Solved UC Chinese Virus

  • Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
    We have Experts in all areas of Tech, including Malware Removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.

    Why not Click Here To Sign Up and start enjoying great FREE Tech Support.

    This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
  • Hello everyone We want to personally apologize to everyone for the downtime that we've experienced. We are working to get everything back up as quickly as possible. Due to the issues we've had, your password will need to be reset. Please click the button that says "Forgot Your Password" and change it. We are working to have things back to normal. Emails are fixed and should now send properly. Thank you all for your patience. Thanks, PCHF Management
Status
Not open for further replies.
I

Iaro96

PCHF Member
Nov 28, 2016
64
12
32
Hello, I need help! I was trying to install a free software when I ran a suspicious exe file (I feel really dumb and regretful about it.) A War game thing popped up on my desktop together with another program with a yellow squirrel and Chinese name. Now there's an icon overlayed on my screen, my google chrome seems hijacked, and my computer is dead slow. Also hamachi launched and updated by itself and also two game launchers shortcut on my desktop were duplicated. Would appreciate if someone helped me remove it! Please.

I've read about it, but it seems more complicated than anything I've dealt with.
I'm using Windows 10 (ver. 10.0.14393 Build 14393)
 
Welcome to PCHF :)

Please download the FRST 32 bit or FRST 64bit version to suit your operating system. It is important FRST is downloaded to your desktop.

If you are unsure if your operating system is 32 or 64 Bit please go HERE.

Once downloaded right click the FRST desktop icon and select "Run as administrator" from the menu"

icon2-jpg.794


If you receive any security warnings, or the User Account Control warning opens at any time whilst using FRST you can safely allow FRST to proceed.
FRST will open with two dialogue boxes, accept the disclaimer.

frst-disclaimer-jpg.795

  1. Accept the default whitelist options,
  2. If the additions.txt options box is not checked please select it.
  3. Then select Scan

frst-jpg.796


Frst will take a few minutes to scan your computer, and when finished will produce two log files on your desktop, FRST.txt, and Addition.txt. They will display immediately on the desktop, but can be reopened later as a notepad file.

2016-08-12_152002-jpg.797


Please Copy and Paste the contents of these logs in your next post for review
 
Last edited by a moderator:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-11-2016
Ran by Ivan Reyes Ortega (administrator) on HOMEPC (28-11-2016 08:56:29)
Running from C:\Users\Ivan Reyes Ortega\Downloads
Loaded Profiles: Ivan Reyes Ortega & Guest (Available Profiles: Joanne & Ivan Reyes Ortega & Guest)
Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Autodesk Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(Microsoft) C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe
(Microsoft) C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe
(Microsoft) C:\Program Files (x86)\Lenovo\GamePortal\Services\IdeaTouch.LocalDataServer.Game.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Popcorn Time) C:\Program Files (x86)\Popcorn Time\Updater.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
() C:\Program Files\GoPro\GoPro Desktop App\GoProDeviceDetection.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE
() C:\Program Files\MATLAB\MATLAB Production Server\R2015a\bin\win64\MATLABStartupAccelerator.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.233.765.0.exe
(Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
() C:\Program Files\GoPro\GoPro Desktop App\GoProDesktopSystemTray.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Spotify Ltd) C:\Users\Ivan Reyes Ortega\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\Bluestacks\HD-Agent.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Quanta Computer Inc.) C:\Program Files (x86)\Lenovo\Lenovo BrgVolOSD\BrgVolOSD.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Silver Silk Wireless Keyboard\skd8861.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Microsoft Corporation) C:\Windows\System32\LocationNotificationWindows.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Skillbrains) C:\Program Files (x86)\Skillbrains\lightshot\5.4.0.1\Lightshot.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Akamai Technologies, Inc.) C:\Users\Ivan Reyes Ortega\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Ivan Reyes Ortega\AppData\Local\Akamai\netsession_win.exe
() C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\DBUpdater.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\ielowutil.exe
(Microsoft Corporation) C:\Windows\System32\cscript.exe
(Microsoft Corporation) C:\Windows\System32\cscript.exe


==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12937872 2012-07-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-07-10] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-07-26] (Apple Inc.)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-10-01] (Microsoft Corporation)
HKLM\...\Run: [GoPro Tray App] => C:\Program Files\GoPro\GoPro Desktop App\GoProDesktopSystemTray.exe [866224 2016-10-11] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [OSD Utility] => C:\Program Files (x86)\Lenovo\Lenovo BrgVolOSD\BrgVolOSD.exe [18276352 2012-05-21] (Quanta Computer Inc.)
HKLM-x32\...\Run: [Lenovo Silver Silk Wireless Keyboard] => C:\Program Files (x86)\Lenovo\Lenovo Silver Silk Wireless Keyboard\skd8861.exe [392192 2012-02-17] (Lenovo)
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2012-07-27] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167024 2012-07-27] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [LVT] => C:\Program Files\Lenovo\LVT\LJYZ.exe [886112 2011-11-24] (Lenovo)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2016-07-05] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-03-17] (Apple Inc.)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [619008 2010-05-25] (Nikon Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ADSKAppManager] => C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe [493960 2014-12-04] (Autodesk Inc.)
HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [225944 2016-07-11] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1065968 2015-07-23] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1928776 2016-11-09] (APN)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5565960 2016-11-11] (LogMeIn Inc.)
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1080104 2014-09-19] (Apple Inc.)
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Run: [Akamai NetSession Interface] => C:\Users\Ivan Reyes Ortega\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1310088 2015-01-27] (Autodesk, Inc.)
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Run: [Spotify Web Helper] => C:\Users\Ivan Reyes Ortega\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2018360 2015-08-23] (Spotify Ltd)
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\Bluestacks\HD-Agent.exe [974360 2016-07-21] (BlueStack Systems, Inc.)
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Run: [Discord] => C:\Users\Ivan Reyes Ortega\AppData\Local\Discord\app-0.0.296\Discord.exe [62471352 2016-08-24] (Hammer & Chisel, Inc.)
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Policies\Explorer: []
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1407912 2016-10-25] (Garmin Ltd. or its subsidiaries)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Ivan Reyes Ortega\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\amd64\FileSyncShell64.dll [2016-10-02] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Ivan Reyes Ortega\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\amd64\FileSyncShell64.dll [2016-10-02] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Ivan Reyes Ortega\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\amd64\FileSyncShell64.dll [2016-10-02] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\WINDOWS\system32\AcSignIcon.dll [2015-02-06] (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Ivan Reyes Ortega\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\FileSyncShell.dll [2016-10-02] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Ivan Reyes Ortega\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\FileSyncShell.dll [2016-10-02] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Ivan Reyes Ortega\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\FileSyncShell.dll [2016-10-02] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GoPro Importer.lnk [2015-01-07]
ShortcutTarget: GoPro Importer.lnk -> C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe (No File)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2014-02-14]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP DeskJet 1110 series.lnk [2016-11-28]
ShortcutTarget: Monitor Ink Alerts - HP DeskJet 1110 series.lnk -> C:\Program Files\HP\HP DeskJet 1110 series\Bin\HPStatusBL.dll (Hewlett-Packard Development Company, LP)
GroupPolicy: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{0d7355bc-6532-4c94-b735-8764407bd143}: [DhcpNameServer] 10.0.0.1
Tcpip\..\Interfaces\{525cffb3-8591-47ea-ada6-08e77e367fc4}: [DhcpNameServer] 192.168.43.1

Internet Explorer:
==================
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://home.lenovo.com
SearchScopes: HKLM -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-2198469641-46685643-2895634536-1004 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-2198469641-46685643-2895634536-1004 -> {89905693-D965-4436-8806-234F772945FF} URL = hxxp://www.search.ask.com/web?tpid=ATU3-C2-MG&o=APN11391&pf=V7&p2=^BAY^YYYYYY^CA^DO&gct=&itbv=12.38.0.3432&apn_uid=5CA1A7FE-655C-43C4-A49C-B8E73E9813F2&apn_ptnrs=^BAY&apn_dtid=^YYYYYY^CA^DO&apn_dbr=microsoftedge.exe_6_20.10240.16384.0&doi=2016-01-16&trgb=CR&q={searchTerms}&psv=&pt=tb
BHO: Media Search App by Ask -> {41545533-2D43-322D-4D47-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU3-C2-MG\Passport_x64.dll [2016-11-09] (APN LLC.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO-x32: Media Search App by Ask -> {41545533-2D43-322D-4D47-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU3-C2-MG\Passport.dll [2016-11-09] (APN LLC.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-08-20] (Oracle Corporation)
BHO-x32: Glass Bottle -> {88803a01-4125-443b-b869-4062a160ceea} -> C:\Program Files (x86)\Glass Bottle\Extensions\88803a01-4125-443b-b869-4062a160ceea.dll => No File
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-20] (Oracle Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM - Media Search App by Ask - {41545533-2D43-322D-4D47-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU3-C2-MG\Passport_x64.dll [2016-11-09] (APN LLC.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM-x32 - Media Search App by Ask - {41545533-2D43-322D-4D47-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU3-C2-MG\Passport.dll [2016-11-09] (APN LLC.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)
Toolbar: HKU\S-1-5-21-2198469641-46685643-2895634536-1004 -> Media Search App by Ask - {41545533-2D43-322D-4D47-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU3-C2-MG\Passport_x64.dll [2016-11-09] (APN LLC.)
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2016-09-23] (Skype Technologies)

FireFox:
========
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK => not found
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-22] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-22] (VideoLAN)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()
FF Plugin-x32: @exent.com/npExentControl,version=7.1.0.1 -> C:\Program Files (x86)\FreeRide Games\npExentControl.dll [2010-10-18] (Exent Technologies Ltd.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-07-26] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-07-26] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-08-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-08-20] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll [2015-03-12] (Nexon)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll [2012-12-14] (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-12-17] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2198469641-46685643-2895634536-1004: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Ivan Reyes Ortega\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-09-05] (Unity Technologies ApS)

Chrome:
=======
CHR DefaultProfile: Profile 1
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HomePage: Profile 1 -> search.ask.com/?gct=hp
CHR DefaultSearchURL: Profile 1 -> hxxp://www.search.ask.com/web?q={searchTerms}
CHR DefaultSearchKeyword: Profile 1 -> search.ask.com
CHR DefaultSuggestURL: Profile 1 -> hxxp://ssmsp.ask.com/query?sstype=prefix&li=ff&q={searchTerms}
CHR Profile: C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default [2016-01-15]
CHR Extension: (Google Docs) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-27] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Google Drive) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
CHR Extension: (Google Search) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-02]
CHR Extension: (Google Docs Offline) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-19]
CHR Extension: (Google Wallet) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-24] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Fast search) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha [2016-11-28]
CHR Extension: (Gmail) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-27]
CHR Extension: (uNiSaleis) - C:\ProgramData\gckimfpkldnpeenhoiknbepenpjlimnk\ []
CHR Profile: C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1 [2016-11-28]
CHR Extension: (Google Slides) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-20]
CHR Extension: (Google Docs) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-20]
CHR Extension: (Google Drive) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-20]
CHR Extension: (YouTube) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-20]
CHR Extension: (Google Search) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-20]
CHR Extension: (Google Docs Offline) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Grammarly for Chrome) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\kbfnbcaeplbcioakkpcpgfkobkghlhen [2016-11-25]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Fast search) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pbdpajcdgknpendpmecafmopknefafha [2016-11-28]
CHR Extension: (Gmail) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-20]
CHR Extension: (Chrome Media Router) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-10-14]
CHR Profile: C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\System Profile [2016-11-28]
CHR Extension: (Fast search) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\pbdpajcdgknpendpmecafmopknefafha [2016-11-28]
CHR HKLM\...\Chrome\Extension: [aaaaapdcjfaomkafnbpoclmfakjianjd] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaapdcjfaomkafnbpoclmfakjianjd.crx [2016-11-09]
CHR HKLM-x32\...\Chrome\Extension: [aaaaapdcjfaomkafnbpoclmfakjianjd] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaapdcjfaomkafnbpoclmfakjianjd.crx [2016-11-09]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [599944 2014-12-04] (Autodesk Inc.)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [201800 2016-11-09] (APN LLC.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)
R2 Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [31160 2015-02-05] (Autodesk, Inc.)
R2 BcmBtRSupport; C:\WINDOWS\system32\BtwRSupportService.exe [2278152 2015-08-20] (Broadcom Corporation.)
S3 BstHdAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Service.exe [445976 2016-07-21] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe [425496 2016-07-21] (BlueStack Systems, Inc.)
S3 BstHdPlusAndroidSvc; C:\Program Files (x86)\Bluestacks\HD-Plus-Service.exe [462360 2016-07-21] (BlueStack Systems, Inc.)
R2 DACoreService; C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe [430480 2013-02-22] (Nuance Communications, Inc.)
R2 Dashboard Service; C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe [24880 2013-01-15] (Microsoft) [File not signed]
R2 EpsonScanSvc; C:\WINDOWS\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)
S2 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [985616 2016-10-25] (Garmin Ltd. or its subsidiaries)
R2 GoProDeviceDetectionService; C:\Program Files\GoPro\GoPro Desktop App\GoProDeviceDetection.exe [37808 2016-10-11] ()
R2 Hamachi2Svc; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [2627080 2016-11-11] (LogMeIn Inc.)
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2011-08-18] (Hewlett-Packard Co.) [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [46904 2013-12-17] (Hewlett-Packard Company)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
R2 IdeaTouch.LocalDataServer.Education; C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe [7680 2012-05-17] (Microsoft) [File not signed]
R2 IdeaTouch.LocalDataServer.Game; C:\Program Files (x86)\Lenovo\GamePortal\Services\IdeaTouch.LocalDataServer.Game.exe [7680 2012-05-17] (Microsoft) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-26] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [177376 2016-08-12] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-26] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [419248 2016-11-11] (LogMeIn, Inc.)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2012-12-14] (Nitro PDF Software)
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 Update service; C:\Program Files (x86)\Popcorn Time\Updater.exe [339968 2016-08-26] (Popcorn Time) [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S2 UCBrowserSvc; "C:\Program Files (x86)\UCBrowser\Application\UCService.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 bcbtums; C:\WINDOWS\system32\drivers\bcbtums.sys [199472 2015-08-20] (Broadcom Corporation.)
S3 BstHdDrv; C:\Program Files (x86)\Bluestacks\HD-Hypervisor-amd64.sys [152672 2016-07-21] (BlueStack Systems)
S3 BstkDrv; C:\Program Files (x86)\Bluestacks\BstkDrv.sys [270904 2016-07-21] (Bluestack System Inc. )
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 Hamachi; C:\WINDOWS\System32\drivers\Hamdrv.sys [45680 2015-08-03] (LogMeIn Inc.)
R3 libusb0; C:\WINDOWS\system32\DRIVERS\libusb0.sys [44480 2015-10-21] (hxxp://libusb-win32.sourceforge.net)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 RSP2STOR; C:\WINDOWS\system32\DRIVERS\RtsP2Stor.sys [310528 2016-03-08] (Realtek Semiconductor Corp.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek )
R3 RtlWlanu_OldIC; C:\WINDOWS\System32\drivers\rtwlanu_oldIC.sys [3814400 2016-07-16] (Realtek Semiconductor Corporation )
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
R1 UCGuard; C:\WINDOWS\System32\DRIVERS\ucguard.sys [81792 2016-08-29] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== ATTENTION
R3 VMC412; C:\WINDOWS\System32\Drivers\VMC412.sys [241920 2016-03-08] (Vimicro Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
S3 wsvd; C:\WINDOWS\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
R2 X5XSEx_Pr148; C:\Program Files (x86)\FreeRide Games\X5XSEx_Pr148.Sys [56136 2012-08-02] (Exent Technologies Ltd.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-11-28 08:56 - 2016-11-28 08:59 - 00036259 _____ C:\Users\Ivan Reyes Ortega\Downloads\FRST.txt
2016-11-28 08:55 - 2016-11-28 08:56 - 00000000 ____D C:\FRST
2016-11-28 08:54 - 2016-11-28 08:55 - 02411520 _____ (Farbar) C:\Users\Ivan Reyes Ortega\Downloads\FRST64.exe
2016-11-28 03:13 - 2016-11-28 03:13 - 00001006 _____ C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2016-11-28 03:13 - 2016-11-28 03:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2016-11-28 03:13 - 2016-11-28 03:13 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2016-11-28 02:38 - 2016-11-28 02:38 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Crashpad
2016-11-28 02:29 - 2016-11-28 03:09 - 00000494 _____ C:\WINDOWS\Tasks\UCBrowserUpdater.job
2016-11-28 02:29 - 2016-11-28 03:09 - 00000330 _____ C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job
2016-11-28 02:29 - 2016-11-28 02:30 - 00002684 _____ C:\WINDOWS\System32\Tasks\UCBrowserUpdaterCore
2016-11-28 02:29 - 2016-11-28 02:29 - 00003536 _____ C:\WINDOWS\System32\Tasks\UCBrowserUpdater
2016-11-28 02:29 - 2016-11-28 02:29 - 00001606 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
2016-11-28 02:29 - 2016-11-28 02:29 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\UCBrowser
2016-11-28 02:29 - 2016-11-28 02:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC浏览器
2016-11-28 02:29 - 2016-11-28 02:29 - 00000000 ____D C:\Program Files (x86)\UCBrowser
2016-11-28 02:29 - 2016-08-29 06:56 - 00081792 _____ (Huorong Borui (Beijing) Technology Co., Ltd.) C:\WINDOWS\system32\Drivers\ucguard.sys
2016-11-28 02:26 - 2016-11-28 02:26 - 00002345 ___RS C:\Users\Public\Desktop\Ваttle.nеt.lnk
2016-11-28 02:26 - 2016-11-28 02:26 - 00002222 ___RS C:\Users\Ivan Reyes Ortega\Desktop\Nеxon Launcher.lnk
2016-11-28 02:26 - 2016-11-28 02:26 - 00001422 ___RS C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gооgle Chrоmе.lnk
2016-11-28 02:26 - 2016-11-28 02:26 - 00001350 ___RS C:\Users\Ivan Reyes Ortega\Desktop\Gоogle Сhromе.lnk
2016-11-28 02:26 - 2016-11-28 02:26 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Roaming\SPI
2016-11-28 02:26 - 2016-11-28 02:26 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Roaming\Browsers
2016-11-28 02:26 - 2016-11-28 02:26 - 00000000 ____D C:\Program Files (x86)\IObit
2016-11-28 02:24 - 2016-11-28 02:24 - 00000000 ____D C:\Users\Ivan Reyes Ortega\Desktop\Adobe InDesign CC 2017
2016-11-28 02:12 - 2016-11-28 02:12 - 00003670 _____ C:\WINDOWS\System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-ivan.reor@gmail.com
2016-11-28 02:04 - 2016-11-28 02:04 - 00000000 ____D C:\ProgramData\ALM
2016-11-28 01:55 - 2016-11-28 02:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Master Collection CS6
2016-11-28 01:09 - 2016-11-28 01:18 - 00000000 ____D C:\Users\Ivan Reyes Ortega\Desktop\MasterCollection_CS6_LS16
2016-11-27 18:24 - 2016-11-27 18:24 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign93e135da6e639f46
2016-11-27 18:24 - 2016-11-27 18:24 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign54b069a5439cde4c
2016-11-27 18:23 - 2016-11-27 19:48 - 2365586577 _____ C:\Users\Ivan Reyes Ortega\Documents\MasterCollection_CS6_LS16.7z
2016-11-27 18:23 - 2016-11-27 18:23 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsignb7ec360f93b79fc1
2016-11-27 18:14 - 2016-11-27 18:14 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign42318f3bd25ae5a2
2016-11-27 18:14 - 2016-11-27 18:14 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign3cc08622ac4657d1
2016-11-27 18:14 - 2016-11-27 18:14 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign3a975dc111481e70
2016-11-27 11:23 - 2016-11-27 11:23 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign2d76c2406b89699a
2016-11-27 11:23 - 2016-11-27 11:23 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign01004fae38126f45
2016-11-27 11:15 - 2016-11-27 11:15 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsigna50ab9696c6d2ccd
2016-11-27 11:15 - 2016-11-27 11:15 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign69d55d5ee0ae705b
2016-11-27 01:05 - 2016-11-27 01:05 - 00801984 _____ (Adobe Systems Incorporated) C:\Users\Ivan Reyes Ortega\Downloads\CreativeCloudSet-Up.exe
2016-11-27 00:48 - 2016-11-27 00:48 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2016-11-26 23:09 - 2016-11-26 23:09 - 00001081 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
2016-11-26 23:09 - 2016-11-26 23:09 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2016-11-26 23:09 - 2016-11-26 23:09 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2016-11-26 10:07 - 2016-11-26 10:13 - 00000000 ____D C:\Program Files (x86)\Overwatch
2016-11-26 09:43 - 2016-11-28 02:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2016-11-26 09:43 - 2016-11-28 01:02 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Battle.net
2016-11-26 09:43 - 2016-11-26 09:43 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Blizzard Entertainment
2016-11-26 09:43 - 2016-11-26 09:43 - 00000000 ____D C:\ProgramData\Blizzard Entertainment
2016-11-26 09:41 - 2016-11-28 01:01 - 00000000 ____D C:\Program Files (x86)\Battle.net
2016-11-26 09:39 - 2016-11-26 09:44 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Roaming\Battle.net
2016-11-26 09:39 - 2016-11-26 09:39 - 00000000 ____D C:\ProgramData\Battle.net
2016-11-26 09:37 - 2016-11-26 09:39 - 03126768 _____ (Blizzard Entertainment) C:\Users\Ivan Reyes Ortega\Downloads\Battle.net-Setup.exe
2016-11-23 11:55 - 2016-11-23 11:55 - 00062278 _____ C:\Users\Ivan Reyes Ortega\Downloads\Einari's Potraits Mod - FIX FOR 1.1-565-.zip
2016-11-23 11:55 - 2016-11-23 11:55 - 00011180 _____ C:\Users\Ivan Reyes Ortega\Downloads\Maru Hospital-565-.zip
2016-11-21 12:53 - 2016-11-21 12:53 - 00163797 _____ C:\Users\Ivan Reyes Ortega\Downloads\SVPortraits.zip
2016-11-20 01:42 - 2016-11-20 01:42 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2016-11-16 03:06 - 2016-11-16 03:06 - 00000000 ____D C:\Users\Ivan Reyes Ortega\Desktop\Skype Screenshots
2016-11-13 15:48 - 2016-11-13 15:48 - 00000000 ____D C:\Users\Joanne\.QtWebEngineProcess
2016-11-13 15:48 - 2016-11-13 15:48 - 00000000 ____D C:\Users\Joanne\.GoPro
2016-11-13 15:46 - 2016-11-13 15:46 - 00000846 _____ C:\Users\Public\Desktop\Quik.lnk
2016-11-13 15:46 - 2016-11-13 15:46 - 00000000 ____D C:\Program Files\GoPro
2016-11-13 15:41 - 2016-11-13 15:45 - 252305280 _____ (GoPro, Inc.) C:\Users\Joanne\Downloads\Quik-WinInstaller-2.0.1.4320.exe
2016-11-11 15:49 - 2016-11-11 15:50 - 00000000 ____D C:\Users\Ivan Reyes Ortega\Downloads\Introductory Circuit Analysis (11th Edition) by Robert L. Boylestad
2016-11-11 15:47 - 2016-11-11 15:47 - 25064085 _____ C:\Users\Ivan Reyes Ortega\Downloads\Introductory Circuit Analysis (11th Edition) by Robert L. Boylestad.zip
2016-11-08 17:16 - 2016-11-02 08:01 - 00315744 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2016-11-08 17:16 - 2016-11-02 07:13 - 00773720 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2016-11-08 17:16 - 2016-11-02 07:12 - 00376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2016-11-08 17:16 - 2016-11-02 07:10 - 02323728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2016-11-08 17:16 - 2016-11-02 07:09 - 02257104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-11-08 17:16 - 2016-11-02 07:08 - 00576408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2016-11-08 17:16 - 2016-11-02 07:08 - 00186424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\weretw.dll
2016-11-08 17:16 - 2016-11-02 07:05 - 00959112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-11-08 17:16 - 2016-11-02 07:02 - 00682816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2016-11-08 17:16 - 2016-11-02 07:02 - 00238056 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll
2016-11-08 17:16 - 2016-11-02 07:01 - 01263856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2016-11-08 17:16 - 2016-11-02 07:01 - 00545936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2016-11-08 17:16 - 2016-11-02 07:00 - 01274712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-11-08 17:16 - 2016-11-02 06:47 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll
2016-11-08 17:16 - 2016-11-02 06:46 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll
2016-11-08 17:16 - 2016-11-02 06:31 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcTok.exe
2016-11-08 17:16 - 2016-11-02 06:31 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll
2016-11-08 17:16 - 2016-11-02 06:30 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2016-11-08 17:16 - 2016-11-02 06:30 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
2016-11-08 17:16 - 2016-11-02 06:29 - 00884224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-11-08 17:16 - 2016-11-02 06:29 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll
2016-11-08 17:16 - 2016-11-02 06:29 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NPSM.dll
2016-11-08 17:16 - 2016-11-02 06:28 - 04423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2016-11-08 17:16 - 2016-11-02 06:28 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenterCPL.dll
2016-11-08 17:16 - 2016-11-02 06:28 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2016-11-08 17:16 - 2016-11-02 06:28 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2016-11-08 17:16 - 2016-11-02 06:28 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\chartv.dll
2016-11-08 17:16 - 2016-11-02 06:27 - 01388544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
2016-11-08 17:16 - 2016-11-02 06:26 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2016-11-08 17:16 - 2016-11-02 06:26 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ddraw.dll
2016-11-08 17:16 - 2016-11-02 06:26 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\system32\netplwiz.dll
2016-11-08 17:16 - 2016-11-02 06:23 - 00101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bowser.sys
2016-11-08 17:16 - 2016-11-02 06:22 - 00369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msinfo32.exe
2016-11-08 17:16 - 2016-11-02 06:19 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2016-11-08 17:16 - 2016-11-02 06:18 - 00836608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcRefreshTask.dll
2016-11-08 17:16 - 2016-11-02 06:17 - 00909824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2016-11-08 17:16 - 2016-11-02 06:16 - 01359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
2016-11-08 17:16 - 2016-11-02 06:16 - 00308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenter.dll
2016-11-08 17:16 - 2016-11-02 04:20 - 00446896 _____ C:\WINDOWS\system32\ApnDatabase.xml
2016-11-08 17:15 - 2016-11-02 08:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2016-11-08 17:15 - 2016-11-02 07:22 - 01570672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-11-08 17:15 - 2016-11-02 07:20 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2016-11-08 17:15 - 2016-11-02 07:13 - 01883784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-11-08 17:15 - 2016-11-02 07:12 - 02255712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2016-11-08 17:15 - 2016-11-02 07:12 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-11-08 17:15 - 2016-11-02 07:05 - 06657176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2016-11-08 17:15 - 2016-11-02 07:05 - 03892352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2016-11-08 17:15 - 2016-11-02 07:05 - 00951904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2016-11-08 17:15 - 2016-11-02 07:05 - 00405856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-11-08 17:15 - 2016-11-02 07:04 - 04312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-11-08 17:15 - 2016-11-02 07:03 - 02750936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-11-08 17:15 - 2016-11-02 07:03 - 00714592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-11-08 17:15 - 2016-11-02 07:01 - 01415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2016-11-08 17:15 - 2016-11-02 07:00 - 08156080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2016-11-08 17:15 - 2016-11-02 07:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2016-11-08 17:15 - 2016-11-02 06:59 - 04673304 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-11-08 17:15 - 2016-11-02 06:50 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2016-11-08 17:15 - 2016-11-02 06:49 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2016-11-08 17:15 - 2016-11-02 06:49 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2016-11-08 17:15 - 2016-11-02 06:44 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2016-11-08 17:15 - 2016-11-02 06:44 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthExt.dll
2016-11-08 17:15 - 2016-11-02 06:43 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2016-11-08 17:15 - 2016-11-02 06:42 - 00632832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sud.dll
2016-11-08 17:15 - 2016-11-02 06:42 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll
2016-11-08 17:15 - 2016-11-02 06:42 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2016-11-08 17:15 - 2016-11-02 06:42 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2016-11-08 17:15 - 2016-11-02 06:40 - 00896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontext.dll
2016-11-08 17:15 - 2016-11-02 06:39 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll
2016-11-08 17:15 - 2016-11-02 06:38 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
2016-11-08 17:15 - 2016-11-02 06:37 - 19415040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-11-08 17:15 - 2016-11-02 06:36 - 19415552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-11-08 17:15 - 2016-11-02 06:36 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-11-08 17:15 - 2016-11-02 06:34 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2016-11-08 17:15 - 2016-11-02 06:33 - 12349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2016-11-08 17:15 - 2016-11-02 06:33 - 03307520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2016-11-08 17:15 - 2016-11-02 06:32 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\efsext.dll
2016-11-08 17:15 - 2016-11-02 06:31 - 03196416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2016-11-08 17:15 - 2016-11-02 06:31 - 01228288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
2016-11-08 17:15 - 2016-11-02 06:31 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2016-11-08 17:15 - 2016-11-02 06:30 - 12175360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-11-08 17:15 - 2016-11-02 06:30 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-11-08 17:15 - 2016-11-02 06:30 - 00567296 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairing.dll
2016-11-08 17:15 - 2016-11-02 06:29 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2016-11-08 17:15 - 2016-11-02 06:29 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-11-08 17:15 - 2016-11-02 06:28 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-11-08 17:15 - 2016-11-02 06:28 - 00690176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2016-11-08 17:15 - 2016-11-02 06:28 - 00411136 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCenter.dll
2016-11-08 17:15 - 2016-11-02 06:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2016-11-08 17:15 - 2016-11-02 06:28 - 00274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\ListSvc.dll
2016-11-08 17:15 - 2016-11-02 06:28 - 00240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkDesktopSettings.dll
2016-11-08 17:15 - 2016-11-02 06:28 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\IdCtrls.dll
2016-11-08 17:15 - 2016-11-02 06:27 - 02458112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll
2016-11-08 17:15 - 2016-11-02 06:27 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\system32\WlanMediaManager.dll
2016-11-08 17:15 - 2016-11-02 06:27 - 00580608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll
2016-11-08 17:15 - 2016-11-02 06:27 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\timedate.cpl
2016-11-08 17:15 - 2016-11-02 06:27 - 00495104 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2016-11-08 17:15 - 2016-11-02 06:27 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll
2016-11-08 17:15 - 2016-11-02 06:26 - 02747392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-11-08 17:15 - 2016-11-02 06:26 - 02484736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gameux.dll
2016-11-08 17:15 - 2016-11-02 06:26 - 00912896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2016-11-08 17:15 - 2016-11-02 06:26 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\zipfldr.dll
2016-11-08 17:15 - 2016-11-02 06:26 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2016-11-08 17:15 - 2016-11-02 06:26 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-11-08 17:15 - 2016-11-02 06:25 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2016-11-08 17:15 - 2016-11-02 06:25 - 01556480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2016-11-08 17:15 - 2016-11-02 06:25 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\sud.dll
2016-11-08 17:15 - 2016-11-02 06:25 - 00496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll
2016-11-08 17:15 - 2016-11-02 06:24 - 00940032 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontext.dll
2016-11-08 17:15 - 2016-11-02 06:23 - 03106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2016-11-08 17:15 - 2016-11-02 06:23 - 02104320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2016-11-08 17:15 - 2016-11-02 06:22 - 13441024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2016-11-08 17:15 - 2016-11-02 06:22 - 13081600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-11-08 17:15 - 2016-11-02 06:22 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2016-11-08 17:15 - 2016-11-02 06:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2016-11-08 17:15 - 2016-11-02 06:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2016-11-08 17:15 - 2016-11-02 06:19 - 08127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-11-08 17:15 - 2016-11-02 06:19 - 00981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2016-11-08 17:15 - 2016-11-02 06:19 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\NPSM.dll
2016-11-08 17:15 - 2016-11-02 06:19 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\chartv.dll
2016-11-08 17:15 - 2016-11-02 06:18 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2016-11-08 17:15 - 2016-11-02 06:17 - 04746752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-11-08 17:15 - 2016-11-02 06:17 - 01282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-11-08 17:15 - 2016-11-02 06:17 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
2016-11-08 17:15 - 2016-11-02 06:17 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2016-11-08 17:15 - 2016-11-02 06:16 - 03400192 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncCenter.dll
2016-11-08 17:15 - 2016-11-02 06:16 - 03133440 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-11-08 17:15 - 2016-11-02 06:16 - 02688512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-11-08 17:15 - 2016-11-02 06:16 - 02512384 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
2016-11-08 17:15 - 2016-11-02 06:16 - 01779712 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-11-08 17:15 - 2016-11-02 06:16 - 00881664 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-11-08 17:15 - 2016-11-02 06:16 - 00629248 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll
2016-11-08 17:15 - 2016-11-02 06:15 - 02611200 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameux.dll
2016-11-08 17:15 - 2016-11-02 06:15 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-11-08 17:15 - 2016-11-02 06:15 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2016-11-08 17:15 - 2016-11-02 06:14 - 01726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2016-11-08 17:14 - 2016-11-02 07:22 - 00601712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2016-11-08 17:14 - 2016-11-02 07:20 - 00378720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2016-11-08 17:14 - 2016-11-02 07:15 - 01051112 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-11-08 17:14 - 2016-11-02 07:15 - 00894096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-11-08 17:14 - 2016-11-02 07:14 - 07816544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-11-08 17:14 - 2016-11-02 07:13 - 01354320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-11-08 17:14 - 2016-11-02 07:13 - 01173496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-11-08 17:14 - 2016-11-02 07:13 - 00423776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2016-11-08 17:14 - 2016-11-02 07:08 - 00602464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-11-08 17:14 - 2016-11-02 07:08 - 00111968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-11-08 17:14 - 2016-11-02 07:05 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-11-08 17:14 - 2016-11-02 07:04 - 02678056 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2016-11-08 17:14 - 2016-11-02 07:04 - 00596832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll
2016-11-08 17:14 - 2016-11-02 07:02 - 00848736 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-11-08 17:14 - 2016-11-02 07:02 - 00148832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-11-08 17:14 - 2016-11-02 07:01 - 01425000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2016-11-08 17:14 - 2016-11-02 07:01 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\input.dll
2016-11-08 17:14 - 2016-11-02 07:01 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-11-08 17:14 - 2016-11-02 07:00 - 22223968 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-11-08 17:14 - 2016-11-02 07:00 - 04130432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2016-11-08 17:14 - 2016-11-02 07:00 - 01061968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2016-11-08 17:14 - 2016-11-02 06:56 - 01609920 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2016-11-08 17:14 - 2016-11-02 06:56 - 01572768 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2016-11-08 17:14 - 2016-11-02 06:56 - 01418312 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2016-11-08 17:14 - 2016-11-02 06:56 - 00628552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2016-11-08 17:14 - 2016-11-02 06:56 - 00322912 _____ (Microsoft Corporation) C:\WINDOWS\system32\input.dll
2016-11-08 17:14 - 2016-11-02 06:55 - 00048992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\iorate.sys
2016-11-08 17:14 - 2016-11-02 06:48 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll
2016-11-08 17:14 - 2016-11-02 06:48 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2016-11-08 17:14 - 2016-11-02 06:48 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efsext.dll
2016-11-08 17:14 - 2016-11-02 06:47 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2016-11-08 17:14 - 2016-11-02 06:47 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BcastDVRHelper.dll
2016-11-08 17:14 - 2016-11-02 06:46 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
2016-11-08 17:14 - 2016-11-02 06:45 - 00492032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2016-11-08 17:14 - 2016-11-02 06:45 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2016-11-08 17:14 - 2016-11-02 06:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsensorgroup.dll
2016-11-08 17:14 - 2016-11-02 06:44 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2016-11-08 17:14 - 2016-11-02 06:43 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8.dll
2016-11-08 17:14 - 2016-11-02 06:43 - 00270336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-11-08 17:14 - 2016-11-02 06:43 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll
2016-11-08 17:14 - 2016-11-02 06:43 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-11-08 17:14 - 2016-11-02 06:42 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2016-11-08 17:14 - 2016-11-02 06:42 - 00549376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActionCenterCPL.dll
2016-11-08 17:14 - 2016-11-02 06:42 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll
2016-11-08 17:14 - 2016-11-02 06:41 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2016-11-08 17:14 - 2016-11-02 06:40 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ddraw.dll
2016-11-08 17:14 - 2016-11-02 06:40 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2016-11-08 17:14 - 2016-11-02 06:39 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2016-11-08 17:14 - 2016-11-02 06:39 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAnimation.dll
2016-11-08 17:14 - 2016-11-02 06:38 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-11-08 17:14 - 2016-11-02 06:36 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetailsUpdate.dll
2016-11-08 17:14 - 2016-11-02 06:35 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msinfo32.exe
2016-11-08 17:14 - 2016-11-02 06:34 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-11-08 17:14 - 2016-11-02 06:33 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-11-08 17:14 - 2016-11-02 06:32 - 00045056 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2016-11-08 17:14 - 2016-11-02 06:31 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\BcastDVRHelper.dll
2016-11-08 17:14 - 2016-11-02 06:31 - 00170496 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-11-08 17:14 - 2016-11-02 06:31 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2016-11-08 17:14 - 2016-11-02 06:31 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-11-08 17:14 - 2016-11-02 06:31 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2016-11-08 17:14 - 2016-11-02 06:30 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
2016-11-08 17:14 - 2016-11-02 06:30 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2016-11-08 17:14 - 2016-11-02 06:30 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2016-11-08 17:14 - 2016-11-02 06:30 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
2016-11-08 17:14 - 2016-11-02 06:29 - 01247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2016-11-08 17:14 - 2016-11-02 06:29 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2016-11-08 17:14 - 2016-11-02 06:29 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll
2016-11-08 17:14 - 2016-11-02 06:29 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll
2016-11-08 17:14 - 2016-11-02 06:29 - 00276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-11-08 17:14 - 2016-11-02 06:29 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2016-11-08 17:14 - 2016-11-02 06:29 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-11-08 17:14 - 2016-11-02 06:28 - 00807424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2016-11-08 17:14 - 2016-11-02 06:28 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2016-11-08 17:14 - 2016-11-02 06:28 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkUXBroker.dll
2016-11-08 17:14 - 2016-11-02 06:28 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2016-11-08 17:14 - 2016-11-02 06:28 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2016-11-08 17:14 - 2016-11-02 06:28 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-11-08 17:14 - 2016-11-02 06:28 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2016-11-08 17:14 - 2016-11-02 06:27 - 23677952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-11-08 17:14 - 2016-11-02 06:27 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-11-08 17:14 - 2016-11-02 06:27 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2016-11-08 17:14 - 2016-11-02 06:26 - 01880576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2016-11-08 17:14 - 2016-11-02 06:26 - 01595392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-11-08 17:14 - 2016-11-02 06:26 - 01509376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-11-08 17:14 - 2016-11-02 06:26 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-11-08 17:14 - 2016-11-02 06:26 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAnimation.dll
2016-11-08 17:14 - 2016-11-02 06:25 - 02256384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-11-08 17:14 - 2016-11-02 06:25 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2016-11-08 17:14 - 2016-11-02 06:25 - 00772608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntshrui.dll
2016-11-08 17:14 - 2016-11-02 06:25 - 00541696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll
2016-11-08 17:14 - 2016-11-02 06:24 - 03778560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2016-11-08 17:14 - 2016-11-02 06:23 - 02356736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
2016-11-08 17:14 - 2016-11-02 06:23 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2016-11-08 17:14 - 2016-11-02 06:23 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetailsUpdate.dll
2016-11-08 17:14 - 2016-11-02 06:21 - 05111296 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2016-11-08 17:14 - 2016-11-02 06:20 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-11-08 17:14 - 2016-11-02 06:20 - 00167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
2016-11-08 17:14 - 2016-11-02 06:19 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2016-11-08 17:14 - 2016-11-02 06:19 - 01586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2016-11-08 17:14 - 2016-11-02 06:19 - 00805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll
2016-11-08 17:14 - 2016-11-02 06:18 - 01690112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2016-11-08 17:14 - 2016-11-02 06:18 - 00243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\shdocvw.dll
2016-11-08 17:14 - 2016-11-02 06:17 - 00982528 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-11-08 17:14 - 2016-11-02 06:16 - 04148736 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-11-08 17:14 - 2016-11-02 06:16 - 02669056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-11-08 17:14 - 2016-11-02 06:16 - 01637888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-11-08 17:14 - 2016-11-02 06:16 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-11-08 17:14 - 2016-11-02 06:16 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2016-11-08 17:14 - 2016-11-02 06:16 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2016-11-08 17:14 - 2016-11-02 06:16 - 00265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-11-08 17:14 - 2016-11-02 06:15 - 04708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2016-11-08 17:14 - 2016-11-02 06:15 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-11-08 17:14 - 2016-11-02 06:15 - 01348608 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2016-11-08 17:14 - 2016-11-02 06:15 - 00842240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll
2016-11-08 17:14 - 2016-11-02 06:13 - 03496960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
2016-11-08 17:14 - 2016-11-02 06:13 - 03299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2016-11-08 17:14 - 2016-11-02 06:13 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2016-11-08 17:14 - 2016-11-02 05:11 - 00788624 _____ C:\WINDOWS\SysWOW64\locale.nls
2016-11-08 17:14 - 2016-11-02 05:11 - 00788624 _____ C:\WINDOWS\system32\locale.nls
2016-11-08 17:14 - 2016-08-02 00:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2016-11-05 16:02 - 2016-11-05 16:29 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Roaming\discord
2016-11-05 16:02 - 2016-11-05 16:02 - 00002341 _____ C:\Users\Ivan Reyes Ortega\Desktop\Discord.lnk
2016-11-05 16:02 - 2016-11-05 16:02 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hammer & Chisel, Inc
2016-11-05 16:01 - 2016-11-05 16:02 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\SquirrelTemp
2016-11-05 16:01 - 2016-11-05 16:02 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Discord
2016-11-05 15:58 - 2016-11-05 16:01 - 50343608 _____ (Hammer & Chisel, Inc.) C:\Users\Ivan Reyes Ortega\Downloads\DiscordSetup.exe
2016-11-04 13:50 - 2016-11-04 13:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2016-10-31 22:04 - 2016-10-31 22:04 - 00000000 ____D C:\Users\Ivan Reyes Ortega\Documents\Stardew Valley

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-11-28 08:54 - 2015-05-05 20:35 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Akamai
2016-11-28 08:52 - 2014-11-12 12:45 - 00000000 __SHD C:\Users\Ivan Reyes Ortega\IntelGraphicsProfiles
2016-11-28 08:51 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2016-11-28 03:16 - 2015-08-20 18:18 - 01478012 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-11-28 03:14 - 2016-10-01 04:40 - 00000000 ____D C:\Users\Default\AppData\Local\LogMeIn Hamachi
2016-11-28 03:14 - 2016-10-01 04:40 - 00000000 ____D C:\Users\Default User\AppData\Local\LogMeIn Hamachi
2016-11-28 03:14 - 2014-06-30 18:07 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\LogMeIn Hamachi
2016-11-28 03:09 - 2016-10-01 05:09 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-11-28 03:09 - 2016-10-01 04:16 - 05046152 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-11-28 03:08 - 2016-10-01 04:24 - 00000000 ____D C:\Users\Ivan Reyes Ortega
2016-11-28 03:08 - 2016-07-16 02:04 - 01048576 _____ C:\WINDOWS\system32\config\BBI
2016-11-28 02:38 - 2015-08-12 22:27 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\NexonLauncher
2016-11-28 02:27 - 2016-07-04 10:13 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Roaming\Adobe
2016-11-28 02:19 - 2015-08-23 20:31 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Roaming\Spotify
2016-11-28 02:18 - 2015-08-23 20:37 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Spotify
2016-11-28 02:17 - 2016-10-06 22:21 - 00000000 ____D C:\Users\Public\Documents\AdobeGC
2016-11-28 02:13 - 2016-07-04 10:13 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Adobe
2016-11-28 02:08 - 2016-10-25 17:06 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2016-11-28 02:07 - 2016-07-04 10:13 - 00000000 ____D C:\ProgramData\Adobe
2016-11-28 02:05 - 2016-10-22 14:13 - 00000000 ____D C:\Program Files\Common Files\Adobe
2016-11-28 02:05 - 2014-01-06 15:17 - 00000000 ____D C:\Program Files\Adobe
2016-11-28 02:03 - 2014-02-19 19:13 - 00000000 ____D C:\Program Files (x86)\Adobe
2016-11-27 23:26 - 2016-10-01 04:16 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2016-11-27 01:14 - 2016-01-29 14:37 - 00000000 ___RD C:\Users\Ivan Reyes Ortega\Creative Cloud Files
2016-11-27 01:14 - 2015-12-04 22:16 - 00000000 ____D C:\ProgramData\boost_interprocess
2016-11-26 22:48 - 2013-12-26 00:24 - 00000000 ____D C:\Program Files (x86)\Steam
2016-11-24 11:45 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-11-24 09:09 - 2014-11-13 14:28 - 00000000 __SHD C:\Users\Joanne\IntelGraphicsProfiles
2016-11-24 02:06 - 2014-07-24 16:47 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Roaming\Skype
2016-11-24 00:59 - 2014-07-24 16:47 - 00000000 ____D C:\ProgramData\Skype
2016-11-24 00:58 - 2016-01-05 15:58 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-11-23 14:23 - 2016-07-16 07:47 - 00000000 ___HD C:\Program Files\WindowsApps
2016-11-23 14:23 - 2013-12-09 10:37 - 00000000 ____D C:\Users\Joanne\AppData\Local\Packages
2016-11-22 13:58 - 2014-01-07 16:03 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Roaming\Nitro PDF
2016-11-22 11:19 - 2013-12-25 13:13 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Packages
2016-11-20 01:42 - 2016-07-16 07:45 - 00000000 ____D C:\WINDOWS\INF
2016-11-19 11:36 - 2016-03-24 17:41 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Roaming\StardewValley
2016-11-14 23:02 - 2016-10-01 04:24 - 00000000 ____D C:\Users\Joanne
2016-11-14 19:35 - 2013-12-22 21:30 - 00002283 ____H C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-11-13 17:03 - 2013-12-23 15:10 - 00000000 ____D C:\Users\Joanne\AppData\Roaming\Nitro PDF
2016-11-13 15:53 - 2015-01-07 22:28 - 00000000 ____D C:\Users\Joanne\AppData\Local\GoPro
2016-11-13 15:50 - 2016-07-16 07:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-11-13 15:48 - 2015-01-07 22:27 - 00000000 ____D C:\ProgramData\Package Cache
2016-11-13 15:47 - 2016-10-18 20:10 - 00000000 ____D C:\Program Files (x86)\GoPro
2016-11-13 15:47 - 2016-01-24 18:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GoPro
2016-11-13 15:46 - 2013-04-23 14:06 - 00466456 _____ (Creative Labs) C:\WINDOWS\system32\wrap_oal.dll
2016-11-13 15:46 - 2013-04-23 14:06 - 00444952 _____ (Creative Labs) C:\WINDOWS\SysWOW64\wrap_oal.dll
2016-11-13 15:46 - 2013-04-23 14:06 - 00122904 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\WINDOWS\system32\OpenAL32.dll
2016-11-13 15:46 - 2013-04-23 14:06 - 00109080 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\WINDOWS\SysWOW64\OpenAL32.dll
2016-11-13 07:35 - 2013-12-22 21:20 - 00000000 ____D C:\Users\Joanne\AppData\Local\Google
2016-11-13 00:21 - 2013-12-09 10:37 - 00000000 ____D C:\Users\Joanne\AppData\Roaming\Adobe
2016-11-13 00:19 - 2013-04-23 16:07 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-11-11 15:50 - 2015-01-24 13:56 - 00000000 ____D C:\Users\Ivan Reyes Ortega\Documents\Books
2016-11-11 14:25 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\rescache
2016-11-10 01:11 - 2016-07-16 07:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-11-10 01:11 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2016-11-10 01:11 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-11-10 01:11 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\system32\migwiz
2016-11-10 01:11 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2016-11-10 01:11 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-11-09 23:44 - 2013-12-21 17:04 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-11-09 23:38 - 2013-12-21 17:04 - 141011376 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-11-08 10:19 - 2016-10-01 05:08 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-11-04 13:51 - 2015-10-21 13:53 - 00000000 ____D C:\Program Files (x86)\Garmin
2016-11-04 13:50 - 2016-10-01 05:08 - 00003624 _____ C:\WINDOWS\System32\Tasks\GarminUpdaterTask

==================== Files in the root of some directories =======

2014-03-31 20:17 - 2016-02-10 03:41 - 0000132 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\Adobe PNG Format CS6 Prefs
2015-05-25 18:08 - 2015-05-25 18:08 - 0000046 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\Camdata.ini
2015-05-25 18:08 - 2015-05-25 18:08 - 0000408 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\CamLayout.ini
2015-05-25 18:08 - 2015-05-25 18:08 - 0000408 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\CamShapes.ini
2015-05-25 18:08 - 2015-05-25 18:08 - 0004536 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\CamStudio.cfg
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\Users\Ivan Reyes Ortega\AppData\Roaming\Profiles
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\Users\Ivan Reyes Ortega\AppData\Roaming\Project Templates
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\Users\Ivan Reyes Ortega\AppData\Roaming\Quartz Composer
2015-05-25 18:07 - 2015-05-25 18:07 - 0000096 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\version2.xml
2015-05-25 18:54 - 2015-05-25 23:41 - 0005632 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-08-08 02:44 - 2015-08-08 02:44 - 1930335 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\package.nw.new
2015-05-25 17:47 - 2015-05-25 17:47 - 0000003 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\updater.log
2015-05-25 17:47 - 2016-08-06 21:42 - 0000424 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\UserProducts.xml
2016-09-13 15:17 - 2016-09-13 15:17 - 0000057 _____ () C:\ProgramData\Ament.ini
2013-04-23 13:47 - 2013-04-23 13:47 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-02-14 00:43 - 2014-02-14 00:48 - 0000818 _____ () C:\ProgramData\hpzinstall.log
2013-04-23 13:57 - 2013-04-23 13:57 - 0000198 ____H () C:\ProgramData\Lenovo-31886.vbs
2013-04-23 13:58 - 2013-04-23 13:58 - 0000198 ____H () C:\ProgramData\Lenovo-31951.vbs
2015-05-05 22:31 - 2015-05-05 22:31 - 0000133 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
2014-02-10 19:38 - 2014-02-10 19:38 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2014-02-10 19:38 - 2016-03-12 20:28 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2014-02-10 19:38 - 2016-03-12 20:28 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\ProgramData\Receipts
2015-08-11 18:09 - 2015-08-11 18:09 - 0010295 _____ () C:\ProgramData\regid.2011-06.com.youtubebyclick_3C521B99-9ACE-47EA-AC9F-26075467D03B.swidtag
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\ProgramData\Repeat Routines
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\ProgramData\Resources

Some files in TEMP:
====================
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\7EE1.tmp.exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\Browser_V5.7.15319.5_r_4670_(Build1608291541).exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\DBUpdater.exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\DriverBoosterSetup.exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\setup_1093.exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\ucbrabs.exe


==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-11-22 12:29

==================== End of FRST.txt ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-11-2016
Ran by Ivan Reyes Ortega (28-11-2016 09:00:17)
Running from C:\Users\Ivan Reyes Ortega\Downloads
Windows 10 Home Version 1607 (X64) (2016-10-01 09:16:13)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2198469641-46685643-2895634536-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2198469641-46685643-2895634536-503 - Limited - Disabled)
Guest (S-1-5-21-2198469641-46685643-2895634536-501 - Limited - Disabled) => C:\Users\Guest
Ivan Reyes Ortega (S-1-5-21-2198469641-46685643-2895634536-1004 - Administrator - Enabled) => C:\Users\Ivan Reyes Ortega
Joanne (S-1-5-21-2198469641-46685643-2895634536-1002 - Administrator - Enabled) => C:\Users\Joanne

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

1500 (x32 Version: 140.0.425.000 - Hewlett-Packard) Hidden
1500_Help (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden
1500Trb (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
A360 Desktop (HKLM\...\{B209E611-5511-4AD6-B4B3-9D36F93DBCD4}) (Version: 6.0.3.1100 - Autodesk)
ACA & MEP 2016 Object Enabler (Version: 7.8.41.0 - Autodesk) Hidden
ACAD Private (Version: 20.1.49.0 - Autodesk) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Creative Suite 6 Master Collection (HKLM-x32\...\{E8AD3069-9EB7-4BA8-8BFE-83F4E69355C0}) (Version: 6 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.14) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.14 - Adobe Systems Incorporated)
AIO_CDB_ProductContext (x32 Version: 140.0.425.000 - Hewlett-Packard) Hidden
AIO_CDB_Software (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden
AIO_Scan (x32 Version: 130.0.421.000 - Hewlett-Packard) Hidden
Akamai NetSession Interface (HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Akamai) (Version: - Akamai Technologies, Inc)
Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon) <==== ATTENTION
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Apple Application Support (32-bit) (HKLM-x32\...\{D4B07658-F443-4445-A261-E643996E139D}) (Version: 4.3.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{A6B0442B-E159-444B-B49D-6B9AC531EAE3}) (Version: 4.3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
aTube Catcher (HKLM-x32\...\aTube Catcher) (Version: 3.8.5187 - DsNET Corp)
aTube Catcher version 3.8 (HKLM-x32\...\{D43B360E-722D-421B-BC77-20B9E0F8B6CD}_is1) (Version: 3.8 - DsNET Corp)
AutoCAD 2016 - English (Version: 20.1.49.0 - Autodesk) Hidden
AutoCAD 2016 (Version: 20.1.49.0 - Autodesk) Hidden
AutoCAD 2016 Language Pack - English (Version: 20.1.49.0 - Autodesk) Hidden
Autodesk Advanced Material Library Image Library 2016 (HKLM-x32\...\{94AD53E7-493B-4291-8714-7A3B761D2783}) (Version: 6.3.0.15 - Autodesk)
Autodesk App Manager 2016 (HKLM-x32\...\{4ECF9E00-2978-46AF-BD80-455EFEAB7A93}) (Version: 2.0.0 - Autodesk)
Autodesk Application Manager (HKLM-x32\...\Autodesk Application Manager) (Version: 4.0.69.0 - Autodesk)
Autodesk AutoCAD 2016 - English (HKLM\...\AutoCAD 2016 - English) (Version: 20.1.49.0 - Autodesk)
Autodesk AutoCAD Performance Feedback Tool 1.2.4 (HKLM-x32\...\{4E20873D-BC20-495C-AFD9-B18877B7F9BB}) (Version: 1.2.4.0 - Autodesk)
Autodesk BIM 360 Glue AutoCAD 2016 Add-in 64 bit (HKLM\...\{4BEE127E-95C4-434D-ABAC-65155192BB24}) (Version: 4.35.1742 - Autodesk)
Autodesk Content Service (HKLM\...\Autodesk Content Service) (Version: 3.2.0.0 - Autodesk)
Autodesk Content Service (Version: 3.2.0.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (Version: 3.2.0.0 - Autodesk) Hidden
Autodesk Design Review 2013 (HKLM-x32\...\Autodesk Design Review 2013) (Version: 13.0.0.82 - Autodesk, Inc.)
Autodesk Design Review 2013 (x32 Version: 13.0.0.82 - Autodesk, Inc.) Hidden
Autodesk Featured Apps 2016 (HKLM-x32\...\{D42F37CD-9AF9-4435-A474-B387C5BB6B47}) (Version: 2.0.0 - Autodesk)
Autodesk Material Library 2016 (HKLM-x32\...\{29A7D6EC-63C2-42FD-8143-5812ABD2923F}) (Version: 6.3.0.15 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2016 (HKLM-x32\...\{6B4CFC6E-ECB0-47FE-95D3-65C680ED0687}) (Version: 6.3.0.15 - Autodesk)
Autodesk Material Library Medium Resolution Image Library 2016 (HKLM-x32\...\{415A5A54-325E-4815-9940-62A889CA3877}) (Version: 6.3.0.15 - Autodesk)
Autodesk ReCap 2016 (HKLM\...\Autodesk ReCap 2016) (Version: 1.5.0.33 - Autodesk)
Autodesk ReCap 2016 (Version: 1.5.0.33 - Autodesk) Hidden
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BattleBlock Theater (HKLM-x32\...\Steam App 238460) (Version: - The Behemoth)
Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
BitTorrent (HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\BitTorrent) (Version: 7.9.6.42095 - BitTorrent Inc.)
BlueStacks App Player (HKLM-x32\...\BlueStacks) (Version: 2.3.41.6024 - BlueStack Systems, Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Brawlhalla (HKLM-x32\...\Steam App 291550) (Version: - Blue Mammoth Games)
Broforce (HKLM-x32\...\Steam App 274190) (Version: - Free Lives)
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
Castle Crashers (HKLM-x32\...\Steam App 204360) (Version: - The Behemoth)
Copy (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
Discord (HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Discord) (Version: 0.0.296 - Hammer & Chisel, Inc.)
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.16 - Dolby Laboratories Inc)
Don't Starve Together Beta (HKLM-x32\...\Steam App 322330) (Version: - Klei Entertainment)
Dragon Assistant Application en-US version 1.5.0 (HKLM-x32\...\{1CCBE73F-4948-4711-8D12-22E2FD65D706}_is1) (Version: 1.5.0 - Nuance Communications, Inc.)
Dragon Assistant Core Recognition Service version 1.1.4 (HKLM-x32\...\{E97BA7A6-46FC-4EBF-B24A-B8362948C696}_is1) (Version: 1.1.4 - Nuance Communications, Inc.)
Dragon Assistant Language Data en-US version 1.1.1 (HKLM-x32\...\{4C0C1E4E-D3B1-4496-98EC-DA14D45EC855}_is1) (Version: 1.1.1 - Nuance Communications, Inc.)
Dragon Assistant version 1.5.0 (HKLM-x32\...\{D57A8269-3BE5-4D10-B882-64D0F2D448BF}_is1) (Version: 1.5.0 - Nuance Communications, Inc.)
Driver & Application Installation (HKLM-x32\...\{BFECCF2A-F094-4066-8BFA-29CCBB7F6602}) (Version: 6.12.0815 - Lenovo)
DriverAgent by eSupport.com (HKLM-x32\...\DriverAgent_is1) (Version: - Copyright © 2013 eSupport.com, Inc • All Rights Reserved)
Easy Photo Scan (HKLM-x32\...\{1A6DED1E-A024-455D-AA82-203D6B3B0CBC}) (Version: 1.00.0006 - Seiko Epson Corporation)
EducationPortal (HKLM-x32\...\{65487538-FF20-421B-91DB-F6634B8D264C}) (Version: 5.00.012.0617 - Lenovo)
Elevated Installer (x32 Version: 4.2.0.0 - Garmin Ltd or its subsidiaries) Hidden
Epson Copy Utility 4 (HKLM-x32\...\{06A7E8AB-2856-4490-BAA9-F338ABE7695A}) (Version: 4.01.0001 - Seiko Epson Corporation)
Epson Event Manager (HKLM-x32\...\{17FA0444-A025-43B9-862C-81AE6307C2F2}) (Version: 3.10.0050 - Seiko Epson Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON Scan OCR Component (HKLM-x32\...\{563B99D8-8895-4E3E-AE8D-15BE8C05F1C1}) (Version: 3.00.00 - SEIKO EPSON Corp.)
Ezvid (HKLM-x32\...\{F96D619D-99D6-4C9C-A393-0CD22DE1CA66}_is1) (Version: 1.002 - Ezvid, inc.)
FARO LS 1.1.502.0 (64bit) (HKLM-x32\...\{66D83FE0-D798-4B38-86FE-FB48151E5AEF}) (Version: 5.2.0.35213 - FARO Scanner Production)
Fax (x32 Version: 140.0.307.000 - Hewlett-Packard) Hidden
Find the Differences (HKLM-x32\...\InstallShield_{65F9B587-24A7-466A-999A-9C5F9D452400}) (Version: 1.00.2012.0512 - Tong child Research & Planning Co.,Ltd)
Find the Differences (x32 Version: 1.00.2012.0512 - Tong child Research & Planning Co.,Ltd) Hidden
Finding the Letters (HKLM-x32\...\InstallShield_{535FB733-FFCF-4460-8694-664A2F6C53B4}) (Version: 1.00.2012.0512 - Tong child Research & Planning Co.,Ltd)
Finding the Letters (x32 Version: 1.00.2012.0512 - Tong child Research & Planning Co.,Ltd) Hidden
FreeRide Games (HKLM-x32\...\{6C26A305-4549-4A8A-9F03-25719C03B0FB}) (Version: 07.05.80.00 - Exent Technologies)
Fruits (HKLM-x32\...\InstallShield_{AA39BFDE-71E5-46A6-A10B-44C2F45A341E}) (Version: 1.00.2012.0809 - Tong child Research & Planning Co.,Ltd)
Fruits (x32 Version: 1.00.2012.0809 - Tong child Research & Planning Co.,Ltd) Hidden
GamePortal (HKLM-x32\...\{530A0CD0-4158-45BE-AD45-8DC7019C597F}) (Version: 5.00.012.0605 - Lenovo)
Garmin Express (HKLM-x32\...\{d74c733b-9216-49f5-ae3a-14bf3a3d66f5}) (Version: 4.2.0.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 4.2.0.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 4.2.0.0 - Garmin Ltd or its subsidiaries) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 54.0.2840.99 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
GoPro Studio (x32 Version: 5.10.4320 - GoPro, Inc.) Hidden
GPBaseService2 (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
Grow Home (HKLM-x32\...\Steam App 323320) (Version: - Reflections, a Ubisoft Studio)
Guacamelee! Gold Edition (HKLM\...\Steam App 214770) (Version: - DrinkBox Studios)
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP DeskJet 1110 series Basic Device Software (HKLM\...\{87DEBE9C-FD90-4E36-8AD8-608F871B9BD9}) (Version: 35.0.61.54677 - Hewlett-Packard Co.)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.2024 - HP Photo Creations Powered by RocketLife)
HP Photosmart Officejet and Deskjet All-In-One Driver Software (HKLM\...\{6F5B70F0-EA6C-4A5B-BB16-8390BD66B251}) (Version: 14.0 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Support Solutions Framework (HKLM-x32\...\{23CCE784-A812-4647-AEFF-1DCCD4E57478}) (Version: 11.50.0000 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.0.1083 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{7224B7CE-196C-4E2A-A1AE-1D7BF259FD36}) (Version: 3.4.1942 - Intel Corporation)
iTunes (HKLM\...\{955524E7-79EB-4CA9-BA4D-FD2DF587651B}) (Version: 12.4.3.1 - Apple Inc.)
Java 8 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218051F0}) (Version: 8.0.510 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Lenovo Assistant (HKLM-x32\...\{B2DE4F30-B8C7-49C0-85B9-2F37A5290F00}) (Version: 2.0.0.23 - Lenovo)
Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.1900 - Broadcom Corporation)
Lenovo BrgVolOSD (HKLM-x32\...\{B0CAB976-C41D-4800-A7BA-CBD4BF4EA920}) (Version: 1.1.05 - Lenovo)
Lenovo Dashboard (HKLM-x32\...\{FEF1833C-244C-4DF2-AB67-1E1D26921ED8}) (Version: 2.0.0.9 - Lenovo)
Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: 4.8.5 - CEWE COLOR AG u Co. OHG)
Lenovo Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.6418 - CyberLink Corp.)
Lenovo Power2Go (x32 Version: 6.0.6418 - CyberLink Corp.) Hidden
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4409.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.4409.52 - CyberLink Corp.) Hidden
Lenovo Rescue System (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 4.0.0.0822 - CyberLink Corp.)
Lenovo Rescue System (Version: 4.0.0.0822 - CyberLink Corp.) Hidden
Lenovo Silver Silk Wireless Keyboard (HKLM-x32\...\InstallShield_{B88AD4F5-58A6-425D-9282-92228FEB7067}) (Version: 1.03 - Lenovo)
Lenovo Silver Silk Wireless Keyboard (x32 Version: 1.03 - Lenovo) Hidden
Lenovo USB2.0 UVC Camera (HKLM-x32\...\{70D2C5B8-EB22-45B1-9EAA-5E8C1C408A3B}) (Version: 1.00.0000 - Vimicro Corporation)
Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.1.3127 - CyberLink Corp.)
Lenovo YouCam (x32 Version: 4.1.3127 - CyberLink Corp.) Hidden
LenovoUtility version 1.0 (HKLM-x32\...\{4F949BD9-1E99-40C7-9102-C67E2D384995}_is1) (Version: 1.0 - Lenovo)
Lightshot-5.4.0.1 (HKLM-x32\...\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1) (Version: 5.4.0.1 - Skillbrains)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.541 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.541 - LogMeIn, Inc.) Hidden
LVT (HKLM-x32\...\{9E3469A6-443A-452C-BF44-8D7CE3A9A7E2}) (Version: 5.00.0914 - Lenovo)
Manual Perfection V19_V39 versión 1.0 (HKLM-x32\...\UsersGuideManual Perfection V19_V39_is1) (Version: 1.0 - )
MapleStory (HKLM-x32\...\MapleStory) (Version: - )
Mark of the Ninja (HKLM\...\Steam App 214560) (Version: - Klei Entertainment)
MarketResearch (x32 Version: 140.0.299.000 - Hewlett-Packard) Hidden
Matching Roles (HKLM-x32\...\InstallShield_{92736E44-7608-4D80-9333-E40C82B7E8B3}) (Version: 1.00.2012.0512 - Tong child Research & Planning Co.,Ltd)
Matching Roles (x32 Version: 1.00.2012.0512 - Tong child Research & Planning Co.,Ltd) Hidden
MATLAB R2015a (HKLM\...\Matlab R2015a) (Version: 8.5 - MathWorks)
Media Search App by Ask (HKLM-x32\...\{41545533-2D43-322D-4D47-A758B70C2D01}) (Version: 12.45.1.1183 - APN, LLC)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Network64 (Version: 140.0.306.000 - Hewlett-Packard) Hidden
Nexon Game Manager (HKLM-x32\...\{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}) (Version: - )
Nexon Launcher (HKLM-x32\...\Nexon Nexon Launcher) (Version: 1.3.0 - Nexon)
Nikon File Uploader 2 (HKLM-x32\...\{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}) (Version: 2.00.0001 - Nikon)
Nikon Message Center 2 (HKLM-x32\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.0.1 - Nikon)
Nitro Pro 8 (HKLM\...\{34BE77EE-B563-49D7-A8A0-FFD76D29BBD3}) (Version: 8.0.10.7 - Nitro)
NVIDIA PhysX (HKLM-x32\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)
OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Picture Control Utility (HKLM-x32\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.0 - Nikon)
Popcorn Time (HKLM-x32\...\Popcorn Time_is1) (Version: 5.5.1.2 - Popcorn Time) <==== ATTENTION
Portal (HKLM-x32\...\Steam App 400) (Version: - Valve)
Puzzle (HKLM-x32\...\InstallShield_{6EB7ECE3-E3BE-481D-821B-F1AFFA244D64}) (Version: 1.00.2012.0807 - Tong child Research & Planning Co.,Ltd)
Puzzle (x32 Version: 1.00.2012.0807 - Tong child Research & Planning Co.,Ltd) Hidden
QuickTime (HKLM-x32\...\{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}) (Version: 7.66.71.0 - Apple Inc.)
Quik (HKLM-x32\...\{0d91b40f-e179-491c-a726-cd71dc297e8a}) (Version: 2.0.0.4320 - GoPro, Inc.)
Quik (Version: 0.1.4320 - GoPro, Inc.) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6695 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.8400.29025 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{B20F9D1C-A0A5-4cd8-8306-DA03872311B1}) (Version: 1.00.0187 - REALTEK Semiconductor Corp.)
Relic Hunters Zero (HKLM-x32\...\Steam App 382490) (Version: - Rogue Snail)
Risk of Rain (HKLM-x32\...\Steam App 248820) (Version: - )
Rocket League (HKLM-x32\...\Steam App 252950) (Version: - Psyonix)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15024.8 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.15024.8 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
SketchUp Import 2016 (HKLM-x32\...\{C769FB7C-1F55-4B31-9A2A-21CEC50F4F92}) (Version: 2.0.0 - Autodesk)
Skype™ 7.30 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.30.105 - Skype Technologies S.A.)
Snowflake Suite (HKLM-x32\...\{E03B9D73-3806-4466-97B1-75C4486F65DF}) (Version: 1.0 - Natural User Interface Technologies AB)
Software Updater (HKLM-x32\...\{8DBC5A0A-31C4-46C7-B252-6B593EA11A87}) (Version: 4.3.7 - SEIKO EPSON CORPORATION)
SolutionCenter (x32 Version: 140.0.299.000 - Hewlett-Packard) Hidden
Spotify (HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Spotify) (Version: 1.0.11.134.ga37df67b - Spotify AB)
StageLight version 1.0.0.3497 (HKLM\...\StageLight) (Version: version 1.0.0.3497 - Open Labs, LLC.)
Starbound (HKLM\...\Steam App 211820) (Version: - )
Stardew Valley (HKLM\...\Steam App 413150) (Version: - ConcernedApe)
Status (x32 Version: 140.0.342.000 - Hewlett-Packard) Hidden
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
SugarSync Manager (HKLM-x32\...\SugarSync) (Version: 1.9.61.90905 - SugarSync, Inc.)
System Requirements Lab Detection (HKLM-x32\...\{06A5D553-A6B5-481C-958E-53C79C1AC3CB}) (Version: 6.1.6.0 - Husdawg, LLC)
Terraria (HKLM-x32\...\Steam App 105600) (Version: - Re-Logic)
timer (HKLM-x32\...\InstallShield_{9CC4B8EE-A96B-4800-B674-0CF8B4560F45}) (Version: 1.00.2012.0512 - Tong child Research & Planning Co.,Ltd)
timer (x32 Version: 1.00.2012.0512 - Tong child Research & Planning Co.,Ltd) Hidden
Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
UC浏览器 (HKLM-x32\...\UCBrowser) (Version: 5.7.15319.5 - 广州市动景计算机科技有限公司) <==== ATTENTION
Unity Web Player (HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\UnityWebPlayer) (Version: 4.5.4f1 - Unity Technologies ApS)
VFW_Codec32 (x32 Version: 0.1.160.0 - GoPro, Inc.) Hidden
VFW_Codec64 (Version: 0.1.160.0 - GoPro, Inc.) Hidden
Video Viewer (HKLM-x32\...\Video Viewer) (Version: 0.1.9.9 - AVTECH Corporation, Inc.)
ViewNX 2 (HKLM-x32\...\{DDD62492-32A7-412B-8AF1-2CF032AD42E3}) (Version: 2.0.1 - Nikon)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden
Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows Driver Package - GoPro (WinUSB) Universal Serial Bus devices (03/07/2012 ) (HKLM\...\0B624A43DD66DBF5CF3EDFA9741A364E688062A4) (Version: 03/07/2012 - GoPro)
Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.21 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
YouTubeByClick (HKLM-x32\...\{648D7AF2-9A50-45B3-94F5-755619C11B73}) (Version: 2.2.18 - YouTubeByClick.com)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2198469641-46685643-2895634536-1004_Classes\CLSID\{0B628DE4-07AD-4284-81CA-5B439F67C5E6}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-2198469641-46685643-2895634536-1004_Classes\CLSID\{149DD748-EA85-45A6-93C5-AC50D0260C98}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-2198469641-46685643-2895634536-1004_Classes\CLSID\{5370C727-1451-4700-A960-77630950AF6D}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-2198469641-46685643-2895634536-1004_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2198469641-46685643-2895634536-1004_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD 2016\en-US\acadficn.dll (Autodesk, Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0A165010-AF54-474C-94ED-9DFF4B9C3AD1} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {0A5EB38C-CF67-4132-9854-60015B62260D} - System32\Tasks\Microsoft\Windows\Multimedia\Manager => C:\Users\Ivan Reyes Ortega\AppData\Roaming\Adobe\Manager.exe [2016-11-28] ()
Task: {12C84F3D-A4F2-4679-AC79-A2BA61579CE8} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-11-09] (Microsoft Corporation)
Task: {15FA8FAB-820A-491D-A857-B058053684D0} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: {2112063D-C2C4-4ED2-8D91-EA33E01EA3AC} - System32\Tasks\{8DD3EE36-D507-432E-A9B1-FA7778A3BE83} => pcalua.exe -a D:\setup.exe -d D:\
Task: {26EC85F5-1BDB-49E9-A054-D64C01D6C3EE} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {2796E93F-F927-4E48-ABFA-1DB74CEDBFAA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {28383A68-A4F1-4D4F-9926-20CB3F790EC6} - System32\Tasks\UCBrowserUpdaterCore => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: {319B2FFE-9D83-4724-AEEA-BE39FAF40990} - System32\Tasks\Lenovo\Lenovo-31951 => C:\ProgramData\Lenovo-31951.vbs [2013-04-23] ()
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe
Task: {3C84829D-6B42-418D-A771-458A407DE3B3} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2014-12-01] (Apple Inc.)
Task: {49C43CBE-E19B-48D1-860A-A41B7A66DBF7} - System32\Tasks\RegistryDr_Popup => C:\Program Files (x86)\Registry Dr\Splash.exe <==== ATTENTION
Task: {5063F521-19C3-4E5A-81CB-5C8F68385746} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2012-07-27] (CyberLink)
Task: {527E4654-CB89-4667-B8A0-72E3FF062DBC} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {6366D6B0-4AF1-4BE9-8585-560E3CAC504B} - System32\Tasks\MATLAB R2015a Startup Accelerator => C:\Program Files\MATLAB\MATLAB Production Server\R2015a\bin\win64\MATLABStartupAccelerator.exe [2014-12-29] ()
Task: {65F1D94F-1B83-49CD-A06C-67FBB06EDB1C} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2016-08-12] (Intel Corporation)
Task: {718CA63A-5FCD-4CED-947B-D96C8A446393} - System32\Tasks\Lenovo\Lenovo-31886 => C:\ProgramData\Lenovo-31886.vbs [2013-04-23] ()
Task: {74E3D63A-49D6-4364-AD93-EC23C1800870} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe <==== ATTENTION
Task: {784859C8-AEE8-46E5-932A-A867C71F9E46} - System32\Tasks\update-S-1-5-21-2198469641-46685643-2895634536-1004 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2014-11-28] ()
Task: {80426A41-260C-404B-9118-7056DAA30411} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {8EFD4A30-8449-473D-B5CB-C3FE9E6AA696} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-28] (Google Inc.)
Task: {8FA5B345-C64D-46AF-A01C-712450EF5DF4} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
Task: {94F39B2E-640A-4BC1-8B69-188EE055C68A} - System32\Tasks\{7C134AF1-A52C-45FB-A769-590205637799} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.18.0.105/en/abandoninstall?source=lightinstaller&amp;page=tsBing
Task: {96BB6801-483A-46F9-B8E5-4BE2680F272B} - System32\Tasks\{DB50062B-1108-4516-B07E-CB933EB55684} => pcalua.exe -a "C:\Users\Ivan Reyes Ortega\AppData\Local\Akamai\uninstall.exe"
Task: {97067761-8A56-422F-9D9F-9DFF349C95A1} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {9E2BB99F-4450-46FA-889C-EE0E9746BC96} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-28] (Google Inc.)
Task: {AB21143A-912A-4C23-B434-36F31AF5F4AD} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {ACC90A31-B54E-45B9-9C65-5604BAA1B87C} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express SelfUpdater\ExpressSelfUpdater.exe [2016-10-25] ()
Task: {B3E8083E-B3F5-4CC4-9CB3-F1C7247D0C7A} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {B9BAA86C-5FD2-41BF-87A1-EEF21BF9284F} - System32\Tasks\update-sys => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2014-11-28] ()
Task: {D241D09F-6EFA-462C-8E72-95329844212A} - \WPD\SqmUpload_S-1-5-21-2198469641-46685643-2895634536-1001 -> No File <==== ATTENTION
Task: {D852B7A0-A14F-4C30-85F0-8F1A998CD974} - System32\Tasks\RegistryDr_Start => C:\Program Files (x86)\Registry Dr\RegistryDr.exe <==== ATTENTION
Task: {DA251989-C31D-479E-89D6-3B27D73F18E1} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {DFB4AF5D-A014-4D89-8F4D-3FBAA5976A0D} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2016-08-12] (Intel Corporation)
Task: {E50365B6-808E-46BC-9625-F32BD3C44B89} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {F5F9C05F-FDF0-451B-8CF6-8D6620812AA3} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {F6FD2841-898E-44AE-981A-D8E14760DC8B} - System32\Tasks\EPSON Perfection V19 Update => C:\Program Files (x86)\epson\escndv\update\e_dtsksd.exe [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {F8532917-B977-40D5-B99C-A712A571A196} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-ivan.reor@gmail.com => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {FCE3B066-123B-46A5-A204-0DC1CBA06A57} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\EPSON Perfection V19 Update.job => C:\Program Files (x86)\epson\escndv\update\e_dtsksd.exe7/EXE_S:EPSON Perfection V19,ES010C.DAT /F:Update www\JoanneĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\MATLAB R2015a Startup Accelerator.job => C:\Program Files\MATLAB\MATLAB Production Server\R2015a\bin\win64\MATLABStartupAccelerator.exe
Task: C:\WINDOWS\Tasks\UCBrowserUpdater.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\update-S-1-5-21-2198469641-46685643-2895634536-1004.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\WINDOWS\Tasks\update-sys.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\Ivan Reyes Ortega\Desktop\Gоogle Сhromе.lnk -> C:\Users\Ivan Reyes Ortega\AppData\Roaming\Browsers\exe.emorhc.bat ()
Shortcut: C:\Users\Ivan Reyes Ortega\Desktop\Nеxon Launcher.lnk -> C:\Users\Ivan Reyes Ortega\AppData\Roaming\Browsers\exe.rehcnual_noxen.bat ()
Shortcut: C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Intеrnet Exрlоrer.lnk -> C:\Users\Ivan Reyes Ortega\AppData\Roaming\Browsers\exe.erolpxei.bat ()
Shortcut: C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Gоogle Chrоmе.lnk -> C:\Users\Ivan Reyes Ortega\AppData\Roaming\Browsers\exe.emorhc.bat ()
Shortcut: C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunch Intеrnet Exрlorеr Вrowsеr.lnk -> C:\Users\Ivan Reyes Ortega\AppData\Roaming\Browsers\exe.erolpxei.bat ()
Shortcut: C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Gоogle Сhrоmе.lnk -> C:\Users\Ivan Reyes Ortega\AppData\Roaming\Browsers\exe.emorhc.bat ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gооgle Chrоmе.lnk -> C:\Users\Ivan Reyes Ortega\AppData\Roaming\Browsers\exe.emorhc.bat ()
Shortcut: C:\Users\Public\Desktop\Ваttle.nеt.lnk -> C:\Users\Ivan Reyes Ortega\AppData\Roaming\Browsers\exe.rehcnual ten.elttab.bat ()

ShortcutWithArgument: C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69b5b7893971c8e8\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1"
ShortcutWithArgument: C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1"

==================== Loaded Modules (Whitelisted) ==============

2016-03-18 22:56 - 2016-03-18 22:56 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-07-05 15:23 - 2016-07-05 15:23 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-10-11 23:48 - 2016-10-11 23:48 - 00037808 _____ () C:\Program Files\GoPro\GoPro Desktop App\GoProDeviceDetection.exe
2016-07-16 07:42 - 2016-07-16 07:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-10-01 08:08 - 2016-10-01 08:08 - 02681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-10-01 08:08 - 2016-10-01 08:08 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-03-06 17:28 - 2014-12-29 19:25 - 00045056 _____ () C:\Program Files\MATLAB\MATLAB Production Server\R2015a\bin\win64\MATLABStartupAccelerator.exe
2016-10-01 08:08 - 2016-10-01 08:08 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-10-02 13:50 - 2016-10-02 13:51 - 01864384 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\amd64\ClientTelemetry.dll
2016-10-01 08:08 - 2016-10-01 08:08 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2016-11-08 17:15 - 2016-11-02 06:30 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2016-11-08 17:14 - 2016-11-02 06:21 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-11-08 17:14 - 2016-11-02 06:15 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-11-08 17:15 - 2016-11-02 06:14 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2016-11-08 17:15 - 2016-11-02 06:15 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-11-08 17:15 - 2016-11-02 06:16 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-11-08 17:15 - 2016-11-02 06:17 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-11-17 10:15 - 2016-11-17 10:19 - 00072192 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2016-11-17 10:15 - 2016-11-17 10:19 - 00178688 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2016-11-17 10:15 - 2016-11-17 10:19 - 41609728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2016-10-11 23:48 - 2016-10-11 23:48 - 00866224 _____ () C:\Program Files\GoPro\GoPro Desktop App\GoProDesktopSystemTray.exe
2016-11-28 08:54 - 2016-11-28 08:54 - 00434692 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\DBUpdater.exe
2016-11-04 13:57 - 2016-11-04 13:58 - 02549248 _____ () C:\Program Files\WindowsApps\Microsoft.People_10.1.2850.0_x64__8wekyb3d8bbwe\People.BackgroundTasks.dll
2016-11-04 13:57 - 2016-11-04 13:58 - 00139264 _____ () C:\Program Files\WindowsApps\Microsoft.People_10.1.2850.0_x64__8wekyb3d8bbwe\PeopleUtilRT.Windows.dll
2015-05-05 23:31 - 2014-12-04 22:27 - 00055688 _____ () C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\QtSolutions_Service-head.dll
2015-05-05 23:31 - 2014-12-04 22:27 - 00104328 _____ () C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\qjson0.dll
2013-04-23 14:15 - 2013-02-22 18:05 - 00387984 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\fl_core.dll
2013-04-23 14:15 - 2013-02-22 18:05 - 00199056 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_base.dll
2013-04-23 14:15 - 2013-02-22 18:05 - 01165712 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_asr.dll
2013-04-23 14:15 - 2013-02-22 18:05 - 01132944 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_pron.dll
2013-04-23 14:15 - 2013-02-22 18:05 - 00035216 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_platform.dll
2013-04-23 14:15 - 2013-02-22 18:05 - 00229264 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\sdxg.dll
2013-04-23 14:15 - 2013-02-22 18:04 - 00027648 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\WASAPIResamplingStreamCOMServer.dll
2013-04-23 13:47 - 2012-07-26 22:12 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2016-07-05 15:23 - 2016-07-05 15:23 - 01041208 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2016-10-02 13:50 - 2016-10-02 13:50 - 01383616 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\ClientTelemetry.dll
2016-10-02 13:53 - 2016-10-02 13:53 - 00118976 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\Microsoft\OneDrive\17.3.6517.0809_1\FileSyncViews.dll
2016-08-01 16:39 - 2016-03-09 02:28 - 03306496 _____ () C:\Program Files (x86)\Bluestacks\libGLESv2.dll
2012-03-12 13:55 - 2012-03-12 13:55 - 00008192 _____ () C:\Program Files (x86)\Lenovo\Lenovo BrgVolOSD\CD_DLL.dll
2011-11-03 14:48 - 2011-11-03 14:48 - 00056320 _____ () C:\Program Files (x86)\Lenovo\Lenovo Silver Silk Wireless Keyboard\skfunc.dll
2009-12-04 19:59 - 2009-12-04 19:59 - 00619816 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
2009-12-04 20:04 - 2009-12-04 20:04 - 00013096 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
2016-11-14 19:35 - 2016-11-08 16:29 - 01819240 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libglesv2.dll
2016-11-14 19:35 - 2016-11-08 16:29 - 00093288 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libegl.dll
2016-11-08 17:17 - 2016-11-08 17:17 - 17772736 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\PepperFlash\23.0.0.207\pepflashplayer.dll
2016-08-12 18:38 - 2016-08-12 18:38 - 00042720 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32api.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00060640 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\pywintypes27.dll
2016-08-12 18:38 - 2016-08-12 18:38 - 00126688 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\pythoncom27.dll
2016-08-12 18:38 - 2016-08-12 18:38 - 00023264 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_multiprocessing.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00045792 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_ctypes.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00026848 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32service.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00023776 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\servicemanager.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00030432 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_socket.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00444128 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_ssl.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00287968 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_hashlib.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00018144 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\select.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00021216 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32pipe.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00045792 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32file.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00018656 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32event.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00371424 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_bsddb.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00025312 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32process.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00021216 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32ts.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00019680 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32profile.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00043744 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32security.pyd
2016-08-12 18:38 - 2016-08-12 18:38 - 00025824 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32inet.pyd

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\Classes\.scr: AutoCADScriptFile =>

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\Ivan Reyes Ortega\Desktop\bxifRla.jpg
DNS Servers: 10.0.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\StartupFolder: => "GoPro Importer.lnk"
HKLM\...\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKLM\...\StartupApproved\Run32: => "ADSKAppManager"
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\StartupApproved\Run: => "iCloudServices"
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\StartupApproved\Run: => "iCloudDrive"
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\StartupApproved\Run: => "ApplePhotoStreams"
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\StartupApproved\Run: => "Autodesk Sync"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{77BE12A4-49DE-43B1-BAE6-FF86BA26CB2C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win32\starbound.exe
FirewallRules: [{6AEAC4AB-A725-4E18-97FD-95209CD88384}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win32\starbound.exe
FirewallRules: [{949DD314-214A-42A9-9BA4-006BAF4B8BF0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\mod_uploader.exe
FirewallRules: [{DBB7B2EB-35C4-4C20-85CE-4D3AFA16B119}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\mod_uploader.exe
FirewallRules: [{CC81E284-C40A-44F2-A696-E520BF9AB57F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\starbound_server.exe
FirewallRules: [{4C86F986-E558-4AB0-8B06-57D6556FDEA1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\starbound_server.exe
FirewallRules: [{B3F124C6-919E-48AD-A9B9-6EEA861198AB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\starbound.exe
FirewallRules: [{59BBA3EA-B0E1-48E2-848A-6864F2E0454F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\starbound.exe
FirewallRules: [{DB372886-A51D-4107-A9A0-1D49662235D4}] => (Allow) C:\Program Files\HP\HP DeskJet 1110 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{B4A5DE8B-E32F-4760-9EEE-26854A3724D4}] => (Allow) C:\Program Files\HP\HP DeskJet 1110 series\Bin\USBSetup.exe
FirewallRules: [{41EB60FC-7A76-4E3D-929B-228ED617958C}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{F419D9AB-41B9-4E6A-9551-5E07055E9AA6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win32\starbound.exe
FirewallRules: [{9FA40796-E96C-4854-8DDD-5EB8E9C5731E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win32\starbound.exe
FirewallRules: [{9F42AFA2-F239-4678-A371-32ABEBE8EB4A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\mod_uploader.exe
FirewallRules: [{F80952E9-3BFA-4C1E-8582-4D88A038CB42}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\mod_uploader.exe
FirewallRules: [{4FCA1982-A7C4-4D4A-90DB-6E43AAFC50AA}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\starbound_server.exe
FirewallRules: [{ABF428DE-902A-47B5-8F8C-8CC19FA4B885}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\starbound_server.exe
FirewallRules: [{B5FBC99F-4017-4BED-9B5C-56AF05F6CD38}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\starbound.exe
FirewallRules: [{8F3C3BD9-AA0E-4A2D-A88B-230C72A101E7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win64\starbound.exe
FirewallRules: [{EBB2669A-B809-445A-86E4-E9B1F209D587}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{0F899D30-1CD8-4E69-821C-08314CEBEF98}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{6442B1CC-B32F-4A4C-856E-D21ABBE1482B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
FirewallRules: [{47A93463-9A07-4B0D-8B68-B63004B0B8D4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
FirewallRules: [{9E0587A5-ECCC-4A9E-AA83-3A75F5DEA0C6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win32\mod_uploader.exe
FirewallRules: [{1BFE23EC-76F3-4216-A975-B687CE419FCC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Starbound\win32\mod_uploader.exe
FirewallRules: [{CE6BA63A-B43F-4928-91A3-D526940B2F15}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DA4F0A87-CCDA-4F11-BB60-3632FF1E792D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9E80797D-8A6F-4A56-9FE9-85A46946C8E3}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{3FA025E0-23BD-4DCA-AF0C-78787D0EE8E2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E15F816F-6DAA-4661-9FA9-156ABC3CBA62}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\mark_of_the_ninja\bin\game.exe
FirewallRules: [{7C27F9DA-FE39-4360-A084-2B6BF5D724AE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\mark_of_the_ninja\bin\game.exe
FirewallRules: [{365E90CC-6B0F-41CF-BCEE-2149DD018831}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Guacamelee\Guac.exe
FirewallRules: [{BAE174CC-348D-461E-BCBA-CF535108468D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Guacamelee\Guac.exe
FirewallRules: [UDP Query User{39847624-14F3-42B0-8EAB-F381E2F5F24B}C:\users\ivan reyes ortega\downloads\enter.the.gungeon\enter the gungeon\etg.exe] => (Allow) C:\users\ivan reyes ortega\downloads\enter.the.gungeon\enter the gungeon\etg.exe
FirewallRules: [TCP Query User{615A882C-9547-414D-AC36-A5776358A56C}C:\users\ivan reyes ortega\downloads\enter.the.gungeon\enter the gungeon\etg.exe] => (Allow) C:\users\ivan reyes ortega\downloads\enter.the.gungeon\enter the gungeon\etg.exe
FirewallRules: [{AA118E05-F35F-47CB-B2A5-CC78B2075D01}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Stardew Valley\Stardew Valley.exe
FirewallRules: [{AF33B213-C317-4F27-9B7A-D05BBF077312}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Stardew Valley\Stardew Valley.exe
FirewallRules: [{CAC31A13-56C8-473E-99D8-B07E56FF0B5F}] => (Block) C:\users\ivan reyes ortega\appdata\local\popcorn time\node-webkit\popcorn time.exe
FirewallRules: [{8F2749F3-2A74-4568-BF91-CBFB3841981D}] => (Block) C:\users\ivan reyes ortega\appdata\local\popcorn time\node-webkit\popcorn time.exe
FirewallRules: [UDP Query User{967B06DD-7F87-49DB-BE2D-C1899FA4EFCF}C:\users\ivan reyes ortega\appdata\local\popcorn time\node-webkit\popcorn time.exe] => (Allow) C:\users\ivan reyes ortega\appdata\local\popcorn time\node-webkit\popcorn time.exe
FirewallRules: [TCP Query User{68DF18A3-0ACD-47E9-B870-EFB5711343E9}C:\users\ivan reyes ortega\appdata\local\popcorn time\node-webkit\popcorn time.exe] => (Allow) C:\users\ivan reyes ortega\appdata\local\popcorn time\node-webkit\popcorn time.exe
FirewallRules: [{B9153A24-D0C5-4255-936E-99F94AA402FE}] => (Allow) LPort=50248
FirewallRules: [{7A66FB29-D59D-4A4F-830E-36652BE9E8E8}] => (Block) C:\users\ivan reyes ortega\appdata\local\akamai\netsession_win.exe
FirewallRules: [{6E66C2E6-41CD-4A7E-A8A6-43AB722B80E1}] => (Block) C:\users\ivan reyes ortega\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{B22C16FF-25FA-4940-BC50-C69A0E6E0D18}C:\users\ivan reyes ortega\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\ivan reyes ortega\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{A30B1611-3E2E-44BD-AC65-EF654CA510C0}C:\users\ivan reyes ortega\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\ivan reyes ortega\appdata\local\akamai\netsession_win.exe
FirewallRules: [{A9008696-CE84-429F-9B50-B14FC9512B6E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{B9776E9F-B9A6-4C69-90BE-1BB929055C7C}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{E1CA524D-7BB8-46E8-9B9E-06B64568843D}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{52DA54E6-18B4-494B-9C9D-EB04DBF2F847}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{8BFA967D-BAE1-4FB4-A40F-397F136333EE}] => (Allow) C:\ProgramData\NexonUS\NGM\NGM.exe
FirewallRules: [{56F73F32-15E7-494A-AA3D-F4AE30197F36}] => (Allow) C:\ProgramData\NexonUS\NGM\NGM.exe
FirewallRules: [{EABCF979-53D6-48B1-AE62-760F8DA2193D}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{B8F390CE-CB76-4829-8C45-2250AE1278EF}] => (Allow) LPort=1900
FirewallRules: [{AC4A8A44-B8E0-4880-AEA3-D9E3BBAEB9B9}] => (Allow) LPort=2869
FirewallRules: [{E2694AC1-83EE-4A83-8C8E-42B285624AF5}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{BC979BD9-350C-412D-9C10-419540536B1E}] => (Allow) C:\Program Files (x86)\Lenovo\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{7ED94DEF-3338-413A-91B4-ABAAC22AE55C}] => (Allow) C:\Program Files (x86)\Lenovo\PowerDVD10\PowerDVD10.EXE
FirewallRules: [TCP Query User{9A9CC485-97EB-4781-89EA-15488D26FF61}C:\program files (x86)\videoviewer\videoviewer.exe] => (Allow) C:\program files (x86)\videoviewer\videoviewer.exe
FirewallRules: [UDP Query User{62E026D0-B119-4286-A75B-08ADABCAAF60}C:\program files (x86)\videoviewer\videoviewer.exe] => (Allow) C:\program files (x86)\videoviewer\videoviewer.exe
FirewallRules: [{975ECBD9-02FD-4DE1-93BE-1510CB40F170}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{7E7F0401-485E-4A61-873C-AD7A21B8E7DF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [TCP Query User{A68C2BF9-47E5-4ED6-84FD-007F95A9C7B6}C:\program files (x86)\lenovo\touch game\snowflake suite\bin\release\launcher.exe] => (Allow) C:\program files (x86)\lenovo\touch game\snowflake suite\bin\release\launcher.exe
FirewallRules: [UDP Query User{90AD6C1F-06A1-423D-8F3E-6DF581B164B1}C:\program files (x86)\lenovo\touch game\snowflake suite\bin\release\launcher.exe] => (Allow) C:\program files (x86)\lenovo\touch game\snowflake suite\bin\release\launcher.exe
FirewallRules: [TCP Query User{2459B2C4-C0C3-41A3-8BD9-E3E8A70224CF}C:\program files (x86)\steam\steamapps\common\starbound\win32\starbound_server.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\starbound\win32\starbound_server.exe
FirewallRules: [UDP Query User{01B314AA-556B-480F-BE89-683906BAC01E}C:\program files (x86)\steam\steamapps\common\starbound\win32\starbound_server.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\starbound\win32\starbound_server.exe
FirewallRules: [{4929B6FF-3443-4C5D-A86B-547E1B003B4C}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{CC0A394E-7935-4C0F-A4BC-AED9364680E0}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{3C0B7222-60BC-41BD-9F61-B2712FC7BF59}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{095DF0FC-F3F8-4FD1-9FD6-AE548BAD0EA7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{167D87C4-320B-4C0E-99F9-4C1FF6DF9B89}] => (Allow) C:\Users\Ivan Reyes Ortega\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{30BC05B1-043D-48AB-81DE-8FB8A93745BF}] => (Allow) C:\Users\Ivan Reyes Ortega\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [TCP Query User{1E8950D0-B9C5-463D-A3A5-DD021B62245F}C:\program files (x86)\torntv.com\torntv downloader.exe] => (Block) C:\program files (x86)\torntv.com\torntv downloader.exe
FirewallRules: [UDP Query User{E1B73A5B-5CA6-48A5-937E-85785924C8CA}C:\program files (x86)\torntv.com\torntv downloader.exe] => (Block) C:\program files (x86)\torntv.com\torntv downloader.exe
FirewallRules: [{0DF074E1-AC46-401B-903B-C561FAD2E0F3}] => (Allow) C:\Users\Ivan Reyes Ortega\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{21144E42-4218-4231-AB2C-F6239E82301F}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
FirewallRules: [{35CB5256-1451-4682-B346-5C902B18B731}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
FirewallRules: [{8F497986-ED76-4DAA-8BCA-FDC080F23241}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxm08.exe
FirewallRules: [{A3F0A030-5F72-4193-A5C9-05ED16BA29DA}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposfx08.exe
FirewallRules: [{331E3B3B-1F53-4980-BF44-9F3C610E1280}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
FirewallRules: [{A0ADD1CC-86E9-4D03-830F-FD3B109CE679}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{0DE939DF-FB7D-4002-815E-29DBEF26FFA8}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcopy2.exe
FirewallRules: [{1983A01C-EC6F-4542-B7B5-B2618B41E033}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{D0CA3C7C-F1F7-468E-BD37-5865FD35D1C4}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpzwiz01.exe
FirewallRules: [{958B5DE8-936A-4C1E-AA26-2B96B51BD468}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
FirewallRules: [{1435A1AB-EE41-4FD9-8255-21F7176B72BD}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqnrs08.exe
FirewallRules: [{CFAF5E96-F3BB-45B5-A982-73EA362D4781}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{6DD29254-766F-4435-82F6-51FC2F503D7B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxs08.exe
FirewallRules: [{FD05594D-75EE-4653-97C9-B92BD90EBDEF}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqfxt08.exe
FirewallRules: [{1C14978F-A69F-4301-8770-B426DED0EBFF}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{B20F3FA7-FC4C-433B-A935-5B0B563D853C}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{2000EDAF-39F4-49D6-9254-2043904BCFBA}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe
FirewallRules: [{EFF9B671-4F97-4736-9E27-1FA2091F35F7}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe
FirewallRules: [{E18F8DE7-E6FF-45B1-8E93-4ADA64FCEADB}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{8BEC8E25-132A-4E91-A3D1-0BF8637788F2}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{02740AED-3980-47A8-8096-252E054E671E}C:\users\ivan reyes ortega\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\ivan reyes ortega\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{48CB6EA1-CCFC-4723-9B54-A5BCE578CE51}C:\users\ivan reyes ortega\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\ivan reyes ortega\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{49130D70-67FC-43FC-8721-5C36D870F827}C:\users\ivan reyes ortega\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\ivan reyes ortega\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{70E0437F-FBCD-40A7-9F8A-B433FEA64098}C:\users\ivan reyes ortega\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\ivan reyes ortega\appdata\roaming\spotify\spotify.exe
FirewallRules: [{E2319FC4-7101-4A09-8E37-7F8D18FF2043}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Brawlhalla\Brawlhalla.exe
FirewallRules: [{C78AA84B-6DEF-41C6-97C9-6BE00AC40814}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Brawlhalla\Brawlhalla.exe
FirewallRules: [{91A56E40-DC01-4314-A857-1F2246ED06DC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Broforce\Broforce_beta.exe
FirewallRules: [{4C216977-FFF6-4E71-A81E-78A772E98EAF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Broforce\Broforce_beta.exe
FirewallRules: [{E74B1726-33CE-4CED-8976-9B2D41C37561}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risk of Rain\Risk of Rain.exe
FirewallRules: [{D6D01D64-87F7-49D6-B9AD-A25D691DB640}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risk of Rain\Risk of Rain.exe
FirewallRules: [{EA5186FF-CCF1-4F35-B6AA-E9FD1659ED5F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\BattleBlock Theater\BattleBlockTheater.exe
FirewallRules: [{D91FFDF9-BF6F-4BE6-B100-A097FD42460F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\BattleBlock Theater\BattleBlockTheater.exe
FirewallRules: [{14AB5886-7D9E-4F67-82DD-8B745B4C2BE3}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\CastleCrashers\castle.exe
FirewallRules: [{DCCE1E2A-A36D-4D74-B2CD-F5FD7AA519A9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\CastleCrashers\castle.exe
FirewallRules: [{829087A1-F9DA-4C65-8F8E-FF5BF46D35E7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [{CF531D95-1695-4080-89A5-E88F711D9D5A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [{12D6D81A-2F13-4543-9505-67B178832C3A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GrowHome\GrowHome.exe
FirewallRules: [{17C3B4EB-23CE-4A3C-9A90-6180FCD541E4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GrowHome\GrowHome.exe
FirewallRules: [{82D0E2BD-B950-450B-BF64-62C8FB01A85B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Relic Hunters Zero\RelicHuntersZero.exe
FirewallRules: [{1489C886-A1FD-49DB-9C08-F9E593B6903A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Relic Hunters Zero\RelicHuntersZero.exe
FirewallRules: [{F1214F86-3B5E-420F-BFFE-097F741F9D8B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Terraria\Terraria.exe
FirewallRules: [{123C0259-0AA0-46D0-BA94-A0D7E4775A93}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Terraria\Terraria.exe
FirewallRules: [TCP Query User{A44F0A70-2BBB-4681-93EE-881E59151624}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe
FirewallRules: [UDP Query User{99E13054-9B0B-410E-9C5B-30ECE0249108}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe
FirewallRules: [{61A9118A-998E-4088-889A-A7FF64A24695}] => (Block) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe
FirewallRules: [{7EA53580-F13B-4249-8F38-7B3F160343D8}] => (Block) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe
FirewallRules: [TCP Query User{0969C7DC-A851-49EB-8F7F-7B2C78C583ED}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [UDP Query User{708CC35E-4882-4361-B15A-961EDEBCCCDB}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [{64720D4C-B79F-4E93-A45E-AA554FEF577E}] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [{AA56DD6F-0898-45A8-AC53-18CFD06A25BE}] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [{332E629C-9FD9-4D7C-8A25-7CBEF58A4C3D}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
FirewallRules: [{045B94D9-C348-4F73-B661-B11796F68353}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
FirewallRules: [TCP Query User{C1F0C80F-6B8D-4B44-9286-6AF79A5E89F4}C:\program files\matlab\r2015b\bin\win64\matlab.exe] => (Allow) C:\program files\matlab\r2015b\bin\win64\matlab.exe
FirewallRules: [UDP Query User{5B13973B-E8EA-417A-8504-C2C1CB934554}C:\program files\matlab\r2015b\bin\win64\matlab.exe] => (Allow) C:\program files\matlab\r2015b\bin\win64\matlab.exe
FirewallRules: [{FBC6FB7C-2D72-4DF0-A619-6858EBBC2A93}] => (Allow) C:\Users\Joanne\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{B8ED7DB7-89D5-4DF7-B25B-B72D74B483E5}] => (Allow) C:\Users\Joanne\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{89B207B0-787E-4001-AB81-B3922A82A73E}] => (Allow) C:\Users\Joanne\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{8F2E7CC6-5847-4676-A438-612C1FDDF0D1}] => (Allow) C:\Users\Joanne\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{09AD54A4-1B88-4794-A91C-AF698FAEDEC4}] => (Allow) C:\Users\Joanne\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{15F4F775-C5CB-4049-8D9B-7BC3CBA4DC7C}] => (Allow) C:\Users\Joanne\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [TCP Query User{F7B79E30-FA3E-4FC3-8D4E-3DF7D0475ECB}C:\program files\matlab\matlab production server\r2015a\bin\win64\matlab.exe] => (Allow) C:\program files\matlab\matlab production server\r2015a\bin\win64\matlab.exe
FirewallRules: [UDP Query User{8CEDC82E-C18F-41E4-A0C1-754C4277C0FF}C:\program files\matlab\matlab production server\r2015a\bin\win64\matlab.exe] => (Allow) C:\program files\matlab\matlab production server\r2015a\bin\win64\matlab.exe
FirewallRules: [{B9BE043C-5216-4132-B885-12B5142654DF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{ADE1ED92-F248-4E80-BF56-DC7937F97D07}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{882F13AC-F890-40BE-B639-2E1EAB8C672D}] => (Allow) C:\Program Files (x86)\Popcorn Time\Updater.exe
FirewallRules: [{1669AA52-D9D7-467A-B0C3-DDFB0BA571E8}] => (Allow) C:\Program Files (x86)\Popcorn Time\Updater.exe
FirewallRules: [{E8931D55-BD0D-4D6A-9A28-F1ECB94612CA}] => (Allow) C:\Program Files (x86)\Popcorn Time\Updater.exe
FirewallRules: [{A0B0DE1D-A3A5-44E3-9041-398A18885A77}] => (Allow) C:\Program Files (x86)\Popcorn Time\Updater.exe
FirewallRules: [{F2352761-7E02-4F96-8838-BFD68934E776}] => (Allow) C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe
FirewallRules: [{E2984905-FC25-4F4A-8805-3FC49A5D1111}] => (Allow) C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe
FirewallRules: [{52671084-582D-4BA0-AD36-905B8DC2280D}] => (Allow) C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe
FirewallRules: [{C7A3C673-2D8B-453F-AE1F-327FAD845F34}] => (Allow) C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe
FirewallRules: [{59C4474F-7725-4265-AE0F-88F974408011}] => (Allow) C:\Program Files (x86)\Popcorn Time\chromecast\node.exe
FirewallRules: [{3E9C3E5A-2A1C-4981-8167-A31A567409DD}] => (Allow) C:\Program Files (x86)\Popcorn Time\chromecast\node.exe
FirewallRules: [{815049DE-8E78-4E75-8544-6E4D5A144E0E}] => (Allow) C:\Program Files (x86)\Popcorn Time\chromecast\node.exe
FirewallRules: [{842A01E1-DC86-4D63-9D93-398E9F831DC4}] => (Allow) C:\Program Files (x86)\Popcorn Time\chromecast\node.exe
FirewallRules: [{B939B50D-A614-4282-A6CF-21E250694C22}] => (Allow) C:\Program Files\GoPro\GoPro Desktop App\Quik.exe
FirewallRules: [{2BB0ECE1-C9F4-44BA-8D6F-BCD66FB71772}] => (Allow) C:\Program Files\GoPro\GoPro Desktop App\GoProMsgBus.exe
FirewallRules: [{0D4A8E6B-AB05-4160-BC7E-A3B2C3D9CCC6}] => (Allow) C:\Program Files\GoPro\GoPro Desktop App\GoProIDService.exe
FirewallRules: [{2C8745AD-A67D-4136-89E5-7E08E3DC53EC}] => (Allow) C:\Program Files\GoPro\GoPro Desktop App\GoProLauncher.exe
FirewallRules: [{F60A072A-CAC3-473A-A3B9-2040FB04327D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{13EA340D-EACC-44F6-AA64-6589C74F439A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
FirewallRules: [{E66971C1-A475-4FBA-9D21-C3E7011E8984}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
FirewallRules: [{8647FA0C-DCF7-43FF-BB98-C77FEE543BA3}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{E51E850E-241C-4E8A-9333-20758B5DB387}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\Downloader\download\MiniThunderPlatform.exe

==================== Restore Points =========================

13-11-2016 15:47:59 Windows Modules Installer
21-11-2016 12:59:40 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/28/2016 08:55:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: DBUpdater.exe, version: 0.0.0.0, time stamp: 0x58208e8f
Faulting module name: DBUpdater.exe, version: 0.0.0.0, time stamp: 0x58208e8f
Exception code: 0xc0000417
Fault offset: 0x00033fe9
Faulting process id: 0x2dfc
Faulting application start time: 0x01d249769e11201a
Faulting application path: C:\Users\IVANRE~1\AppData\Local\Temp\DBUpdater.exe
Faulting module path: C:\Users\IVANRE~1\AppData\Local\Temp\DBUpdater.exe
Report Id: 774c33ff-d425-47b3-8237-613a56833aad
Faulting package full name:
Faulting package-relative application ID:

Error: (11/28/2016 08:54:40 AM) (Source: MsiInstaller) (EventID: 11310) (User: HOMEPC)
Description: Product: Akamai NetSession Interface -- Error 1310. Error writing to file: C:\Users\Ivan Reyes Ortega\AppData\Local\Akamai\admintool.exe. System error 0. Verify that you have access to that directory.

Error: (11/28/2016 08:54:12 AM) (Source: MsiInstaller) (EventID: 11310) (User: HOMEPC)
Description: Product: Akamai NetSession Interface -- Error 1310. Error writing to file: C:\Users\Ivan Reyes Ortega\AppData\Local\Akamai\admintool.exe. System error 0. Verify that you have access to that directory.

Error: (11/28/2016 08:53:09 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "WmiApRpl" in DLL "C:\WINDOWS\system32\wbem\wmiaprpl.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (11/28/2016 08:53:06 AM) (Source: Perflib) (EventID: 1023) (User: )
Description: Windows cannot load the extensible counter DLL rdyboost. The first four bytes (DWORD) of the Data section contains the Windows error code.

Error: (11/28/2016 08:53:04 AM) (Source: PerfNet) (EventID: 2004) (User: )
Description: Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

Error: (11/28/2016 08:53:04 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "MSDTC" in DLL "C:\WINDOWS\system32\msdtcuiu.DLL" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (11/28/2016 08:53:01 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "Lsa" in DLL "C:\Windows\System32\Secur32.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (11/28/2016 08:53:01 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "ESENT" in DLL "C:\WINDOWS\system32\esentprf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (11/28/2016 08:53:00 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.


System errors:
=============
Error: (11/28/2016 08:55:09 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.

Error: (11/28/2016 08:52:11 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/28/2016 08:52:11 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/28/2016 08:52:09 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/28/2016 03:15:23 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {B91D5831-B1BD-4608-8198-D72E155020F7} did not register with DCOM within the required timeout.

Error: (11/28/2016 03:14:17 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The LogMeIn Hamachi Tunneling Engine service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/28/2016 03:13:40 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout.

Error: (11/28/2016 03:10:41 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/28/2016 03:10:41 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/28/2016 03:10:40 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


CodeIntegrity:
===================================
Date: 2016-11-28 02:26:25.190
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-11-28 02:26:25.188
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-11-28 02:26:25.132
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-11-28 02:26:24.748
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-11-28 02:26:24.746
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-11-28 02:26:24.679
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-11-28 02:26:22.745
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-11-28 02:26:22.742
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-11-28 02:26:22.737
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-11-28 02:26:22.735
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3-3130M CPU @ 2.60GHz
Percentage of memory in use: 40%
Total physical RAM: 6029.13 MB
Available physical RAM: 3570.88 MB
Total Virtual: 6989.13 MB
Available Virtual: 4396.6 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:904.81 GB) (Free:360.79 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 1B3DE834)

Partition: GPT.

==================== End of Addition.txt ============================
 
No problem, I am going over your log with my morning cup of coffee. I will get back with a fix for you shortly. :)
 
Useless Program Removal.

Uninstall the items below with Geek Uninstaller.

Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon) <==== ATTENTION
Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
BitTorrent (HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\BitTorrent) (Version: 7.9.6.42095 - BitTorrent Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Support Solutions Framework (HKLM-x32\...\{23CCE784-A812-4647-AEFF-1DCCD4E57478}) (Version: 11.50.0000 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
Lenovo Assistant (HKLM-x32\...\{B2DE4F30-B8C7-49C0-85B9-2F37A5290F00}) (Version: 2.0.0.23 - Lenovo)
Media Search App by Ask (HKLM-x32\...\{41545533-2D43-322D-4D47-A758B70C2D01}) (Version: 12.45.1.1183 - APN, LLC)
UC浏览器 (HKLM-x32\...\UCBrowser) (Version: 5.7.15319.5 - 广州市动景计算机科技有限公司) <==== ATTENTION
YouTubeByClick (HKLM-x32\...\{648D7AF2-9A50-45B3-94F5-755619C11B73}) (Version: 2.2.18 - YouTubeByClick.com)

Your Chrome is infected, and needs to reset.!!

Download ResetBrowser To your desktop.
Now close all open browsers.
Right click and run as administrator.

vwUeyaZ.png


Click on Reset Chrome-- Allow completion.
Now reboot your machine.



FRST Fix.


Download attached fixlist.txt file and save it to the Desktop. NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.



Next:

Clean up temp files and reduce startup load with CCleaner.

  • Download CCleaner from here.
  • After install Click Options.
  • Go to monitoring.
  • Uncheck All Monitoring items.
  • Go to advanced -- Click close program after cleaning.
  • Go to settings -- click run ccleaner when the computer starts.
  • Now that you have ccleaner installed and set-up:
  • Open the program.
  • Go to Tools
  • Go to Startup
  • Now double click each item. To Disable.
  • You have a large amount of items starting, you should only keep three. Pick your fabvorite apps to start then disable the rest.
  • Then disable All items in your scheduled task as well.
  • Unless they are related to windows defender.
  • Reboot the machine.
 

Attachments

All the useless programs were deleted and my Google Chrome was reset.
Ran the fix. After boot Windows Firewall gave me an alert of blocking some features of Google Chrome and Akamai NetSession. Also got an error message regarding missing files for Lenovo Assistant (Which I uninstalled with the Geek Uninstaller). I'll post the Fixlog below.
 
Fix result of Farbar Recovery Scan Tool (x64) Version: 27-11-2016
Ran by Ivan Reyes Ortega (28-11-2016 11:01:49) Run:1
Running from C:\Users\Ivan Reyes Ortega\Desktop\Defenses\FRST
Loaded Profiles: Ivan Reyes Ortega (Available Profiles: Joanne & Ivan Reyes Ortega & Guest)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
C:\Program Files (x86)\AskPartnerNetwork
C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1928776 2016-11-09] (APN)
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\...\Policies\Explorer: []
GroupPolicy: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
Tcpip\..\Interfaces\{0d7355bc-6532-4c94-b735-8764407bd143}: [DhcpNameServer] 10.0.0.1
Tcpip\..\Interfaces\{525cffb3-8591-47ea-ada6-08e77e367fc4}: [DhcpNameServer] 192.168.43.1
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://home.lenovo.com
SearchScopes: HKLM -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-2198469641-46685643-2895634536-1004 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-2198469641-46685643-2895634536-1004 -> {89905693-D965-4436-8806-234F772945FF} URL = hxxp://www.search.ask.com/web?tpid=ATU3-C2-MG&o=APN11391&pf=V7&p2=^BAY^YYYYYY^CA^DO&gct=&itbv=12.38.0.3432&apn_uid=5CA1A7FE-655C-43C4-A49C-B8E73E9813F2&apn_ptnrs=^BAY&apn_dtid=^YYYYYY^CA^DO&apn_dbr=microsoftedge.exe_6_20.10240.16384.0&doi=2016-01-16&trgb=CR&q={searchTerms}&psv=&pt=tb
BHO: Media Search App by Ask -> {41545533-2D43-322D-4D47-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU3-C2-MG\Passport_x64.dll [2016-11-09] (APN LLC.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO-x32: Media Search App by Ask -> {41545533-2D43-322D-4D47-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU3-C2-MG\Passport.dll [2016-11-09] (APN LLC.)
BHO-x32: Glass Bottle -> {88803a01-4125-443b-b869-4062a160ceea} -> C:\Program Files (x86)\Glass Bottle\Extensions\88803a01-4125-443b-b869-4062a160ceea.dll => No File
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM - Media Search App by Ask - {41545533-2D43-322D-4D47-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU3-C2-MG\Passport_x64.dll [2016-11-09] (APN LLC.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM-x32 - Media Search App by Ask - {41545533-2D43-322D-4D47-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU3-C2-MG\Passport.dll [2016-11-09] (APN LLC.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)
Toolbar: HKU\S-1-5-21-2198469641-46685643-2895634536-1004 -> Media Search App by Ask - {41545533-2D43-322D-4D47-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU3-C2-MG\Passport_x64.dll [2016-11-09] (APN LLC.)
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK => not found
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HomePage: Profile 1 -> search.ask.com/?gct=hp
CHR DefaultSearchURL: Profile 1 -> hxxp://www.search.ask.com/web?q={searchTerms}
CHR DefaultSearchKeyword: Profile 1 -> search.ask.com
CHR DefaultSuggestURL: Profile 1 -> hxxp://ssmsp.ask.com/query?sstype=prefix&li=ff&q={searchTerms}
CHR Extension: (Google Docs) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-27] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Google Wallet) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-24] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Fast search) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha [2016-11-28]
CHR Extension: (uNiSaleis) - C:\ProgramData\gckimfpkldnpeenhoiknbepenpjlimnk\ []
CHR Extension: (Fast search) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pbdpajcdgknpendpmecafmopknefafha [2016-11-28]
CHR Extension: (Fast search) - C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\pbdpajcdgknpendpmecafmopknefafha [2016-11-28]
CHR HKLM\...\Chrome\Extension: [aaaaapdcjfaomkafnbpoclmfakjianjd] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaapdcjfaomkafnbpoclmfakjianjd.crx [2016-11-09]
CHR HKLM-x32\...\Chrome\Extension: [aaaaapdcjfaomkafnbpoclmfakjianjd] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaapdcjfaomkafnbpoclmfakjianjd.crx [2016-11-09]
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [201800 2016-11-09] (APN LLC.)
S2 UCBrowserSvc; "C:\Program Files (x86)\UCBrowser\Application\UCService.exe" [X]
R1 UCGuard; C:\WINDOWS\System32\DRIVERS\ucguard.sys [81792 2016-08-29] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== ATTENTION
C:\WINDOWS\System32\DRIVERS\ucguard.sys
C:\Program Files (x86)\UCBrowser\Application
2016-11-28 02:29 - 2016-11-28 03:09 - 00000494 _____ C:\WINDOWS\Tasks\UCBrowserUpdater.job
2016-11-28 02:29 - 2016-11-28 03:09 - 00000330 _____ C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job
2016-11-28 02:29 - 2016-11-28 02:30 - 00002684 _____ C:\WINDOWS\System32\Tasks\UCBrowserUpdaterCore
2016-11-28 02:29 - 2016-11-28 02:29 - 00003536 _____ C:\WINDOWS\System32\Tasks\UCBrowserUpdater
2016-11-28 02:29 - 2016-11-28 02:29 - 00001606 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC???.lnk
2016-11-28 02:29 - 2016-11-28 02:29 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\UCBrowser
2016-11-28 02:29 - 2016-11-28 02:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC???
2016-11-28 02:29 - 2016-11-28 02:29 - 00000000 ____D C:\Program Files (x86)\UCBrowser
2016-11-28 02:29 - 2016-08-29 06:56 - 00081792 _____ (Huorong Borui (Beijing) Technology Co., Ltd.) C:\WINDOWS\system32\Drivers\ucguard.sys
2016-11-27 18:24 - 2016-11-27 18:24 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign93e135da6e639f46
2016-11-27 18:24 - 2016-11-27 18:24 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign54b069a5439cde4c
2016-11-27 18:23 - 2016-11-27 18:23 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsignb7ec360f93b79fc1
2016-11-27 18:14 - 2016-11-27 18:14 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign42318f3bd25ae5a2
2016-11-27 18:14 - 2016-11-27 18:14 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign3cc08622ac4657d1
2016-11-27 18:14 - 2016-11-27 18:14 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign3a975dc111481e70
2016-11-27 11:23 - 2016-11-27 11:23 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign2d76c2406b89699a
2016-11-27 11:23 - 2016-11-27 11:23 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign01004fae38126f45
2016-11-27 11:15 - 2016-11-27 11:15 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsigna50ab9696c6d2ccd
2016-11-27 11:15 - 2016-11-27 11:15 - 00000000 ____D C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign69d55d5ee0ae705b
C:\WINDOWS\System32\Tasks\GarminUpdaterTask
2014-03-31 20:17 - 2016-02-10 03:41 - 0000132 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\Adobe PNG Format CS6 Prefs
2015-05-25 18:08 - 2015-05-25 18:08 - 0000046 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\Camdata.ini
2015-05-25 18:08 - 2015-05-25 18:08 - 0000408 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\CamLayout.ini
2015-05-25 18:08 - 2015-05-25 18:08 - 0000408 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\CamShapes.ini
2015-05-25 18:08 - 2015-05-25 18:08 - 0004536 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\CamStudio.cfg
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\Users\Ivan Reyes Ortega\AppData\Roaming\Profiles
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\Users\Ivan Reyes Ortega\AppData\Roaming\Project Templates
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\Users\Ivan Reyes Ortega\AppData\Roaming\Quartz Composer
2015-05-25 18:07 - 2015-05-25 18:07 - 0000096 _____ () C:\Users\Ivan Reyes Ortega\AppData\Roaming\version2.xml
2015-05-25 18:54 - 2015-05-25 23:41 - 0005632 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-08-08 02:44 - 2015-08-08 02:44 - 1930335 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\package.nw.new
2015-05-25 17:47 - 2015-05-25 17:47 - 0000003 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\updater.log
2015-05-25 17:47 - 2016-08-06 21:42 - 0000424 _____ () C:\Users\Ivan Reyes Ortega\AppData\Local\UserProducts.xml
2016-09-13 15:17 - 2016-09-13 15:17 - 0000057 _____ () C:\ProgramData\Ament.ini
2013-04-23 13:47 - 2013-04-23 13:47 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-02-14 00:43 - 2014-02-14 00:48 - 0000818 _____ () C:\ProgramData\hpzinstall.log
2013-04-23 13:57 - 2013-04-23 13:57 - 0000198 ____H () C:\ProgramData\Lenovo-31886.vbs
2013-04-23 13:58 - 2013-04-23 13:58 - 0000198 ____H () C:\ProgramData\Lenovo-31951.vbs
2015-05-05 22:31 - 2015-05-05 22:31 - 0000133 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
2014-02-10 19:38 - 2014-02-10 19:38 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2014-02-10 19:38 - 2016-03-12 20:28 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2014-02-10 19:38 - 2016-03-12 20:28 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\ProgramData\Receipts
2015-08-11 18:09 - 2015-08-11 18:09 - 0010295 _____ () C:\ProgramData\regid.2011-06.com.youtubebyclick_3C521B99-9ACE-47EA-AC9F-26075467D03B.swidtag
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\ProgramData\Repeat Routines
2014-02-10 19:38 - 2014-02-10 19:38 - 0000268 ___RH () C:\ProgramData\Resources
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\7EE1.tmp.exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\Browser_V5.7.15319.5_r_4670_(Build1608291541).exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\DBUpdater.exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\DriverBoosterSetup.exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\setup_1093.exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\ucbrabs.exe
C:\Program Files (x86)\UCBrowser\Application\update_task.exe
C:\Program Files (x86)\UCBrowser
Task: {0A165010-AF54-474C-94ED-9DFF4B9C3AD1} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {12C84F3D-A4F2-4679-AC79-A2BA61579CE8} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-11-09] (Microsoft Corporation)
Task: {15FA8FAB-820A-491D-A857-B058053684D0} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: {26EC85F5-1BDB-49E9-A054-D64C01D6C3EE} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {2796E93F-F927-4E48-ABFA-1DB74CEDBFAA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {28383A68-A4F1-4D4F-9926-20CB3F790EC6} - System32\Tasks\UCBrowserUpdaterCore => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: {49C43CBE-E19B-48D1-860A-A41B7A66DBF7} - System32\Tasks\RegistryDr_Popup => C:\Program Files (x86)\Registry Dr\Splash.exe <==== ATTENTION
C:\Program Files (x86)\Registry Dr
Task: {527E4654-CB89-4667-B8A0-72E3FF062DBC} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {6366D6B0-4AF1-4BE9-8585-560E3CAC504B} - System32\Tasks\MATLAB R2015a Startup Accelerator => C:\Program Files\MATLAB\MATLAB Production Server\R2015a\bin\win64\MATLABStartupAccelerator.exe [2014-12-29] ()
Task: {74E3D63A-49D6-4364-AD93-EC23C1800870} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe <==== ATTENTION
Task: {784859C8-AEE8-46E5-932A-A867C71F9E46} - System32\Tasks\update-S-1-5-21-2198469641-46685643-2895634536-1004 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2014-11-28] ()
Task: {80426A41-260C-404B-9118-7056DAA30411} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {97067761-8A56-422F-9D9F-9DFF349C95A1} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {AB21143A-912A-4C23-B434-36F31AF5F4AD} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {B3E8083E-B3F5-4CC4-9CB3-F1C7247D0C7A} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {B9BAA86C-5FD2-41BF-87A1-EEF21BF9284F} - System32\Tasks\update-sys => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2014-11-28] ()
Task: {D241D09F-6EFA-462C-8E72-95329844212A} - \WPD\SqmUpload_S-1-5-21-2198469641-46685643-2895634536-1001 -> No File <==== ATTENTION
Task: {D852B7A0-A14F-4C30-85F0-8F1A998CD974} - System32\Tasks\RegistryDr_Start => C:\Program Files (x86)\Registry Dr\RegistryDr.exe <==== ATTENTION
Task: {DA251989-C31D-479E-89D6-3B27D73F18E1} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {F5F9C05F-FDF0-451B-8CF6-8D6620812AA3} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {FCE3B066-123B-46A5-A204-0DC1CBA06A57} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: C:\WINDOWS\Tasks\UCBrowserUpdater.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\update-S-1-5-21-2198469641-46685643-2895634536-1004.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\WINDOWS\Tasks\update-sys.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
ShortcutWithArgument: C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69b5b7893971c8e8\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1"
ShortcutWithArgument: C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1"
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
EmptyTemp:





*****************

Restore point was successfully created.
"C:\Program Files (x86)\AskPartnerNetwork" => not found.
"C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" => not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ApnTBMon => value not found.
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => value removed successfully
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\ => value removed successfully
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
HKLM\SOFTWARE\Policies\Google => key not found.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0d7355bc-6532-4c94-b735-8764407bd143}\\DhcpNameServer => value removed successfully
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{525cffb3-8591-47ea-ada6-08e77e367fc4}\\DhcpNameServer => value removed successfully
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\Microsoft\Internet Explorer\Main\\Secondary Start Pages => value removed successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => key removed successfully
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => key removed successfully
HKCR\Wow6432Node\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => key not found.
"HKU\S-1-5-21-2198469641-46685643-2895634536-1004\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => key removed successfully
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => key not found.
"HKU\S-1-5-21-2198469641-46685643-2895634536-1004\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{89905693-D965-4436-8806-234F772945FF}" => key removed successfully
HKCR\CLSID\{89905693-D965-4436-8806-234F772945FF} => key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41545533-2D43-322D-4D47-7A786E7484D7} => key not found.
HKCR\CLSID\{41545533-2D43-322D-4D47-7A786E7484D7} => key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7} => key not found.
HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7} => key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} => key not found.
HKCR\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41545533-2D43-322D-4D47-7A786E7484D7} => key not found.
HKCR\Wow6432Node\CLSID\{41545533-2D43-322D-4D47-7A786E7484D7} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{88803a01-4125-443b-b869-4062a160ceea}" => key removed successfully
"HKCR\Wow6432Node\CLSID\{88803a01-4125-443b-b869-4062a160ceea}" => key removed successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7} => key not found.
HKCR\Wow6432Node\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} => key not found.
HKCR\Wow6432Node\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} => key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} => value not found.
HKCR\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f} => key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{41545533-2D43-322D-4D47-7A786E7484D7} => value not found.
HKCR\CLSID\{41545533-2D43-322D-4D47-7A786E7484D7} => key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} => value not found.
HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} => value not found.
HKCR\Wow6432Node\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{41545533-2D43-322D-4D47-7A786E7484D7} => value not found.
HKCR\Wow6432Node\CLSID\{41545533-2D43-322D-4D47-7A786E7484D7} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} => value not found.
HKCR\Wow6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F} => key not found.
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{41545533-2D43-322D-4D47-7A786E7484D7} => value removed successfully
HKCR\CLSID\{41545533-2D43-322D-4D47-7A786E7484D7} => key not found.
HKLM\Software\Wow6432Node\Mozilla\Thunderbird\Extensions\\msktbird@mcafee.com => value removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3" => key removed successfully
C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll => moved successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9" => key removed successfully
C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll => not found.
CHR dev: Chrome dev build detected! <======= ATTENTION => Error: No automatic fix found for this entry.
Chrome HomePage => removed successfully
Chrome DefaultSearchURL => removed successfully
Chrome DefaultSearchKeyword => removed successfully
Chrome DefaultSuggestURL => removed successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake <==== ATTENTION => not found
C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda <==== ATTENTION => not found

"C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha" folder move:

Could not move "C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha" => Scheduled to move on reboot.

C:\ProgramData\gckimfpkldnpeenhoiknbepenpjlimnk\ => moved successfully

"C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pbdpajcdgknpendpmecafmopknefafha" folder move:

Could not move "C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pbdpajcdgknpendpmecafmopknefafha" => Scheduled to move on reboot.


"C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\pbdpajcdgknpendpmecafmopknefafha" folder move:

Could not move "C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\pbdpajcdgknpendpmecafmopknefafha" => Scheduled to move on reboot.

"HKLM\SOFTWARE\Google\Chrome\Extensions\aaaaapdcjfaomkafnbpoclmfakjianjd" => key removed successfully
"C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaapdcjfaomkafnbpoclmfakjianjd.crx" => not found.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\aaaaapdcjfaomkafnbpoclmfakjianjd" => key removed successfully
"C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaapdcjfaomkafnbpoclmfakjianjd.crx" => not found.
APNMCP => service not found.
UCBrowserSvc => service removed successfully
UCGuard => Unable to stop service.
UCGuard => service removed successfully
C:\WINDOWS\System32\DRIVERS\ucguard.sys => moved successfully
"C:\Program Files (x86)\UCBrowser\Application" => not found.
C:\WINDOWS\Tasks\UCBrowserUpdater.job => moved successfully
C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job => moved successfully
C:\WINDOWS\System32\Tasks\UCBrowserUpdaterCore => moved successfully
C:\WINDOWS\System32\Tasks\UCBrowserUpdater => moved successfully
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC???.lnk" => not found.
C:\Users\Ivan Reyes Ortega\AppData\Local\UCBrowser => moved successfully
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC???" => not found.
C:\Program Files (x86)\UCBrowser => moved successfully
"C:\WINDOWS\system32\Drivers\ucguard.sys" => not found.
C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign93e135da6e639f46 => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign54b069a5439cde4c => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsignb7ec360f93b79fc1 => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign42318f3bd25ae5a2 => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign3cc08622ac4657d1 => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign3a975dc111481e70 => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign2d76c2406b89699a => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign01004fae38126f45 => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsigna50ab9696c6d2ccd => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Tempzxpsign69d55d5ee0ae705b => moved successfully
C:\WINDOWS\System32\Tasks\GarminUpdaterTask => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Roaming\Adobe PNG Format CS6 Prefs => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Roaming\Camdata.ini => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Roaming\CamLayout.ini => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Roaming\CamShapes.ini => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Roaming\CamStudio.cfg => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Roaming\Profiles => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Roaming\Project Templates => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Roaming\Quartz Composer => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Roaming\version2.xml => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\package.nw.new => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\updater.log => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\UserProducts.xml => moved successfully
C:\ProgramData\Ament.ini => moved successfully
C:\ProgramData\DP45977C.lfl => moved successfully
C:\ProgramData\hpzinstall.log => moved successfully
C:\ProgramData\Lenovo-31886.vbs => moved successfully
C:\ProgramData\Lenovo-31951.vbs => moved successfully
C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc => moved successfully
C:\ProgramData\PKP_DLes.DAT => moved successfully
C:\ProgramData\PKP_DLet.DAT => moved successfully
C:\ProgramData\PKP_DLev.DAT => moved successfully
C:\ProgramData\Receipts => moved successfully
"C:\ProgramData\regid.2011-06.com.youtubebyclick_3C521B99-9ACE-47EA-AC9F-26075467D03B.swidtag" => not found.
C:\ProgramData\Repeat Routines => moved successfully
C:\ProgramData\Resources => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\7EE1.tmp.exe => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\Browser_V5.7.15319.5_r_4670_(Build1608291541).exe => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\DBUpdater.exe => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\DriverBoosterSetup.exe => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\setup_1093.exe => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\SkypeSetup.exe => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Temp\ucbrabs.exe => moved successfully
"C:\Program Files (x86)\UCBrowser\Application\update_task.exe" => not found.
"C:\Program Files (x86)\UCBrowser" => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0A165010-AF54-474C-94ED-9DFF4B9C3AD1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0A165010-AF54-474C-94ED-9DFF4B9C3AD1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{12C84F3D-A4F2-4679-AC79-A2BA61579CE8}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{12C84F3D-A4F2-4679-AC79-A2BA61579CE8}" => key removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\RemovalTools\MRT_HB" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{15FA8FAB-820A-491D-A857-B058053684D0}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15FA8FAB-820A-491D-A857-B058053684D0}" => key removed successfully
C:\WINDOWS\System32\Tasks\UCBrowserUpdater => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UCBrowserUpdater" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{26EC85F5-1BDB-49E9-A054-D64C01D6C3EE}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{26EC85F5-1BDB-49E9-A054-D64C01D6C3EE}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2796E93F-F927-4E48-ABFA-1DB74CEDBFAA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2796E93F-F927-4E48-ABFA-1DB74CEDBFAA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{28383A68-A4F1-4D4F-9926-20CB3F790EC6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{28383A68-A4F1-4D4F-9926-20CB3F790EC6}" => key removed successfully
C:\WINDOWS\System32\Tasks\UCBrowserUpdaterCore => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UCBrowserUpdaterCore" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{49C43CBE-E19B-48D1-860A-A41B7A66DBF7}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{49C43CBE-E19B-48D1-860A-A41B7A66DBF7}" => key removed successfully
C:\WINDOWS\System32\Tasks\RegistryDr_Popup => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegistryDr_Popup" => key removed successfully
C:\Program Files (x86)\Registry Dr => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{527E4654-CB89-4667-B8A0-72E3FF062DBC}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{527E4654-CB89-4667-B8A0-72E3FF062DBC}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6366D6B0-4AF1-4BE9-8585-560E3CAC504B}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6366D6B0-4AF1-4BE9-8585-560E3CAC504B}" => key removed successfully
C:\WINDOWS\System32\Tasks\MATLAB R2015a Startup Accelerator => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MATLAB R2015a Startup Accelerator" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{74E3D63A-49D6-4364-AD93-EC23C1800870}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{74E3D63A-49D6-4364-AD93-EC23C1800870}" => key removed successfully
C:\WINDOWS\System32\Tasks\LaunchPreSignup => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LaunchPreSignup" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{784859C8-AEE8-46E5-932A-A867C71F9E46}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{784859C8-AEE8-46E5-932A-A867C71F9E46}" => key removed successfully
C:\WINDOWS\System32\Tasks\update-S-1-5-21-2198469641-46685643-2895634536-1004 => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\update-S-1-5-21-2198469641-46685643-2895634536-1004" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{80426A41-260C-404B-9118-7056DAA30411}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{80426A41-260C-404B-9118-7056DAA30411}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{97067761-8A56-422F-9D9F-9DFF349C95A1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{97067761-8A56-422F-9D9F-9DFF349C95A1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AB21143A-912A-4C23-B434-36F31AF5F4AD}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AB21143A-912A-4C23-B434-36F31AF5F4AD}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B3E8083E-B3F5-4CC4-9CB3-F1C7247D0C7A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B3E8083E-B3F5-4CC4-9CB3-F1C7247D0C7A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B9BAA86C-5FD2-41BF-87A1-EEF21BF9284F}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B9BAA86C-5FD2-41BF-87A1-EEF21BF9284F}" => key removed successfully
C:\WINDOWS\System32\Tasks\update-sys => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\update-sys" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D241D09F-6EFA-462C-8E72-95329844212A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D241D09F-6EFA-462C-8E72-95329844212A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WPD\SqmUpload_S-1-5-21-2198469641-46685643-2895634536-1001" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D852B7A0-A14F-4C30-85F0-8F1A998CD974}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D852B7A0-A14F-4C30-85F0-8F1A998CD974}" => key removed successfully
C:\WINDOWS\System32\Tasks\RegistryDr_Start => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegistryDr_Start" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DA251989-C31D-479E-89D6-3B27D73F18E1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DA251989-C31D-479E-89D6-3B27D73F18E1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F5F9C05F-FDF0-451B-8CF6-8D6620812AA3}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F5F9C05F-FDF0-451B-8CF6-8D6620812AA3}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FCE3B066-123B-46A5-A204-0DC1CBA06A57}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FCE3B066-123B-46A5-A204-0DC1CBA06A57}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => key removed successfully
C:\WINDOWS\Tasks\UCBrowserUpdater.job => not found.
C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job => not found.
C:\WINDOWS\Tasks\update-S-1-5-21-2198469641-46685643-2895634536-1004.job => moved successfully
C:\WINDOWS\Tasks\update-sys.job => moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69b5b7893971c8e8\Google Chrome.lnk => Shortcut argument removed successfully.
C:\Users\Ivan Reyes Ortega\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Google Chrome.lnk => Shortcut argument removed successfully.

========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-2198469641-46685643-2895634536-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully


========= End of RemoveProxy: =========


========= netsh advfirewall reset =========

Ok.


========= End of CMD: =========


========= netsh advfirewall set allprofiles state ON =========

Ok.


========= End of CMD: =========


========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 302165124 B
Java, Flash, Steam htmlcache => 380423354 B
Windows/system/drivers => 116830619 B
Edge => 1430022 B
Chrome => 895275414 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 600968 B
NetworkService => 175694 B
Joanne => 207554563 B
Ivan Reyes Ortega => 1051184114 B
Guest => 23399 B

RecycleBin => 13431809694 B
EmptyTemp: => 15.3 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 28-11-2016 11:06:04)

C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha => Is moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pbdpajcdgknpendpmecafmopknefafha => Is moved successfully
C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\pbdpajcdgknpendpmecafmopknefafha => Is moved successfully

==== End of Fixlog 11:06:04 ====
 
Iaro96 said:
Ran the fix. After boot Windows Firewall gave me an alert of blocking some features of Google Chrome and Akamai NetSession.
Click to expand...


No big deal, I reset your firewall settings with the fix, this should not trouble you any longer.


Iaro96 said:
Also got an error message regarding missing files for Lenovo Assistant (Which I uninstalled with the Geek Uninstaller).
Click to expand...


No big deal there, if this happens again let me know and we will take care of the error with Autoruns.

Now can you tell me what issues remain with the machine?
How is it running now?
 
Malnutrition said:
No big deal, I reset your firewall settings with the fix, this should not trouble you any longer.
Click to expand...
Alright, I granted access to it. I'll run the CCleaner now.
Everything seems fine for now, except that for some reason Google Chrome has Internet Explorer's icon.
 
Iaro96 said:
Google Chrome has Internet Explorer's icon.
Click to expand...
Odd...

Delete that icon from your desktop and then go to the start menu.
Then Computer then Local disk C:
Then program files x86
Locate the Google Chrome Folder.
Right click the chrome.exe create shrotcut.
Drag that to your desktop.

For now lets run a couple more scans to ensure we cleaned up everything, and then we will work from there. :)

Adware Cleaner Scan.

Please download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.


JRT Scan.


Please download Junkware Removal Tool and save it on your desktop.



  • Shut down your anti-virus, anti-spyware, and firewall software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click it and select Run as administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log is saved to your desktop and will automatically open.
  • Please post the JRT log.

Adware Removal Tool Scan.

Download Adware removal tool to your desktop, right click the icon and select Run as Administrator.

LOr0Gd7.png


Hit Ok.

sYFsqHx.png


Hit next make sure to leave all items checked, for removal.

8NcZjGc.png


The Program will close all open programs to complete the removal, so save any work and hit OK. Then hit OK after the removal process is complete, thenOK again to finish up. Post log generated by tool.



ZHP Scan.

Please download Zhp Cleaner to your desktop. Right Click the icon and select run as administrator.

2. Once you have started the program, you will need to click the scanner button.

EgsT69u.png


The program will close all open browsers!
3. Once the scan is completed, the you will want to click the Repair button.



At the end of the process you may be asked to reboot your machine. After you reboot a report will open on your desktop.
Copy and paste the report here in your next reply.

Security Check Scan.


  • Download Security Check to your desktop.
  • Right click it run as administrator.
  • When the program completes, the tool will automatically open a log file.
  • Please post that log here in your next post.
 
Creating the new shortcut didn't fix it. It has the Google Chrome icon in my desktop, but once I open it, the task bar icon is Internet Explorer's.... and an old version of it (Not Edge, which is the one that came with my Windows)
 
Ok, we will take care of that shortly. Go ahead and run the follow up scans to ensure that we have gotten all of the malware on your machine. :)
 
Do I do that before running the CCcleaner? I installed it but I'm not sure what is it that I have to do with it.
 
If you still have issues with CCleaner, then skip and run the adware cleaning tools. I will provide more detailed information on Ccleaner after those other tools have been ran.
 
Ran the AdwClearner. Not really sure what everything is but apparently there were leftovers of the UC thing :cry:


# AdwCleaner v6.030 - Logfile created 28/11/2016 at 12:16:57
# Updated on 19/10/2016 by Malwarebytes
# Database : 2016-11-28.2 [Server]
# Operating System : Windows 10 Home (X64)
# Username : Ivan Reyes Ortega - HOMEPC
# Running from : C:\Users\Ivan Reyes Ortega\Desktop\Defenses\adwcleaner_6.030.exe
# Mode: Clean
# Support : hxxps://www.malwarebytes.com/support



***** [ Services ] *****

[-] Service deleted: Update service


***** [ Folders ] *****

[-] Folder deleted: C:\Program Files (x86)\uNiSaleis
[-] Folder deleted: C:\Users\Joanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoViewer
[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoViewer
[-] Folder deleted: C:\Program Files (x86)\VideoViewer
[-] Folder deleted: C:\Users\Joanne\AppData\Local\temp
[-] Folder deleted: C:\Users\Joanne\AppData\LocalLow\temp
[#] Folder deleted on reboot: C:\Users\Ivan Reyes Ortega\AppData\Local\temp
[-] Folder deleted: C:\Users\Ivan Reyes Ortega\AppData\LocalLow\temp
[-] Folder deleted: C:\Users\Guest\AppData\Local\temp
[-] Folder deleted: C:\ProgramData\temp
[#] Folder deleted on reboot: C:\ProgramData\Application Data\temp
[-] Folder deleted: C:\Program Files (x86)\temp
[-] Folder deleted: C:\WINDOWS\temp
[-] Folder deleted: C:\ProgramData\9409923304362216177
[-] Folder deleted: C:\Users\Joanne\AppData\Local\RegistryDr
[-] Folder deleted: C:\Users\Joanne\Documents\RegistryDr
[-] Folder deleted: C:\Users\Ivan Reyes Ortega\AppData\Local\eSupport.com
[-] Folder deleted: C:\Users\Ivan Reyes Ortega\AppData\Local\VideoConverter
[-] Folder deleted: C:\ProgramData\apn
[#] Folder deleted on reboot: C:\ProgramData\Application Data\apn
[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eSupport.com
[-] Folder deleted: C:\Program Files (x86)\Amazon\ABB
[-] Folder deleted: C:\Program Files (x86)\eSupport.com
[-] Folder deleted: C:\Program Files (x86)\SecretSauce
[-] Folder deleted: C:\Program Files (x86)\TornTV.com
[-] Folder deleted: C:\Users\Ivan Reyes Ortega\AppData\Roaming\browsers
[-] Folder deleted: C:\Users\Joanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaapdcjfaomkafnbpoclmfakjianjd


***** [ Files ] *****

[-] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_pstatic.eshopcomp.com_0.localstorage
[-] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_pstatic.eshopcomp.com_0.localstorage-journal
[-] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.eshopcomp.com_0.localstorage
[-] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.eshopcomp.com_0.localstorage-journal
[#] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_pstatic.eshopcomp.com_0.localstorage
[#] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_pstatic.eshopcomp.com_0.localstorage-journal
[-] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_iris.cnice.mec.es_0.localstorage
[-] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_iris.cnice.mec.es_0.localstorage-journal
[#] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.eshopcomp.com_0.localstorage
[#] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.eshopcomp.com_0.localstorage-journal
[-] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.onclickads.net_0.localstorage
[-] File deleted: C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.onclickads.net_0.localstorage-journal


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Shortcuts ] *****



***** [ Scheduled Tasks ] *****



***** [ Registry ] *****

[-] Key deleted: HKLM\SOFTWARE\Classes\UCHTML
[-] Key deleted: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.CRX
[-] Key deleted: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.HTM
[-] Key deleted: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.HTML
[-] Key deleted: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.MHT
[-] Key deleted: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.SHTM
[-] Key deleted: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.SHTML
[-] Key deleted: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.WEBP
[-] Key deleted: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.XHT
[-] Key deleted: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.XHTML
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{0BF85F37-ECD3-462C-8F41-902FD170F42E}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{0BF85F37-ECD3-462C-8F41-902FD170F42E}
[#] Key deleted on reboot: HKLM\SOFTWARE\Classes\WebCommObj.ExtCommObj.WebCommObj.ExtCommObj
[#] Key deleted on reboot: HKLM\SOFTWARE\Classes\WebCommObj.ExtCommObj.WebCommObj.ExtCommObj.1
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{0ED2BF70-D5F2-4C89-BC03-DD3E771D5388}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{0ED2BF70-D5F2-4C89-BC03-DD3E771D5388}
[#] Key deleted on reboot: HKLM\SOFTWARE\Classes\WebCommunication.WebComObject.WebCommunication.WebