
SHIELD Streaming (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv) (Version: 7.1.0351 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (HKLM...{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShieldWirelessController) (Version: 3.4.0.70 - NVIDIA Corporation) Hidden
Sir, You Are Being Hunted (HKLM...\Steam App 242880) (Version: - Big Robot Ltd)
Skype Click to Call (HKLM-x32...{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype Web Plugin (HKLM-x32...{AC7406B6-BB3B-4CD1-AEBA-0527B9CB16FE}) (Version: 7.27.0.105 - Skype Technologies S.A.)
Skype Web Plugin (HKLM-x32...{FAD5089C-EB67-442F-89A3-970BCD034D40}) (Version: 7.14.0.184 - Skype Technologies S.A.)
Skype™ 7.36 (HKLM-x32...{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.36.101 - Skype Technologies S.A.)
Space Engineers (HKLM-x32...\Steam App 244850) (Version: - Keen Software House)
Spermination (HKLM-x32...\Steam App 363460) (Version: - Phr00t’s Software)
Steam (HKLM-x32...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Stellaris (HKLM...\Steam App 281990) (Version: - Paradox Development Studio)
Stranded Deep (HKLM-x32...\Steam App 313120) (Version: - Beam Team Games)
Sunless Sea (HKLM-x32...\Steam App 304650) (Version: - Failbetter Games)
Sword With Sauce: Alpha (HKLM...\Steam App 581630) (Version: - Diatomic Games)
Syrian Warfare (HKLM...\Steam App 485980) (Version: - Cats Who Play)
Team Fortress 2 (HKLM-x32...\Steam App 440) (Version: - Valve)
TeamSpeak 3 Client (HKLM...\TeamSpeak 3 Client) (Version: 3.0.18 - TeamSpeak Systems GmbH)
The Binding of Isaac: Rebirth (HKLM-x32...\Steam App 250900) (Version: - Nicalis, Inc.)
The Curious Expedition (HKLM-x32...\Steam App 358130) (Version: - Maschinen-Mensch)
The Elder Scrolls V: Skyrim (HKLM-x32...\Steam App 72850) (Version: - Bethesda Game Studios)
The Forest (HKLM-x32...\Steam App 242760) (Version: - Endnight Games Ltd)
The Howler (HKLM-x32...\Steam App 306040) (Version: - Antanas Marcelionis)
The Swindle (HKLM-x32...\Steam App 369110) (Version: - Size Five Games)
The Walking Dead (HKLM-x32...\Steam App 207610) (Version: - )
The Walking Dead: Season Two (HKLM-x32...\Steam App 261030) (Version: - Telltale Games)
theHunter™: Call of the Wild (HKLM...\Steam App 518790) (Version: - Expansive Worlds)
This War of Mine (HKLM-x32...\Steam App 282070) (Version: - 11 bit studios)
Tom Clancy’s Rainbow Six Siege (HKLM...\Steam App 359550) (Version: - Ubisoft Montreal)
Total War: ATTILA (HKLM...\Steam App 325610) (Version: - Creative Assembly)
Total War: ROME II - Emperor Edition (HKLM...\Steam App 214950) (Version: - Creative Assembly)
Total War™: WARHAMMER® (HKLM...\Steam App 364360) (Version: - Creative Assembly)
TP-LINK Archer T4U Driver (HKLM-x32...{58F414FE-74CC-42A0-9D86-A089849C510A}) (Version: 1.3.1 - TP-LINK)
TP-LINK Wireless Configuration Utility (HKLM-x32...{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.3.1 - TP-LINK)
Tropico 5 (HKLM-x32...\Steam App 245620) (Version: - Haemimont Games)
TunnelBear (HKLM-x32...{7094abcc-0311-45f4-aaac-638bf633a58a}) (Version: 2.3.22.0 - TunnelBear)
TunnelBear (HKLM-x32...{EFF0A0F1-E557-4228-8F55-E6DD94516FDC}) (Version: 2.3.22.0 - TunnelBear) Hidden
Universe Sandbox ² (HKLM-x32...\Steam App 230290) (Version: - Giant Army)
Uplay (HKLM-x32...\Uplay) (Version: 27.0 - Ubisoft)
Verdun (HKLM...\Steam App 242860) (Version: - M2H)
Victoria II (HKLM...\Steam App 42960) (Version: - Paradox Development Studio)
Viscera Cleanup Detail: Shadow Warrior (HKLM-x32...\Steam App 255520) (Version: - RuneStorm)
Wargame: Red Dragon (HKLM-x32...\Steam App 251060) (Version: - Eugen Systems)
Warhammer: End Times - Vermintide (HKLM...\Steam App 235540) (Version: - Fatshark)
Westerado: Double Barreled (HKLM-x32...\Steam App 275200) (Version: - Ostrich Banditos)
Windows Live Essentials (HKLM-x32...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.30 (32-bit) (HKLM-x32...\WinRAR archiver) (Version: 5.30.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{58743271-597A-401B-AF4A-1450179151C0}\InprocServer32 → C:\Users\Alex\AppData\Local\SkypePlugin\7.27.0.105 \GatewayActiveX-x64.dll (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 → C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{AB08C8FC-971C-4AE2-B23D-D76AC42C46E9}\localserver32 → C:\Users\Alex\AppData\Local\SkypePlugin\7.14.0.184 \GatewayVersion-x64.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{ABB7ECA5-6973-499F-B610-80173795847A}\InprocServer32 → C:\Users\Alex\AppData\Local\SkypePlugin\7.14.0.184 \GatewayActiveX-x64.dll (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{CBF9CD8C-2714-4F36-B76A-43E6C7547BC2}\localserver32 → C:\Users\Alex\AppData\Local\SkypePlugin\7.27.0.105 \EdgeCalling.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{D0FC4B60-C60D-4908-8365-0C64C03E0291}\localserver32 → C:\Users\Alex\AppData\Local\SkypePlugin\7.27.0.105 \GatewayVersion-x64.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-630333582-4039751370-1614634531-1000_Classes\CLSID{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 → C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
ShellIconOverlayIdentifiers: [ OverlayExcluded] → {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayPending] → {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayProtected] → {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ AccExtIco1] → {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] → {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] → {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
ShellIconOverlayIdentifiers-x32: [ OverlayExcluded] → {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayPending] → {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayProtected] → {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ContextMenuHandlers1: [AccExt] → {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
ContextMenuHandlers1: [BUContextMenu] → {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ContextMenuHandlers1: [Symantec.Norton.Antivirus.IEContextMenu] → {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\NavShExt.dll [2017-08-24] (Symantec Corporation)
ContextMenuHandlers1: [WinRAR] → {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2015-11-18] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] → {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2015-11-18] (Alexander Roshal)
ContextMenuHandlers2: [Symantec.Norton.Antivirus.IEContextMenu] → {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\NavShExt.dll [2017-08-24] (Symantec Corporation)
ContextMenuHandlers5: [igfxcui] → {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => → No File
ContextMenuHandlers5: [igfxDTCM] → {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2015-08-09] (Intel Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] → {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2015-03-13] (NVIDIA Corporation)
ContextMenuHandlers6: [AccExt] → {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
ContextMenuHandlers6: [BUContextMenu] → {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\buShell.dll [2017-08-24] (Symantec Corporation)
ContextMenuHandlers6: [Symantec.Norton.Antivirus.IEContextMenu] → {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\NavShExt.dll [2017-08-24] (Symantec Corporation)
ContextMenuHandlers6: [WinRAR] → {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2015-11-18] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] → {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2015-11-18] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0BB47E1C-65AC-4B30-9954-187CCB1234B9} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-02-23] (NVIDIA Corporation)
Task: {0E10E79B-1E11-4FE0-8E62-AA7A2FEBDEBB} - System32\Tasks\Games\UpdateCheck_S-1-5-21-630333582-4039751370-1614634531-1000
Task: {0E2760F8-3F8C-475B-857C-6F966EB51CFD} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-09-03] (Microsoft Corporation)
Task: {1B52B129-F8C3-440F-ABFF-87CBACAAD825} - System32\Tasks\Norton Security\Norton Security Error Analyzer => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\SymErr.exe [2017-08-24] (Symantec Corporation)
Task: {2D907517-3127-4DCD-9899-702FB8523E2B} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-08-28] (Microsoft Corporation)
Task: {46C04AD0-7561-450A-AD48-FC68053020FA} - System32\Tasks\Remediation\AntimalwareMigrationTas k => C:\Program Files\Common Files\AV\Norton Security\Upgrade.exe [2017-08-24] (Symantec Corporation)
Task: {4C621390-2ED0-4DC8-8214-3CC44517B6F5} - \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser → No File <==== ATTENTION
Task: {58CB4454-B5FE-44A7-848A-C9283038B151} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-02-23] (NVIDIA Corporation)
Task: {641A6F4E-DAB3-4C5B-9108-FF3513DEA8C2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-08-11] (Google Inc.)
Task: {65A4DEBB-AEC8-4C56-8D27-DA120040F02D} - System32\Tasks\Microsoft\Office\OfficeBackgroundTa skHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.e xe [2017-09-03] ()
Task: {66BD7690-8E3A-4166-BA16-051A98E84C62} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-02-23] (NVIDIA Corporation)
Task: {7A180518-D8DF-41D3-8C8F-E1D26DA021C7} - System32\Tasks\DllKitPRO => C:\Program Files (x86)\DllKitPRO\dllkitpro.exe
Task: {92B47D1E-E56A-4807-8453-66E6AF1EC407} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-02-23] (NVIDIA Corporation)
Task: {9350ECA1-A41C-4A0D-B77D-1A79EF41587F} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-09-10] (Overwolf LTD)
Task: {96803BE7-EC85-43C0-A98C-D48E608D71EC} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-08-28] (Microsoft Corporation)
Task: {A7E03ABD-597E-4918-8101-9808A823ADAC} - System32\Tasks\Microsoft\Office\OfficeBackgroundTa skHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.e xe [2017-09-03] ()
Task: {A8D3C198-71E3-495A-9800-FC2A09B6402D} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-02-23] (NVIDIA Corporation)
Task: {C0453763-91DE-4AFA-990D-D2ECA3EA41B3} - System32\Tasks\Microsoft\Office\OfficeTelemetryAge ntLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-09-03] (Microsoft Corporation)
Task: {C3B84E8B-499E-4461-9FD8-190CE7087FD4} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-02-23] (NVIDIA Corporation)
Task: {CC21B860-0C88-45F5-A572-5500341E5D11} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-02-23] (NVIDIA Corporation)
Task: {D0E9C069-E34A-4EFC-A80E-B3D57DE4B779} - System32\Tasks\Microsoft\Office\OfficeTelemetryAge ntFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-09-03] (Microsoft Corporation)
Task: {D556B455-9C86-4F05-AA5E-1F501B329789} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-08-11] (Google Inc.)
Task: {D8C22827-26A2-4491-9FB3-6C5C06A96BF5} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\WSCStub.exe [2017-08-24] (Symantec Corporation)
Task: {E5AD3D8F-8DE9-4495-84C4-8001C1AE137B} - System32\Tasks\Norton Security\Norton Security Error Processor => C:\Program Files (x86)\Norton Security\Engine\22.10.1.10\SymErr.exe [2017-08-24] (Symantec Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2016-11-22 00:42 - 2017-02-23 19:35 - 001147328 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-11-22 00:42 - 2017-02-23 19:35 - 004489152 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\Poco.dll
2015-09-23 06:10 - 2013-10-18 17:42 - 000048856 _____ () C:\Windows\runSW.exe
2016-02-10 13:24 - 2016-02-10 13:24 - 000039424 _____ () C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe
2016-05-22 19:33 - 2016-05-22 19:33 - 000491184 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2016-03-16 17:23 - 2017-09-03 13:17 - 008929480 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2015-09-23 06:10 - 2013-12-16 09:52 - 000847872 _____ () E:\1A\TWCU.exe
2017-08-29 01:36 - 2017-08-23 09:48 - 003824472 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\libg lesv2.dll
2017-08-29 01:36 - 2017-08-23 09:48 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\libe gl.dll
2017-08-11 12:36 - 2017-08-08 15:13 - 001893880 _____ () C:\Users\Alex\AppData\Local\Discord\app-0.0.298\ffmpeg.dll
2017-04-26 15:19 - 2017-04-26 15:19 - 002005976 ____R () C:\Program Files (x86)\Skype\Phone\skypert.dll
2017-06-01 02:18 - 2017-09-03 13:17 - 008928960 _____ () C:\Program Files (x86)\Microsoft Office\root\Office16\1033\GrooveIntlResource.dll
2015-09-23 06:22 - 2017-08-04 22:19 - 000678176 _____ () E:\Steam\SDL2.dll
2015-09-23 06:22 - 2016-09-01 02:02 - 004969248 _____ () E:\Steam\v8.dll
2015-09-23 06:22 - 2016-09-01 02:02 - 001563936 _____ () E:\Steam\icui18n.dll
2015-09-23 06:22 - 2016-09-01 02:02 - 001195296 _____ () E:\Steam\icuuc.dll
2015-09-23 06:22 - 2017-09-07 05:51 - 002505504 _____ () E:\Steam\video.dll
2015-09-23 06:22 - 2016-01-27 08:49 - 002549760 _____ () E:\Steam\libavcodec-56.dll
2015-09-23 06:22 - 2016-01-27 08:49 - 000442880 _____ () E:\Steam\libavutil-54.dll
2015-09-23 06:22 - 2016-01-27 08:49 - 000491008 _____ () E:\Steam\libavformat-56.dll
2015-09-23 06:22 - 2016-01-27 08:49 - 000332800 _____ () E:\Steam\libavresample-2.dll
2015-09-23 06:22 - 2016-01-27 08:49 - 000485888 _____ () E:\Steam\libswscale-3.dll
2015-09-23 06:22 - 2017-09-07 05:51 - 000885024 _____ () E:\Steam\bin\chromehtml.DLL
2016-03-09 09:19 - 2016-07-04 23:17 - 000266560 _____ () E:\Steam\openvr_api.dll
2015-09-23 06:10 - 2013-11-21 16:13 - 001411072 _____ () E:\1A\nicLan.dll
2015-09-23 06:10 - 2013-07-23 16:21 - 000193024 _____ () E:\1A\DC_WFF.dll
2015-09-23 06:10 - 2013-12-20 11:13 - 000300544 _____ () E:\1A\WJRtl.dll
2017-08-11 12:36 - 2017-08-08 15:13 - 001938424 _____ () C:\Users\Alex\AppData\Local\Discord\app-0.0.298\libglesv2.dll
2017-08-11 12:36 - 2017-08-08 15:13 - 000095736 _____ () C:\Users\Alex\AppData\Local\Discord\app-0.0.298\libegl.dll
2016-12-13 01:11 - 2017-07-17 23:50 - 073115424 _____ () E:\Steam\bin\cef\cef.win7\libcef.dll
2017-06-08 08:00 - 2017-05-17 02:54 - 000678176 _____ () E:\Steam\bin\cef\cef.win7\SDL2.dll
2015-09-23 06:22 - 2015-09-25 00:52 - 000119208 _____ () E:\Steam\winh264.dll
2017-08-11 12:36 - 2017-08-31 17:42 - 009622008 _____ () \?\C:\Users\Alex\AppData\Roaming\discord\0.0.298\m odules\discord_voice\discord_voice.node
2017-08-11 12:36 - 2017-08-11 12:36 - 001440248 _____ () \?\C:\Users\Alex\AppData\Roaming\discord\0.0.298\m odules\discord_utils\discord_utils.node
2017-09-14 22:20 - 2017-09-14 22:20 - 000148992 _____ () \?\C:\Users\Alex\AppData\Local\Temp\57B1.tmp.node
2017-08-11 12:36 - 2017-08-11 12:36 - 002658296 _____ () \?\C:\Users\Alex\AppData\Roaming\discord\0.0.298\m odules\discord_rpc\discord_rpc.node
2017-08-11 12:36 - 2017-08-11 12:36 - 002673656 _____ () \?\C:\Users\Alex\AppData\Roaming\discord\0.0.298\m odules\discord_contact_import\discord_contact_impo rt.node

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The “AlternateShell” will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-630333582-4039751370-1614634531-1000...\sharepoint.com → hxxps://thsuknet-files.sharepoint.com

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-630333582-4039751370-1614634531-1000\Control Panel\Desktop\Wallpaper →
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Pol icies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{96E7AE14-410E-4C17-AAB0-6C50199C724E}] => (Allow) E:\Steam\steamapps\common\Planet Coaster\PlanetCoaster.exe
FirewallRules: [{AFB70808-8AA3-4155-9FAC-D07D7FD1101B}] => (Allow) E:\Steam\steamapps\common\Planet Coaster\PlanetCoaster.exe
FirewallRules: [{42E0D8E2-640C-4DD9-BAD7-CD09051FF44C}] => (Allow) E:\Steam\steamapps\common\rocketleague\Binaries\Wi n32\RocketLeague.exe
FirewallRules: [{97C74FD9-8B9C-4AF0-A2AC-83129914792B}] => (Allow) E:\Steam\steamapps\common\rocketleague\Binaries\Wi n32\RocketLeague.exe
FirewallRules: [{9EF21195-2FF3-469C-A2E6-C75F54C9E403}] => (Allow) E:\Steam\steamapps\common\DarkestDungeon_windows\D arkest.exe
FirewallRules: [{8751276E-0CFE-488F-B354-0042937D54ED}] => (Allow) E:\Steam\steamapps\common\DarkestDungeon_windows\D arkest.exe
FirewallRules: [{7E36EA14-0843-4D27-B8A3-57ABA1569D41}] => (Allow) E:\Steam\steamapps\common\Tom Clancy’s Rainbow Six Siege\RainbowSix_BE.exe
FirewallRules: [{12BBAF68-B76C-47BA-A8D7-9D62172DCB8C}] => (Allow) E:\Steam\steamapps\common\Tom Clancy’s Rainbow Six Siege\RainbowSix_BE.exe
FirewallRules: [{2CA463D1-4AB4-44A6-87F4-8FFC550DF098}] => (Allow) E:\Steam\steamapps\common\Tom Clancy’s Rainbow Six Siege\RainbowSix.exe
FirewallRules: [{EE5715D8-7C4F-43BD-9DD8-269A6389A3FF}] => (Allow) E:\Steam\steamapps\common\Tom Clancy’s Rainbow Six Siege\RainbowSix.exe
FirewallRules: [UDP Query User{FA795D5E-A9B9-4D7E-9D00-E16CA398D6EE}E:\steam\steamapps\common\sword with sauce alpha\swordwithsauce\binaries\win64\swordwithsauce-win64-shipping.exe] => (Block) E:\steam\steamapps\common\sword with sauce alpha\swordwithsauce\binaries\win64\swordwithsauce-win64-shipping.exe
FirewallRules: [TCP Query User{CFFE91F1-1D3F-4835-B704-F5F4A9262B91}E:\steam\steamapps\common\sword with sauce alpha\swordwithsauce\binaries\win64\swordwithsauce-win64-shipping.exe] => (Block) E:\steam\steamapps\common\sword with sauce alpha\swordwithsauce\binaries\win64\swordwithsauce-win64-shipping.exe
FirewallRules: [{31DBB65F-F7A5-4814-B503-25F4476524D0}] => (Allow) E:\Steam\steamapps\common\Sword With Sauce Alpha\SwordWithSauce.exe
FirewallRules: [{2E786667-6141-434C-A780-255A6910E673}] => (Allow) E:\Steam\steamapps\common\Sword With Sauce Alpha\SwordWithSauce.exe
FirewallRules: [{DEBF978F-35D0-4D7E-AD01-31B137442E90}] => (Allow) E:\Steam\steamapps\common\theHunterCotW\theHunterC otW_F.exe
FirewallRules: [{D4F83BA4-18EE-41D3-9A9F-9240A5C38382}] => (Allow) E:\Steam\steamapps\common\theHunterCotW\theHunterC otW_F.exe
FirewallRules: [{9245239C-163E-414D-8D24-B1D9CE981418}] => (Allow) E:\Steam\steamapps\common\Domina\Domina.exe
FirewallRules: [{229F5F9A-4796-45AB-894A-1372D1023DD6}] => (Allow) E:\Steam\steamapps\common\Domina\Domina.exe
FirewallRules: [{443343FA-EEED-4D05-BC43-B8310536B93D}] => (Allow) E:\Steam\steamapps\common\Syrian Warfare\bin\SyrianWarfare.exe
FirewallRules: [{2FF90DBB-0406-41DF-8E03-403D91B3EB52}] => (Allow) E:\Steam\steamapps\common\Syrian Warfare\bin\SyrianWarfare.exe
FirewallRules: [{D3285F31-EE3F-4812-8DF1-3F98D6B49FB7}] => (Allow) E:\Steam\steamapps\common\DOOM\DOOMx64.exe
FirewallRules: [{767A947F-FB61-402E-A25E-F2D12A4B228D}] => (Allow) E:\Steam\steamapps\common\DOOM\DOOMx64.exe
FirewallRules: [{963B376C-72B4-4BAE-A07D-738D4777137D}] => (Allow) E:\Steam\steamapps\common\Warhammer End Times Vermintide\binaries\vermintide.exe
FirewallRules: [{7419C265-AC33-4499-AC29-7E0BC36F8466}] => (Allow) E:\Steam\steamapps\common\Warhammer End Times Vermintide\binaries\vermintide.exe
FirewallRules: [{EA1E0400-571F-4557-A2A6-E1CB9748F5C7}] => (Allow) E:\Steam\steamapps\common\Warhammer End Times Vermintide\launcher\launcher.exe
FirewallRules: [{1DD7BC8B-9BBE-4727-84BE-3BAA91C13E57}] => (Allow) E:\Steam\steamapps\common\Warhammer End Times Vermintide\launcher\launcher.exe
FirewallRules: [{85894124-4C55-4320-A562-7FE5BF988C52}] => (Allow) E:\Steam\steamapps\common\Dishonored2\Dishonored2. exe
FirewallRules: [{82A1199B-8AFF-4CD1-8C81-6BC497BB9FDB}] => (Allow) E:\Steam\steamapps\common\Dishonored2\Dishonored2. exe
FirewallRules: [{DC51661D-7F68-457D-8430-3B0E93495A8F}] => (Allow) E:\Steam\steamapps\common\ClusterTruck\Clustertruc k.exe
FirewallRules: [{B9BDF904-4648-4ADB-B3CA-0E59657FFFEB}] => (Allow) E:\Steam\steamapps\common\ClusterTruck\Clustertruc k.exe
FirewallRules: [{F84E3176-CF7B-409C-A59E-FC647FBC883F}] => (Allow) E:\Steam\steamapps\common\Audiosurf 2\Audiosurf2.exe
FirewallRules: [{55FB82E4-5B01-46C5-85D1-9401F194E31D}] => (Allow) E:\Steam\steamapps\common\Audiosurf 2\Audiosurf2.exe
FirewallRules: [{DC79F007-2E33-40E4-9745-565B808B77D2}] => (Allow) E:\Steam\steamapps\common\ShadowOfMordor\x64\Shado wOfMordor.exe
FirewallRules: [{AD840992-EE07-40AB-AD89-B6E1EFAD6037}] => (Allow) E:\Steam\steamapps\common\ShadowOfMordor\x64\Shado wOfMordor.exe
FirewallRules: [{C8981042-BF2C-495F-9EE0-F9456AACC242}] => (Allow) E:\Steam\steamapps\common\Kerbal Space Program\KSP_x64.exe
FirewallRules: [{221E8CC9-8AAA-4C6A-93A1-2E0B40377098}] => (Allow) E:\Steam\steamapps\common\Kerbal Space Program\KSP_x64.exe
FirewallRules: [{2E49665E-D241-4A03-98DA-5852486E1F6E}] => (Allow) E:\Steam\steamapps\common\Kerbal Space Program\KSP.exe
FirewallRules: [{D2C17914-8F24-447A-82DE-458D5DEC49A2}] => (Allow) E:\Steam\steamapps\common\Kerbal Space Program\KSP.exe
FirewallRules: [{0E81BEEE-50F8-42A1-B733-678A0A027F7C}] => (Allow) E:\Steam\steamapps\common\Arma 3\arma3launcher.exe
FirewallRules: [{2F79877D-4F3D-4323-8755-E2D66B5995CA}] => (Allow) E:\Steam\steamapps\common\Arma 3\arma3launcher.exe
FirewallRules: [{5E474619-4428-4094-BCB0-944940119757}] => (Allow) E:\Steam\steamapps\common\Defcon\Defcon.exe
FirewallRules: [{5D164E49-48CF-434F-95D0-F49C31D49B25}] => (Allow) E:\Steam\steamapps\common\Defcon\Defcon.exe
FirewallRules: [{A24226EA-DE5B-4E8D-BDBC-FF9FC2575D32}] => (Allow) E:\Steam\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe
FirewallRules: [{99FDF815-F77C-426E-8019-A3AB6C6C1FAF}] => (Allow) E:\Steam\steamapps\common\Dying Light\DevTools\DyingLightPlayer.exe
FirewallRules: [{97BEEF9C-E91C-467B-B7AF-7678E676FD8C}] => (Allow) E:\Steam\steamapps\common\FirstStrikeFinalHour\Fir stStikeFinalHour.exe
FirewallRules: [{47544D27-5040-44E8-931A-050BD916A9F9}] => (Allow) E:\Steam\steamapps\common\FirstStrikeFinalHour\Fir stStikeFinalHour.exe
FirewallRules: [{34E0F4B3-7120-4A6F-B43D-858E002010D8}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{2A80FDE2-53BC-48B0-853F-BF2595A249C6}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{2D89E8FC-673D-4C02-A54E-383DF0AD9D29}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{01ED11F7-73E4-412C-AE10-CFED915ED1B8}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [UDP Query User{B9388CB9-F2E6-4CB4-86E4-98275B380A1B}E:\steam\steamapps\common\rising storm 2\binaries\win64\vngame.exe] => (Allow) E:\steam\steamapps\common\rising storm 2\binaries\win64\vngame.exe
FirewallRules: [TCP Query User{67039C1E-BFC8-492E-83C3-F4ECC6B74401}E:\steam\steamapps\common\rising storm 2\binaries\win64\vngame.exe] => (Allow) E:\steam\steamapps\common\rising storm 2\binaries\win64\vngame.exe
FirewallRules: [{F6C784AB-160A-4DB3-8C16-69071E357605}] => (Allow) E:\Steam\steamapps\common\Rising Storm 2\Binaries\Win64\RisingStorm2.exe
FirewallRules: [{E79E930E-783C-4A36-B7AB-DBEC5868A58E}] => (Allow) E:\Steam\steamapps\common\Rising Storm 2\Binaries\Win64\RisingStorm2.exe
FirewallRules: [{79398897-AA55-4EBE-A4CF-174B9FF29F98}] => (Allow) E:\Steam\steamapps\common\DoorKickers\DoorKickers. exe
FirewallRules: [{F737ED71-AC79-42DD-931A-9497AB46210D}] => (Allow) E:\Steam\steamapps\common\DoorKickers\DoorKickers. exe
FirewallRules: [{68B62FC8-6D34-4C1B-B8F0-87B5D9CC3B57}] => (Allow) E:\Steam\steamapps\common\Banished\Application-steam-x64.exe
FirewallRules: [{B9DEC131-09F7-4D63-8143-826784481799}] => (Allow) E:\Steam\steamapps\common\Banished\Application-steam-x64.exe
FirewallRules: [UDP Query User{24FDCDC8-83F0-4A0E-AFC3-4323B8792A0B}E:\steam\steamapps\common\total war attila\attila.exe] => (Allow) E:\steam\steamapps\common\total war attila\attila.exe
FirewallRules: [TCP Query User{7899C3B7-030D-4A96-89BD-0A47CB7D3C49}E:\steam\steamapps\common\total war attila\attila.exe] => (Allow) E:\steam\steamapps\common\total war attila\attila.exe
FirewallRules: [{BEDAA2FC-1151-427E-A29B-A2CD05CCF440}] => (Allow) E:\Steam\steamapps\common\Europa Universalis IV\eu4.exe
FirewallRules: [{81C8211F-1347-48D7-90BF-432BBFD7037B}] => (Allow) E:\Steam\steamapps\common\Europa Universalis IV\eu4.exe
FirewallRules: [{808A2D8A-4077-4949-A832-5E40F04864B1}] => (Allow) E:\Steam\steamapps\common\F1 2016\F1_2016.exe
FirewallRules: [{8943FF05-1D1C-4177-BAEA-166A7930E052}] => (Allow) E:\Steam\steamapps\common\F1 2016\F1_2016.exe
FirewallRules: [{DE521477-84D2-40CB-90CC-43C913133255}] => (Allow) E:\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe
FirewallRules: [{B7D6DA9C-12FA-4AE7-B93B-30529673D824}] => (Allow) E:\Steam\steamapps\common\Total War SHOGUN 2\Shogun2.exe
FirewallRules: [{A7B9060E-8C9A-48B3-B6B3-F7FB977D05A2}] => (Allow) E:\Steam\steamapps\common\Hearts of Iron IV\hoi4.exe
FirewallRules: [{91645FE8-B95A-4456-AAC6-D2D312E86449}] => (Allow) E:\Steam\steamapps\common\Hearts of Iron IV\hoi4.exe
FirewallRules: [{77059F52-A28A-45DC-8284-D5EDDEA70EA8}] => (Allow) E:\Steam\steamapps\common\Scourge of War Waterloo\SOWWL.exe
FirewallRules: [{3798A739-5DFA-4825-BFC5-EF093FDC220F}] => (Allow) E:\Steam\steamapps\common\Scourge of War Waterloo\SOWWL.exe
FirewallRules: [{90CBC851-432B-403E-87EA-51993853EB89}] => (Allow) E:\Steam\steamapps\common\Blackwake\Blackwake.exe
FirewallRules: [{217A27C8-548A-4B26-87FB-E157D5C90A94}] => (Allow) E:\Steam\steamapps\common\Blackwake\Blackwake.exe
FirewallRules: [{89BC7FAB-24B9-418F-9C7E-534A3123B1D5}] => (Allow) E:\Steam\steamapps\common\Braid\braid.exe
FirewallRules: [{E715CA75-720B-40BA-87C6-6002A33AE2AE}] => (Allow) E:\Steam\steamapps\common\Braid\braid.exe
FirewallRules: [{D30F36CB-7D63-4A3B-A961-30A61D2DE9C5}] => (Allow) E:\Steam\steamapps\common\Panzermadels\Panzermadel s.exe
FirewallRules: [{A9BE815F-B4E1-4EDF-A90E-636DB852B603}] => (Allow) E:\Steam\steamapps\common\Panzermadels\Panzermadel s.exe
FirewallRules: [{830C5052-BA2D-4297-8664-99690D6F439B}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [{1DCDECD8-32DE-47B3-A9A7-15D576E33A17}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [{D116D235-915C-4B9B-BE16-7508264D880E}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{CC2C3EBA-0395-4908-AAE4-32BF1CB39141}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{E981DFD8-5E0A-4383-A80F-3F18F88F4D0A}] => (Allow) E:\Steam\steamapps\common\Napoleon Total War\Napoleon.exe
FirewallRules: [{F0C441EC-8414-4475-B70F-3BA5EF502412}] => (Allow) E:\Steam\steamapps\common\Napoleon Total War\Napoleon.exe
FirewallRules: [{F85A05B8-5A75-4C25-8862-A43F6F11A7B2}] => (Allow) E:\Steam\steamapps\common\Viscera Cleanup Detail Shadow Warrior\Binaries\Win64\UDK.exe
FirewallRules: [{17A9FEDA-B52D-4F6C-A98C-3C90BB351D52}] => (Allow) E:\Steam\steamapps\common\Viscera Cleanup Detail Shadow Warrior\Binaries\Win64\UDK.exe
FirewallRules: [{46027175-EEB8-43AB-A833-2B583251F3B6}] => (Allow) E:\Steam\steamapps\common\Viscera Cleanup Detail Shadow Warrior\Binaries\Win32\UDK.exe
FirewallRules: [{9E7F5B01-5704-4EE2-8DDE-109833EE6BAE}] => (Allow) E:\Steam\steamapps\common\Viscera Cleanup Detail Shadow Warrior\Binaries\Win32\UDK.exe
FirewallRules: [{1D8E899E-C77B-4072-8868-814363CED353}] => (Allow) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{B352F41F-1964-4274-BB28-091EF60E8B86}] => (Allow) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{4E6423D7-0547-477C-9FFE-4D38BD7CE16C}] => (Allow) E:\Steam\steamapps\common\Hitman™\Launcher.exe
FirewallRules: [{9F9530C6-DBC1-4349-894A-61C6CE6E180D}] => (Allow) E:\Steam\steamapps\common\Hitman™\Launcher.exe
FirewallRules: [{746176A7-6B53-4D9F-946D-D865C1BF8E47}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CC315D9F-D844-4E76-8D48-BF6011C5FD7D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{B57F6DBB-EB8C-4445-B0F5-A7E72714ED1C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{13B3189D-D98C-412D-98A9-ACF710DE6853}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{C0D7B2C3-CF3D-42A9-9316-896C0592CED0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{1767CAD6-9A86-414E-8B02-FC3A28CCFB14}] => (Allow) E:\Steam\steamapps\common\Audiosurf\engine\QuestVi ewer.exe
FirewallRules: [{97691625-7572-4769-870A-0D530DDB4C03}] => (Allow) E:\Steam\steamapps\common\Audiosurf\engine\QuestVi ewer.exe
FirewallRules: [{FDF63DC1-420C-4E3D-B2AD-F17E03709C20}] => (Allow) E:\Steam\steamapps\common\InjusticeGodsAmongUs_Ult imateEdition\DiscContentPCG\InjusticeLauncher.exe
FirewallRules: [{AEE7C769-39EB-4E9D-91D3-D62847C35183}] => (Allow) E:\Steam\steamapps\common\InjusticeGodsAmongUs_Ult imateEdition\DiscContentPCG\InjusticeLauncher.exe
FirewallRules: [{D3D364A1-9F11-483D-A310-06E0DE383F51}] => (Allow) E:\Steam\steamapps\common\InjusticeGodsAmongUs_Ult imateEdition\DiscContentPCG\Injustice.exe
FirewallRules: [{407F5580-E04A-4ED2-A195-8FF05E5F763C}] => (Allow) E:\Steam\steamapps\common\InjusticeGodsAmongUs_Ult imateEdition\DiscContentPCG\Injustice.exe
FirewallRules: [{25BC2235-AE52-47C4-A548-842CD0F4BECD}] => (Allow) E:\Steam\steamapps\common\PlagueInc\PlagueIncEvolv ed.exe
FirewallRules: [{6B81137A-C5E8-423A-AD96-B2574B330D61}] => (Allow) E:\Steam\steamapps\common\PlagueInc\PlagueIncEvolv ed.exe
FirewallRules: [{2F78CCB1-E5F5-429B-93B5-F69E55253702}] => (Allow) E:\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{B2804EFA-287D-4CCE-9F8A-5D0EBC9B3033}] => (Allow) E:\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{24F33C97-33F4-44AC-90B1-B11B5A13135F}] => (Allow) E:\Steam\steamapps\common\Reigns\Reigns.exe
FirewallRules: [{3CC4B159-BA84-4086-A80B-F486438F3F81}] => (Allow) E:\Steam\steamapps\common\Reigns\Reigns.exe
FirewallRules: [{6BD83D17-FA37-49B5-B749-A80DC3DC8B6C}] => (Allow) E:\Steam\steamapps\common\Stellaris\stellaris.exe
FirewallRules: [{81BFBDCC-FA70-4BBD-BF07-FFAAE4F1A0E0}] => (Allow) E:\Steam\steamapps\common\Stellaris\stellaris.exe
FirewallRules: [{638F03D5-B23E-4D45-A336-358F4B01FAD9}] => (Allow) E:\Steam\steamapps\common\SirYouAreBeingHunted\lau ncher\sir.exe
FirewallRules: [{BE1C0583-684C-4250-B6CE-E136CF57FBED}] => (Allow) E:\Steam\steamapps\common\SirYouAreBeingHunted\lau ncher\sir.exe
FirewallRules: [{400709F2-E16F-4F9B-9AD6-1748D3C147A0}] => (Allow) E:\Steam\steamapps\common\Assassin’s Creed IV Black Flag\AC4BFMP.exe
FirewallRules: [{BC57D351-1963-4D31-A701-ED6DD0039CDC}] => (Allow) E:\Steam\steamapps\common\Assassin’s Creed IV Black Flag\AC4BFMP.exe
FirewallRules: [{0D483D8E-E7A6-4A4D-9688-DBDC4B811C3D}] => (Allow) E:\Steam\steamapps\common\Victoria 2\victoria2.exe
FirewallRules: [{432A5774-162A-4E5F-8794-B533C7CC590A}] => (Allow) E:\Steam\steamapps\common\Victoria 2\victoria2.exe
FirewallRules: [{76A220E4-C543-4F0E-A0F6-894E318EB56F}] => (Allow) E:\Steam\steamapps\common\Crusader Kings II\CK2game.exe
FirewallRules: [{27A2611C-D8BD-4E1A-87DA-0EB1837E9689}] => (Allow) E:\Steam\steamapps\common\Crusader Kings II\CK2game.exe
FirewallRules: [{9CE3212F-8D8D-47E4-A461-5D1F3AFDA20B}] => (Allow) E:\Steam\steamapps\common\Assassin’s Creed IV Black Flag\AC4BFSP.exe
FirewallRules: [{091F8CAC-95E9-436D-9BA3-F028BDF65270}] => (Allow) E:\Steam\steamapps\common\Assassin’s Creed IV Black Flag\AC4BFSP.exe
FirewallRules: [{3F21D295-365B-4A2D-A6B0-CEBF9A6BE268}] => (Allow) E:\Steam\steamapps\common\Mafia II\pc\mafia2.exe
FirewallRules: [{62C82668-0ACB-4BC7-A472-8FA79FA41669}] => (Allow) E:\Steam\steamapps\common\Mafia II\pc\mafia2.exe
FirewallRules: [{B32CCB1A-BA7B-4388-A0CA-2F6293EC1C76}] => (Allow) E:\Steam\steamapps\common\Dying Light\DyingLightGame.exe
FirewallRules: [{AEA07B2C-0E54-42A8-AE71-4CA9A17FFFA8}] => (Allow) E:\Steam\steamapps\common\Dying Light\DyingLightGame.exe
FirewallRules: [UDP Query User{FBB7209E-6933-4015-9A9B-9924F738AEDD}E:\steam\steamapps\common\total war warhammer\warhammer.exe] => (Block) E:\steam\steamapps\common\total war warhammer\warhammer.exe
FirewallRules: [TCP Query User{88DF63A5-2BE8-47A0-8981-8F6210D2D801}E:\steam\steamapps\common\total war warhammer\warhammer.exe] => (Block) E:\steam\steamapps\common\total war warhammer\warhammer.exe
FirewallRules: [{5A437811-D259-4952-AC45-A3112F4F36D4}] => (Allow) E:\Steam\steamapps\common\Mount & Blade With Fire and Sword\mb_wfas.exe
FirewallRules: [{72D1CB53-12F4-4FE5-B188-5A92A29E2AA1}] => (Allow) E:\Steam\steamapps\common\Mount & Blade With Fire and Sword\mb_wfas.exe
FirewallRules: [{DE40EABE-FBAA-4DE7-9E41-D784D2BE795E}] => (Allow) E:\Steam\steamapps\common\Sega Classics\SEGAGameRoom.exe
FirewallRules: [{C40CAABE-3F50-43CD-9C0B-944E643D1F0B}] => (Allow) E:\Steam\steamapps\common\Sega Classics\SEGAGameRoom.exe
FirewallRules: [{3B387808-6641-4704-95BD-43C4B161627C}] => (Allow) E:\Steam\steamapps\common\Astroloco1\winsetup.exe
FirewallRules: [{0811C7C5-BABE-4F4F-833F-B66A7047F02C}] => (Allow) E:\Steam\steamapps\common\Astroloco1\winsetup.exe
FirewallRules: [{20E32851-A107-4FE9-8415-65AFF7306D05}] => (Allow) E:\Steam\steamapps\common\Astroloco1\AstroLoco1.ex e
FirewallRules: [{FB4AE6F0-9CFE-4937-BC03-0C3CF0853A77}] => (Allow) E:\Steam\steamapps\common\Astroloco1\AstroLoco1.ex e
FirewallRules: [{669200CB-CC12-4307-894C-E7D19A0E7795}] => (Allow) E:\Steam\steamapps\common\Democracy 3\Democracy3.exe
FirewallRules: [{31410A78-3B3C-4CFC-90D1-0471D27E4D04}] => (Allow) E:\Steam\steamapps\common\Democracy 3\Democracy3.exe
FirewallRules: [{1F95792D-227B-4773-8026-9986CC24EEBD}] => (Allow) E:\Steam\steamapps\common\Universe Sandbox 2\Universe Sandbox VR.exe
FirewallRules: [{71DEEE14-47B6-4CD2-AE21-7BEF7F08CF79}] => (Allow) E:\Steam\steamapps\common\Universe Sandbox 2\Universe Sandbox VR.exe
FirewallRules: [{E986416F-C4ED-4608-B49E-A138F2211A11}] => (Allow) E:\Steam\steamapps\common\Prison Architect\Prison Architect Safe Mode.exe
FirewallRules: [{A528405E-8BB8-4BF3-BB58-30731328943D}] => (Allow) E:\Steam\steamapps\common\Prison Architect\Prison Architect Safe Mode.exe
FirewallRules: [{9A5A74F0-4D33-4B4E-8538-4D5772003F1E}] => (Allow) E:\Steam\steamapps\common\Broforce\Broforce_beta.e xe
FirewallRules: [{E76347D7-E4D7-4044-AA54-C17AE849BA91}] => (Allow) E:\Steam\steamapps\common\Broforce\Broforce_beta.e xe
FirewallRules: [{9A5024AF-9A1D-4D67-AF35-9DC77D4AF1A8}] => (Allow) E:\Steam\steamapps\common\The Curious Expedition\electron.exe
FirewallRules: [{16538FC7-E5FB-4DA9-B153-25BED221170B}] => (Allow) E:\Steam\steamapps\common\The Curious Expedition\electron.exe
FirewallRules: [{707CA1CC-E0C6-415E-BF70-C8751C72B299}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{DDDDBE11-3799-4CDA-B6B3-078733C0FC91}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [UDP Query User{B67BDE6A-907E-4D2B-B7E2-AF83CD46DC50}C:\users\alex\appdata\local\skypeplug in\7.14.0.184\pluginhost.exe] => (Block) C:\users\alex\appdata\local\skypeplugin\7.14.0.184 \pluginhost.exe
FirewallRules: [TCP Query User{8B47E8E4-3C58-43CC-A249-39B14FB07B6F}C:\users\alex\appdata\local\skypeplug in\7.14.0.184\pluginhost.exe] => (Block) C:\users\alex\appdata\local\skypeplugin\7.14.0.184 \pluginhost.exe
FirewallRules: [{6B502C33-FE25-41DA-8340-C8E8BE3AA202}] => (Allow) E:\Steam\steamapps\common\Hexcells Infinite\Hexcells Infinite.exe
FirewallRules: [{216A7F06-258B-4771-9138-2C7F8673266B}] => (Allow) E:\Steam\steamapps\common\Hexcells Infinite\Hexcells Infinite.exe
FirewallRules: [{D3D9BFBE-1FE0-48D3-BE01-2AA08697776C}] => (Allow) E:\Steam\steamapps\common\Hell Yeah\HELLYEAH.exe
FirewallRules: [{AACDAA37-61D5-49A5-B830-18C529AE01D4}] => (Allow) E:\Steam\steamapps\common\Hell Yeah\HELLYEAH.exe
FirewallRules: [{13569324-A13A-4DE8-8A29-4D356CECEE9E}] => (Allow) E:\Steam\steamapps\common\Jet Set Radio\jsrsetup.exe
FirewallRules: [{AB6CB6EB-5898-4868-8068-1890315616DF}] => (Allow) E:\Steam\steamapps\common\Jet Set Radio\jsrsetup.exe
FirewallRules: [{F917580D-38D1-447F-8A33-45A969C9D034}] => (Allow) E:\Steam\steamapps\common\Sega Classics\SEGAGenesisClassics.exe
FirewallRules: [{02DB5186-DB06-4C8C-9B90-CF23CC415C7B}] => (Allow) E:\Steam\steamapps\common\Sega Classics\SEGAGenesisClassics.exe
FirewallRules: [{33FC265F-D9DC-49AF-92CC-79F0643C04D2}] => (Allow) E:\Steam\steamapps\common\Game of Thrones\Thrones.exe
FirewallRules: [{82EAD0A7-F1E2-48A8-934E-7694EBAB49AA}] => (Allow) E:\Steam\steamapps\common\Game of Thrones\Thrones.exe
FirewallRules: [{D21D3DDF-E0A0-4DC1-AB84-03554C988AF8}] => (Allow) E:\Steam\steamapps\common\ARK\ShooterGame\Binaries \Win64\ShooterGame_BE.exe
FirewallRules: [{382E2789-7BC3-4A3B-982A-98D06D5FABA9}] => (Allow) E:\Steam\steamapps\common\ARK\ShooterGame\Binaries \Win64\ShooterGame_BE.exe
FirewallRules: [{23CC8488-320F-41FD-A7DB-51D8C5F1BBD0}] => (Allow) E:\Steam\steamapps\common\Alien Isolation\AI.exe
FirewallRules: [{9E2B6E6C-D761-42C7-8054-533EE8B9121D}] => (Allow) E:\Steam\steamapps\common\Alien Isolation\AI.exe
FirewallRules: [{C01E9C4E-BBC0-4636-ADE0-DC5024B5571B}] => (Allow) E:\Steam\steamapps\common\KHOLAT\Kholat.exe
FirewallRules: [{CC009619-4293-4E81-83F7-CCACF57A3BA8}] => (Allow) E:\Steam\steamapps\common\KHOLAT\Kholat.exe
FirewallRules: [{47539AD8-F699-4075-89EA-D4B16DAC6A73}] => (Allow) LPort=1900
FirewallRules: [{60D9618F-9D12-4128-B29C-C49455BE5DA6}] => (Allow) LPort=2869
FirewallRules: [{E1719443-8853-4CC3-9B84-95DD1EC708D1}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{2C0384B5-AB33-4A4E-8D81-C04C16C02762}] => (Allow) E:\Steam\steamapps\common\SunlessSea\Sunless Sea.exe
FirewallRules: [{75FAA455-D3E0-42B7-AF88-FABA47C7AE50}] => (Allow) E:\Steam\steamapps\common\SunlessSea\Sunless Sea.exe
FirewallRules: [{19498042-C076-40DC-91E6-098E3D1C2D36}] => (Allow) E:\Steam\steamapps\common\Howler\Howler.exe
FirewallRules: [{5FA0E1FF-1811-4489-AA53-037F92F270F1}] => (Allow) E:\Steam\steamapps\common\Howler\Howler.exe
FirewallRules: [{1448BA25-590A-41A5-BD28-50B2BBF34D86}] => (Allow) E:\Steam\steamapps\common\Empire TV Tycoon\EmpireTV.exe
FirewallRules: [{7B2B72E1-D744-4AD3-8826-57AED661EAF2}] => (Allow) E:\Steam\steamapps\common\Empire TV Tycoon\EmpireTV.exe
FirewallRules: [{BCE8A236-B2BE-4EE4-82B9-C19E690F610D}] => (Allow) E:\Steam\steamapps\common\Medieval II Total War\medieval2.exe
FirewallRules: [{8A78F142-15D3-421E-8481-A880F1B21F36}] => (Allow) E:\Steam\steamapps\common\Medieval II Total War\medieval2.exe
FirewallRules: [{68C4BA0D-0783-4F45-9E1D-C34CFB96AAFD}] => (Allow) E:\Steam\steamapps\common\MiniMetro\MiniMetro.exe
FirewallRules: [{AA23588A-A03C-44D5-B53E-6723F4F2E201}] => (Allow) E:\Steam\steamapps\common\MiniMetro\MiniMetro.exe
FirewallRules: [{8A7F7C57-A79E-4A75-81E7-B912E8CFCF55}] => (Allow) E:\Steam\steamapps\common\Just Cause 3\JustCause3.exe
FirewallRules: [{4836DFF6-38BF-4A54-A392-CE65079C7F44}] => (Allow) E:\Steam\steamapps\common\Just Cause 3\JustCause3.exe
FirewallRules: [{7B2EEC31-537A-4CF4-89B2-50D583329451}] => (Allow) E:\Steam\steamapps\common\Wargame Red Dragon\WarGame3.exe
FirewallRules: [{AA65D49D-52E3-441A-9A37-C77061AC80DE}] => (Allow) E:\Steam\steamapps\common\Wargame Red Dragon\WarGame3.exe
FirewallRules: [{7724CFD5-31FC-4A19-BD34-B9BA0AF24661}] => (Allow) E:\Steam\steamapps\common\The Swindle\TheSwindle.exe
FirewallRules: [{DC0EF240-DC38-4DA6-84E4-537114BFA7B4}] => (Allow) E:\Steam\steamapps\common\The Swindle\TheSwindle.exe
FirewallRules: [{84F9DC32-5293-4774-B36D-E8F44C44D282}] => (Allow) E:\Steam\steamapps\common\ARK\ShooterGame\Binaries \Win64\ShooterGame.exe
FirewallRules: [{973B707E-89EF-46A6-B5E6-56B2C3DCD6B4}] => (Allow) E:\Steam\steamapps\common\ARK\ShooterGame\Binaries \Win64\ShooterGame.exe
FirewallRules: [{ACA18622-21FD-4017-B61E-9271313A0FEE}] => (Allow) E:\Steam\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{ABA4F3D1-5526-46CB-A929-1E1C7C60D266}] => (Allow) E:\Steam\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{431DAC89-E340-4DD1-96A4-53A33A1A2DF0}] => (Allow) E:\Steam\steamapps\common\Rodina\Rodina_Steam.exe
FirewallRules: [{55D36DCC-D3A6-4256-9C99-CC1A162545CF}] => (Allow) E:\Steam\steamapps\common\Rodina\Rodina_Steam.exe
FirewallRules: [{7CEC57F9-D511-45D9-A137-BEDADCEB920B}] => (Allow) E:\Steam\steamapps\common\This War of Mine\Storyteller.exe
FirewallRules: [{BD430A1E-086F-4F5A-8465-BBF42C5A4DD4}] => (Allow) E:\Steam\steamapps\common\This War of Mine\Storyteller.exe
FirewallRules: [{A27A4A74-5D88-493C-8739-2BAF704539F5}] => (Allow) E:\Steam\steamapps\common\Batman Arkham City GOTY\Binaries\Win32\BatmanAC.exe
FirewallRules: [{75101B1F-92E0-410B-8749-6398C92D4D4E}] => (Allow) E:\Steam\steamapps\common\Batman Arkham City GOTY\Binaries\Win32\BatmanAC.exe
FirewallRules: [UDP Query User{7DA012B3-6B97-4F21-8658-4B432060A4B4}E:\steam\steamapps\common\total war rome ii\rome2.exe] => (Block) E:\steam\steamapps\common\total war rome ii\rome2.exe
FirewallRules: [TCP Query User{788EAAA3-ABF4-4CAC-B9B0-487216940C79}E:\steam\steamapps\common\total war rome ii\rome2.exe] => (Block) E:\steam\steamapps\common\total war rome ii\rome2.exe
FirewallRules: [{B1961B26-11B2-43D1-9298-AD44D596DC72}] => (Allow) E:\Steam\steamapps\common\Overgrowth\Overgrowth.ex e
FirewallRules: [{2C687411-8DE4-4695-9DCD-0DF12ADC43C0}] => (Allow) E:\Steam\steamapps\common\Overgrowth\Overgrowth.ex e
FirewallRules: [{AFC963A7-0506-473D-AB2D-5C34C49A4A7C}] => (Allow) E:\Steam\steamapps\common\Darksiders\DarksidersPC. exe
FirewallRules: [{FA1AE159-6B0F-4876-A169-C92B26F9A330}] => (Allow) E:\Steam\steamapps\common\Darksiders\DarksidersPC. exe
FirewallRules: [{55355503-8C50-477B-997F-87DEA8310D33}] => (Allow) E:\Steam\steamapps\common\Painkiller Hell & Damnation\Binaries\Win32\PKHDGame-Win32-Shipping.exe
FirewallRules: [{6B6E9C02-333B-4A8A-9734-BCF49440A4DB}] => (Allow) E:\Steam\steamapps\common\Painkiller Hell & Damnation\Binaries\Win32\PKHDGame-Win32-Shipping.exe
FirewallRules: [{7731937E-8684-4975-8E03-FA55D25C332E}] => (Allow) E:\Steam\steamapps\common\Painkiller Redemption\Bin\RedemptionEditor.exe
FirewallRules: [{F206052B-3C45-4707-805F-790560B7C060}] => (Allow) E:\Steam\steamapps\common\Painkiller Redemption\Bin\RedemptionEditor.exe
FirewallRules: [{14C76FB4-D54F-422D-8023-ED63982E38E8}] => (Allow) E:\Steam\steamapps\common\Painkiller Redemption\Bin\Redemption.exe
FirewallRules: [{952C38AC-EC59-4BF2-8D31-283764D9BE98}] => (Allow) E:\Steam\steamapps\common\Painkiller Redemption\Bin\Redemption.exe
FirewallRules: [{676F3500-4AE6-42F2-9D98-65554A8CF298}] => (Allow) E:\Steam\steamapps\common\Painkiller Recurring Evil\Bin\RecurringEvilEditor.exe
FirewallRules: [{BDC13F15-7853-4D1F-B348-E0A3BEC95E03}] => (Allow) E:\Steam\steamapps\common\Painkiller Recurring Evil\Bin\RecurringEvilEditor.exe
FirewallRules: [{A0E86BCE-48E5-4214-85B9-907178F127C2}] => (Allow) E:\Steam\steamapps\common\Painkiller Recurring Evil\Bin\RecurringEvil.exe
FirewallRules: [{C8A5645B-B57E-413E-B262-C411168D5B7E}] => (Allow) E:\Steam\steamapps\common\Painkiller Recurring Evil\Bin\RecurringEvil.exe
FirewallRules: [{F116F121-0801-40CC-94BE-10468BB88A9D}] => (Allow) E:\Steam\steamapps\common\Painkiller Overdose\Bin\Overdose.exe
FirewallRules: [{AF480B4E-54B1-40E8-A244-BEE195F052B3}] => (Allow) E:\Steam\steamapps\common\Painkiller Overdose\Bin\Overdose.exe
FirewallRules: [{ED321C58-D48C-4415-9D3C-138EACB185CC}] => (Allow) E:\Steam\steamapps\common\Painkiller Resurrection\bin\Resurrection.exe
FirewallRules: [{AB55824F-9E3F-4FAF-9A06-5B6D40026EBA}] => (Allow) E:\Steam\steamapps\common\Painkiller Resurrection\bin\Resurrection.exe
FirewallRules: [{F904C541-FB04-46E7-BBBF-0D23915A34E4}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{95CDE522-2BC2-4BF6-BB2A-20E988DEB5FF}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{6465FCCE-22EB-4041-85D6-72015B7984F7}] => (Allow) E:\Steam\steamapps\common\Painkiller Black Edition\Bin\Painkiller.exe
FirewallRules: [{02F67D7D-8968-40CB-98A1-F8073253788D}] => (Allow) E:\Steam\steamapps\common\Painkiller Black Edition\Bin\Painkiller.exe
FirewallRules: [UDP Query User{53A68656-E320-4EFB-868F-C3278D7CC6A5}E:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) E:\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [TCP Query User{EB5330A2-FF1A-48B8-9F0C-1CB31701CC34}E:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) E:\steam\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [{B24B36BB-0D98-42A9-80A1-5AA289D88F62}] => (Allow) E:\Steam\steamapps\common\Viscera Cleanup Detail Shadow Warrior\Binaries\Win32\UDK.exe
FirewallRules: [{2E02719A-82A6-44E8-8914-3724A3AAFA5D}] => (Allow) E:\Steam\steamapps\common\Viscera Cleanup Detail Shadow Warrior\Binaries\Win32\UDK.exe
FirewallRules: [UDP Query User{A22DDE37-3357-4F80-9975-662DBD11CD1A}C:\program files (x86)\ea games\battlefield 1942\bf1942_w32ded.exe] => (Block) C:\program files (x86)\ea games\battlefield 1942\bf1942_w32ded.exe
FirewallRules: [TCP Query User{D470F145-DBAB-4712-A507-8CDC5D7A3ABF}C:\program files (x86)\ea games\battlefield 1942\bf1942_w32ded.exe] => (Block) C:\program files (x86)\ea games\battlefield 1942\bf1942_w32ded.exe
FirewallRules: [{5EB6144C-17C7-4A08-807A-B8C7F37B83BF}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{0A8BDE35-C0B0-4BB8-881E-C17E1BF8373B}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{364C1438-B6A9-48FB-B3A0-3A3697EBE5A4}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{A804557F-B272-4CA7-B433-379FB196B77A}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{7871B363-C137-4E69-B738-84BFF793F221}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin’s Creed III\AC3MP.exe
FirewallRules: [{E5E38B0F-C356-4961-BB23-A5B9992B1721}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin’s Creed III\AC3MP.exe
FirewallRules: [{2F32C1BD-026D-440F-BB09-1D284E8E5D5C}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin’s Creed III\AC3SP.exe
FirewallRules: [{19285886-F36F-4AA2-A87B-D274DF754BC5}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin’s Creed III\AC3SP.exe
FirewallRules: [{D55C3026-CF01-435E-B93D-A18323811FCE}] => (Allow) E:\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{7A2B3893-9D9F-4F61-BFF9-F15E19D8DC9F}] => (Allow) E:\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{AB3F07B5-EBE6-41E2-B1D8-E78923D237C0}] => (Allow) E:\Steam\steamapps\common\CoJ Gunslinger\CoJGunslinger.exe
FirewallRules: [{6EE8DADD-2048-464C-96D2-7D0833C95672}] => (Allow) E:\Steam\steamapps\common\CoJ Gunslinger\CoJGunslinger.exe
FirewallRules: [{0CB3D29E-2E0A-4E9B-95D0-C4A980D5327A}] => (Allow) E:\Steam\steamapps\common\The Walking Dead Season Two\TheWalkingDead2.exe
FirewallRules: [{693D7A94-643D-4768-8487-584E083B7AB8}] => (Allow) E:\Steam\steamapps\common\The Walking Dead Season Two\TheWalkingDead2.exe
FirewallRules: [{DEC7CCFF-5B51-4CC1-9C65-88A5D725D2B4}] => (Allow) E:\Steam\steamapps\common\The Walking Dead\WalkingDead101.exe
FirewallRules: [{A4A35749-46A6-4DC8-BC81-C0CF3E2F9ED1}] => (Allow) E:\Steam\steamapps\common\The Walking Dead\WalkingDead101.exe
FirewallRules: [{804661D2-E50A-4486-8AEB-94E0197928D0}] => (Allow) E:\Steam\steamapps\common\Westerado\WesteradoDB.ex e
FirewallRules: [{B1F63AFE-4C8D-44D3-9F9B-AF879136B157}] => (Allow) E:\Steam\steamapps\common\Westerado\WesteradoDB.ex e
FirewallRules: [{54409E8C-8D01-4435-BA9C-5CEC57CCED21}] => (Allow) E:\Steam\steamapps\common\Naval War Arctic Circle\NWAC.exe
FirewallRules: [{44C58591-853D-4720-BECF-BFA5C33AB711}] => (Allow) E:\Steam\steamapps\common\Naval War Arctic Circle\NWAC.exe
FirewallRules: [{9604FC57-4CCF-4D1C-8B0D-018E398B9CF0}] => (Allow) E:\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{2F984FA6-3F9F-4BD4-8888-78EFD19DE263}] => (Allow) E:\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{D66E2B93-4647-4F74-B284-6451632088AB}] => (Allow) E:\Steam\steamapps\common\PapersPlease\PapersPleas e.exe
FirewallRules: [{06E982CE-5605-4D95-90A6-7CF3E266E380}] => (Allow) E:\Steam\steamapps\common\PapersPlease\PapersPleas e.exe
FirewallRules: [{F9C922EC-ADA5-4083-833F-0459141144D4}] => (Allow) E:\Steam\steamapps\common\Prison Architect\Prison Architect.exe
FirewallRules: [{92EDC087-8DD4-4A74-B13F-E9906D60F831}] => (Allow) E:\Steam\steamapps\common\Prison Architect\Prison Architect.exe
FirewallRules: [{56EB12E4-9BAF-4B45-BD1F-DEBBD5DCDBAC}] => (Allow) E:\Steam\steamapps\common\Red Orchestra 2\Binaries\Win32\ROGame.exe
FirewallRules: [{FCBA4FE5-9243-40BA-BB38-6B67E60F213D}] => (Allow) E:\Steam\steamapps\common\Red Orchestra 2\Binaries\Win32\ROGame.exe
FirewallRules: [{58155C47-495C-49B8-A90B-5C0EBDF2EF90}] => (Allow) E:\Steam\steamapps\common\Orion Dino Beatdown\Binaries\Win32\DinoHordeGame.exe
FirewallRules: [{A9A66C06-6376-4396-A3DC-E40364C946E2}] => (Allow) E:\Steam\steamapps\common\Orion Dino Beatdown\Binaries\Win32\DinoHordeGame.exe
FirewallRules: [{423B688C-6B43-4659-A471-03B66F857889}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3y.exe
FirewallRules: [{A5FE7682-0818-4E8B-A6A6-566EFADADD08}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3y.exe
FirewallRules: [{F796B4B4-1F7A-4D24-BF22-321C3FDB3B82}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3x.exe
FirewallRules: [{BD5D063E-88CC-4F0D-8F95-D7CEDD5AD206}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3x.exe
FirewallRules: [{D1A87504-C435-417C-86F4-D59C69BC93FE}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3.exe
FirewallRules: [{BA7A361D-9F1D-4EFA-A38D-5D6882D29FCC}] => (Allow) E:\Steam\steamapps\common\Age Of Empires 3\bin\age3.exe
FirewallRules: [{91F89AC4-A129-48FC-94BC-F35D776CAE86}] => (Allow) E:\Steam\steamapps\common\Cities_Skylines\Cities.e xe
FirewallRules: [{3C0CD397-9564-4C57-9D41-3D509FB05038}] => (Allow) E:\Steam\steamapps\common\Cities_Skylines\Cities.e xe
FirewallRules: [{98A9F175-A368-447B-A476-6FE06EB697C3}] => (Allow) E:\Steam\steamapps\common\Tropico 5\Tropico5Steam.exe
FirewallRules: [{764C05F9-A332-43B9-B574-D4F08F7B3439}] => (Allow) E:\Steam\steamapps\common\Tropico 5\Tropico5Steam.exe
FirewallRules: [{B4DE6F08-1B7C-4D44-80D9-BE2A38AE2248}] => (Allow) E:\Steam\steamapps\common\Call of Duty Modern Warfare 2\iw4mp.exe
FirewallRules: [{845441F0-26A1-40B0-B629-E29F9727F9A8}] => (Allow) E:\Steam\steamapps\common\Call of Duty Modern Warfare 2\iw4mp.exe
FirewallRules: [{30A0B135-5594-4B3C-8404-61C6202662D9}] => (Allow) E:\Steam\steamapps\common\Call of Duty Black Ops II\t6zm.exe
FirewallRules: [{3FC3BB9A-7D73-403D-9275-3D94B9D1CF20}] => (Allow) E:\Steam\steamapps\common\Call of Duty Black Ops II\t6zm.exe
FirewallRules: [{33539671-9902-49CD-A955-A6015D31B8FD}] => (Allow) E:\Steam\steamapps\common\Call of Duty Black Ops II\t6mp.exe
FirewallRules: [{28A32418-C6DD-478C-B02A-79C985CC886F}] => (Allow) E:\Steam\steamapps\common\Call of Duty Black Ops II\t6mp.exe
FirewallRules: [{53A21B22-39F1-42E1-9F3E-BD7DD301A94F}] => (Allow) E:\Steam\steamapps\common\Call of Duty Black Ops II\t6sp.exe
FirewallRules: [{855630AF-4C15-47F4-ABF6-6A7C0AC746F7}] => (Allow) E:\Steam\steamapps\common\Call of Duty Black Ops II\t6sp.exe
FirewallRules: [{FE0A8470-16EA-4E40-8DBB-45458AF0270D}] => (Allow) E:\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{5CC95C32-BF65-44F3-BCBC-4EDCC6E05E23}] => (Allow) E:\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{2C26FEBC-10A7-44E2-916E-59EA27E7044B}] => (Allow) E:\Steam\steamapps\common\mirrors edge\Binaries\MirrorsEdge.exe
FirewallRules: [{8B59C55D-83D0-4872-8980-A584B27F34E4}] => (Allow) E:\Steam\steamapps\common\mirrors edge\Binaries\MirrorsEdge.exe
FirewallRules: [{E91416FA-3457-420C-8994-ECEA842EF326}] => (Allow) E:\Steam\steamapps\common\Call of Duty Modern Warfare 2\iw4sp.exe
FirewallRules: [{1375463C-EF0E-4B54-B07A-83DB04375CBC}] => (Allow) E:\Steam\steamapps\common\Call of Duty Modern Warfare 2\iw4sp.exe
FirewallRules: [{B94486E4-B0C8-4DCE-BB9E-07D2C1820114}] => (Allow) E:\Steam\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{E3A2D27F-63F4-46AB-84A8-44607939B9D3}] => (Allow) E:\Steam\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{7B0149ED-B97A-42EE-9346-C611D26C9072}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Source\hl2.exe
FirewallRules: [{9C3B6A05-CC77-4942-84D6-596B1741B647}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Source\hl2.exe
FirewallRules: [{2C5D83FD-7932-4CE6-8000-03AD3F984EC9}] => (Allow) E:\Steam\steamapps\common\Metro Last Light Redux\metro.exe
FirewallRules: [{70BD0A05-1395-4653-B229-C9C5D1823040}] => (Allow) E:\Steam\steamapps\common\Metro Last Light Redux\metro.exe
FirewallRules: [{5D0E83A1-ABC4-4B52-BC6B-D4A69DC05E56}] => (Allow) E:\Steam\steamapps\common\Metro 2033 Redux\metro.exe
FirewallRules: [{568030BA-AF9D-4F61-84C3-D55975D24193}] => (Allow) E:\Steam\steamapps\common\Metro 2033 Redux\metro.exe
FirewallRules: [{7D794E2A-B161-4FA1-9597-D301EEF1F79E}] => (Allow) E:\Steam\steamapps\common\Shadow Warrior\sw.exe
FirewallRules: [{A1898A9F-D477-4248-8360-299E5E912075}] => (Allow) E:\Steam\steamapps\common\Shadow Warrior\sw.exe
FirewallRules: [{88138129-409E-4C8A-877A-9ADA8EB205FD}] => (Allow) E:\Steam\steamapps\common\Shadow Warrior\dx11\launcher.exe
FirewallRules: [{8C81187B-7DA3-4FEB-AEA5-43C070B8CD3C}] => (Allow) E:\Steam\steamapps\common\Shadow Warrior\dx11\launcher.exe
FirewallRules: [{CE65FD72-AAF6-43EB-BC91-DFC7DB02622E}] => (Allow) E:\Steam\steamapps\common\Skyrim\SkyrimLauncher.ex e
FirewallRules: [{C05D7E65-7A05-47BD-938D-47FD5E6A793E}] => (Allow) E:\Steam\steamapps\common\Skyrim\SkyrimLauncher.ex e
FirewallRules: [{F89D9D8B-8F5F-405E-AF70-93085D9EB57D}] => (Allow) E:\Steam\steamapps\common\MountBlade Warband\mb_warband.exe
FirewallRules: [{1B85F771-A5F4-419E-A0A9-1A55AF524C47}] => (Allow) E:\Steam\steamapps\common\MountBlade Warband\mb_warband.exe
FirewallRules: [{B2E61692-2D3E-4EEC-A408-7710A6754F4F}] => (Allow) E:\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe
FirewallRules: [{C713DF62-9D39-4BBB-AB66-7F340A4B299C}] => (Allow) E:\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe
FirewallRules: [{F029FA80-2EE1-4D56-BA7F-4DCB400E9DDD}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ ChivLauncher.exe
FirewallRules: [{4A79F3FB-2D3A-447F-B98F-B921BF91B69F}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ ChivLauncher.exe
FirewallRules: [{5CF3CCFE-06D4-420E-92C7-97306CC9BDCE}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ Binaries\Win32\CMW.exe
FirewallRules: [{83CF1D96-3135-43E9-88AB-767C9827B614}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ Binaries\Win32\CMW.exe
FirewallRules: [{2D4FF11C-A0D9-4586-B8DC-0CD9B2847568}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ Binaries\Win64\CMW.exe
FirewallRules: [{6362D936-34F4-46EC-A216-7E26B633D0FF}] => (Allow) E:\Steam\steamapps\common\chivalrymedievalwarfare\ Binaries\Win64\CMW.exe
FirewallRules: [{04A283E1-D779-4F09-8738-B4876DB4755C}] => (Allow) E:\Steam\steamapps\common\SpaceEngineers\Bin64\Spa ceEngineers.exe
FirewallRules: [{EDB56842-6095-4389-B899-09D9209F549A}] => (Allow) E:\Steam\steamapps\common\SpaceEngineers\Bin64\Spa ceEngineers.exe
FirewallRules: [{12C5A99E-B3D5-467D-B389-384F58ED69AA}] => (Allow) E:\Steam\steamapps\common\Universe Sandbox 2\Universe Sandbox x64.exe
FirewallRules: [{176DDD3E-79FC-4279-9D45-3CA417DBCEE6}] => (Allow) E:\Steam\steamapps\common\Universe Sandbox 2\Universe Sandbox x64.exe
FirewallRules: [{3D7F4B70-337C-4710-8161-6868FCA7E18D}] => (Allow) E:\Steam\steamapps\common\Besiege\Besiege.exe
FirewallRules: [{DAFBB32B-1CDB-438F-A697-592636C7D7BE}] => (Allow) E:\Steam\steamapps\common\Besiege\Besiege.exe
FirewallRules: [{3BECF9E9-4FFD-4743-9464-486B115D6D40}] => (Allow) E:\Steam\steamapps\common\Depth\Binaries\Win32\Dep thGame.exe
FirewallRules: [{4B9B38DB-A288-442A-86C6-3EBCA7214BA2}] => (Allow) E:\Steam\steamapps\common\Depth\Binaries\Win32\Dep thGame.exe
FirewallRules: [{78E8D1FF-A533-4DC3-971B-F014C9CF2B28}] => (Allow) E:\Steam\steamapps\common\This War of Mine\This War of Mine.exe
FirewallRules: [{38951131-905C-47D2-B57B-646DF9AADFA1}] => (Allow) E:\Steam\steamapps\common\This War of Mine\This War of Mine.exe
FirewallRules: [{9E1F2C96-4CF6-4FEF-8331-647E4CED1B16}] => (Allow) E:\Steam\steamapps\common\Bugbear Entertainment\Wreckfest_x64.exe
FirewallRules: [{77CD7DBC-6942-4274-AAFD-3A837CF21061}] => (Allow) E:\Steam\steamapps\common\Bugbear Entertainment\Wreckfest_x64.exe
FirewallRules: [{104AE981-B2B4-4886-B8C5-EE4D7BDA5444}] => (Allow) E:\Steam\steamapps\common\Bugbear Entertainment\Wreckfest.exe
FirewallRules: [{8119A035-E01C-4CA3-ADAF-1860F7D7EA94}] => (Allow) E:\Steam\steamapps\common\Bugbear Entertainment\Wreckfest.exe
FirewallRules: [{E9C9F9D0-3476-4460-A873-90D8AA57D5D3}] => (Allow) E:\Steam\steamapps\common\The Forest\TheForest.exe
FirewallRules: [{96A7F6FB-9BD8-40D8-BF64-E38D9DE0472E}] => (Allow) E:\Steam\steamapps\common\The Forest\TheForest.exe
FirewallRules: [{EBE05BB2-F9B8-4AF4-99E2-3608D687FE23}] => (Allow) E:\Steam\steamapps\common\Stranded Deep\Stranded_Deep_x64.exe
FirewallRules: [{383E091B-2E89-4D53-AE71-350CEA730633}] => (Allow) E:\Steam\steamapps\common\Stranded Deep\Stranded_Deep_x64.exe
FirewallRules: [{29253754-6C95-4AE9-986C-B3824E346FF5}] => (Allow) E:\Steam\steamapps\common\Betrayer\Binaries\Win32\ Betrayer.exe
FirewallRules: [{DFDF93C6-D21F-42E3-8A41-B56CA7C3826F}] => (Allow) E:\Steam\steamapps\common\Betrayer\Binaries\Win32\ Betrayer.exe
FirewallRules: [{E5C7965B-9AF7-4E1A-BB56-A77576D86147}] => (Allow) C:\Users\Alex\AppData\Local\Microsoft\OneDrive\One Drive.exe
FirewallRules: [{727C172C-ED74-4700-ABB0-AFB2AC7D9945}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{080DF596-7203-4A93-9043-04A70CB70A8A}] => (Allow) E:\Steam\Steam.exe
FirewallRules: [{465E9387-B3EE-4411-B1AD-6590229DF0C3}] => (Allow) E:\Steam\Steam.exe
FirewallRules: [{8677223F-9F95-476C-AADF-4BA6FB66354B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{56F92C8B-8C50-4B2A-9000-8BB63914D2A9}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{2C1C6E47-7BFA-42E3-8C88-DE6D30269842}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{605C3DF9-4246-4773-84CF-9831FF734C22}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{78D55DC1-318C-4CCF-96AD-466B34F9BD3B}] => (Allow) E:\Steam\steamapps\common\American Truck Simulator\bin\win_x64\amtrucks.exe
FirewallRules: [{82A7C749-EFF2-4FC8-BEA2-F60234722A3E}] => (Allow) E:\Steam\steamapps\common\American Truck Simulator\bin\win_x64\amtrucks.exe
FirewallRules: [{9289FCA1-40AE-4A93-B3D4-EB855DE9B8FF}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{6A684CB5-FA9F-46D5-8EB9-42B1A50241FC}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{3FAE821B-F0C8-4AD1-9F0C-33CD07C80D13}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [{DC8BBF33-0B86-4200-9305-42A8F751ECF9}] => (Allow) E:\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [{31CB8B80-E386-428D-87FD-0516F871FCDC}] => (Allow) E:\Steam\steamapps\common\Reus\Reus.exe
FirewallRules: [{DAD8A397-D99A-416E-9581-4672D4456CBB}] => (Allow) E:\Steam\steamapps\common\Reus\Reus.exe
FirewallRules: [{3C406D74-9AAD-41CD-938F-D817F2A51B38}] => (Allow) E:\Steam\steamapps\common\FTL Faster Than Light\FTLGame.exe
FirewallRules: [{CAF31C4F-7A74-41F3-8DDD-E12903D2645A}] => (Allow) E:\Steam\steamapps\common\FTL Faster Than Light\FTLGame.exe
FirewallRules: [{F1B3BD40-3A40-438D-9CBF-03F463B6E564}] => (Allow) E:\Steam\steamapps\common\Verdun\Verdun.exe
FirewallRules: [{E04E4B65-01E2-4C95-9C3A-4C7B22E90D37}] => (Allow) E:\Steam\steamapps\common\Verdun\Verdun.exe
FirewallRules: [{4B9C5204-0B03-45DC-86BD-F0114E09098A}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{A3CF985B-8C0F-4F3E-A71C-40FD10804A60}] => (Allow) E:\Steam\steamapps\common\Beholder\Beholder.exe
FirewallRules: [{FA67FAE5-3293-4611-96D4-09CF58E2ECCE}] => (Allow) E:\Steam\steamapps\common\Beholder\Beholder.exe
FirewallRules: [{2F540637-86A1-4C2D-BF3E-1C27CB81DC51}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{90CF0C0D-0C57-46D6-BBB2-7A218DDFABB3}] => (Allow) E:\Steam\steamapps\common\Verdun\1914-1918 Series.exe
FirewallRules: [{141B6738-DCE9-4AE5-98E3-04DE40839D72}] => (Allow) E:\Steam\steamapps\common\Verdun\1914-1918 Series.exe
FirewallRules: [{46C7AABE-DCB5-46A4-B965-A9F509607A80}] => (Allow) E:\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe
FirewallRules: [{12C7ACC7-5533-49BB-B8BC-363B493E5DC5}] => (Allow) E:\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe
FirewallRules: [{F50FD054-5F20-408A-B270-ABB2A7EB1D96}] => (Allow) E:\Steam\steamapps\common\Total War Attila\launcher\launcher.exe
FirewallRules: [{D43A379E-E6DF-4504-BBB1-9AB9E29A0FD1}] => (Allow) E:\Steam\steamapps\common\Total War Attila\launcher\launcher.exe
FirewallRules: [{AFD591AC-CACE-4CC4-ADE9-79A000FD507C}] => (Allow) E:\Steam\steamapps\common\Total War Rome II\launcher\launcher.exe
FirewallRules: [{A40E91AC-62A0-4025-A742-323663882DD5}] => (Allow) E:\Steam\steamapps\common\Total War Rome II\launcher\launcher.exe

==================== Restore Points =========================

08-09-2017 12:52:43 JRT Pre-Junkware Removal
09-09-2017 03:00:20 Windows Update
09-09-2017 17:27:36 Installed DirectX
11-09-2017 03:00:20 Windows Update
12-09-2017 03:00:20 Windows Update
13-09-2017 03:00:19 Windows Update
14-09-2017 03:00:20 Windows Update

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================
[HEADING=1]Application errors:[/HEADING]
Error: (09/14/2017 09:03:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (09/14/2017 09:03:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: nvstreamsvc.exe, version: 4.0.1000.0, time stamp: 0x54b5dc94
Faulting module name: nvstreamsvc.exe, version: 4.0.1000.0, time stamp: 0x54b5dc94
Exception code: 0x40000015
Fault offset: 0x00000000003e81fa
Faulting process id: 0x7fc
Faulting application start time: 0x01d32d947923fe9f
Faulting application path: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
Faulting module path: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
Report Id: c010acb2-9987-11e7-b002-fcaa14c32797

Error: (09/14/2017 06:09:40 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for “c:\program files (x86)\Adobe\adobe creative cloud\Utils\Creative Cloud Uninstaller.exe”.Error in manifest or policy file “” on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows. common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e8 55142bd5705d.manifest.
Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.window s.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b 1e3d17594757.manifest.

Error: (09/14/2017 06:07:25 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Activation context generation failed for “c:\program files (x86)\microsoft office\root\Office16\lync.exe.Manifest”.Error in manifest or policy file “c:\program files (x86)\microsoft office\root\Office16\UccApi.DLL” on line 1.
Component identity found in manifest does not match the identity of the component requested.
Reference is UccApi,processorArchitecture=“AMD64”,type=“win32”, version=“16.0.0.0”.
Definition is UccApi,processorArchitecture=“x86”,type=“win32”,ve rsion=“16.0.0.0”.
Please use sxstrace.exe for detailed diagnosis.

Error: (09/13/2017 11:51:26 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (09/13/2017 11:51:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: nvstreamsvc.exe, version: 4.0.1000.0, time stamp: 0x54b5dc94
Faulting module name: nvstreamsvc.exe, version: 4.0.1000.0, time stamp: 0x54b5dc94
Exception code: 0x40000015
Fault offset: 0x00000000003e81fa
Faulting process id: 0x70c
Faulting application start time: 0x01d32ce2c1e83578
Faulting application path: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
Faulting module path: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
Report Id: 08c93b28-98d6-11e7-b8c2-fcaa14c32797

Error: (09/13/2017 03:20:40 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for “c:\program files (x86)\Adobe\adobe creative cloud\Utils\Creative Cloud Uninstaller.exe”.Error in manifest or policy file “” on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows. common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e8 55142bd5705d.manifest.
Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.window s.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b 1e3d17594757.manifest.

Error: (09/13/2017 03:20:32 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Activation context generation failed for “c:\program files (x86)\microsoft office\root\Office16\lync.exe.Manifest”.Error in manifest or policy file “c:\program files (x86)\microsoft office\root\Office16\UccApi.DLL” on line 1.
Component identity found in manifest does not match the identity of the component requested.
Reference is UccApi,processorArchitecture=“AMD64”,type=“win32”, version=“16.0.0.0”.
Definition is UccApi,processorArchitecture=“x86”,type=“win32”,ve rsion=“16.0.0.0”.
Please use sxstrace.exe for detailed diagnosis.

Error: (09/12/2017 04:07:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for “c:\program files (x86)\Adobe\adobe creative cloud\Utils\Creative Cloud Uninstaller.exe”.Error in manifest or policy file “” on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows. common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e8 55142bd5705d.manifest.
Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.window s.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b 1e3d17594757.manifest.

Error: (09/12/2017 04:06:35 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Activation context generation failed for “c:\program files (x86)\microsoft office\root\Office16\lync.exe.Manifest”.Error in manifest or policy file “c:\program files (x86)\microsoft office\root\Office16\UccApi.DLL” on line 1.
Component identity found in manifest does not match the identity of the component requested.
Reference is UccApi,processorArchitecture=“AMD64”,type=“win32”, version=“16.0.0.0”.
Definition is UccApi,processorArchitecture=“x86”,type=“win32”,ve rsion=“16.0.0.0”.
Please use sxstrace.exe for detailed diagnosis.
[HEADING=1]System errors:[/HEADING]
Error: (09/14/2017 09:04:06 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the RunSwUSB service.

Error: (09/14/2017 09:03:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The NVIDIA Streamer Service service terminated unexpectedly. It has done this 1 time(s).

Error: (09/14/2017 09:03:33 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Origin Web Helper Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (09/14/2017 09:03:33 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Origin Web Helper Service service to connect.

Error: (09/14/2017 09:03:02 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has failed to start.

Module Path: C:\Windows\system32\Rtlihvs.dll
Error Code: 126

Error: (09/14/2017 07:37:12 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 11 for Windows 7 for x64-based Systems.

Error: (09/13/2017 11:51:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The NVIDIA Streamer Service service terminated unexpectedly. It has done this 1 time(s).

Error: (09/13/2017 11:51:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Origin Web Helper Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (09/13/2017 11:51:25 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Origin Web Helper Service service to connect.

Error: (09/13/2017 11:50:55 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has failed to start.

Module Path: C:\Windows\system32\Rtlihvs.dll
Error Code: 126

==================== Memory info ===========================

Processor: Intel(R) Core™ i7-4790K CPU @ 4.00GHz
Percentage of memory in use: 19%
Total physical RAM: 32629.22 MB
Available physical RAM: 26116.39 MB
Total Virtual: 65256.63 MB
Available Virtual: 57952.35 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:227.02 GB) (Free:57.09 GB) NTFS
Drive e: () (Fixed) (Total:1863.01 GB) (Free:486.36 GB) NTFS

==================== MBR & Partition Table ==================

================================================== ======
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 6D21D437)
Partition 1: (Active) - (Size=5.9 GB) - (Type=27)
Partition 2: (Not Active) - (Size=227 GB) - (Type=07 NTFS)

================================================== ======
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: A0B47ED7)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

**jmarket** · 09-15-2017, 03:27 AM

Hello 10months, please allow me a little time to check your log, but in the meantime I notice your logs prior to this one all refer to the administrator as “Dan” whereas this latest log lists the admin as “Alex” with no reference to Dan anywhere. Can you please advise how this came about?

**10months** · 09-15-2017, 09:59 AM

In the first log I changed the name to Dan.

**jmarket** · 09-16-2017, 02:48 AM

This can make things very difficult, if not impossible to help you, we will now have to start afresh, although our concern now is what else has been changed. Why does the list of installed programs have differences also in two recently obtained logs?

**10months** · 09-16-2017, 11:30 AM

Sorry about this. I don’t know why there are differences, the only things I’ve changed this whole time is the name in some earlier logs, the name of the computer, and in one of the logs I removed a link including the name of the school I used to go to - but I think I marked where I did that - so I didn’t change anything I thought would be necessary. I have not tampered with installed programs or anything else like that. Is it possible the changes are due to things such as games I deleted or updated between the two logs?

Also, as a side note, gifs aren’t work now - I don’t know if this was the case from the start, but I don’t think it is, “class not registered”

**jmarket** · 09-16-2017, 11:35 PM

If we start again will you agree to not change any computer users, or settings unless asked by us. Will you also agree to not remove, install, or update any software, and not to change any logs produced by any tools, until we give you the all clear?

Please respond to the above before we proceed.

**10months** · 09-16-2017, 11:52 PM

Ah, Christ, I see… When you had me enter code into the ZHPfix…
Alright then, by start again, you mean completely from the beginning, or… Could I just swap back the names on that code and go on from there?

Many games and apps broken

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment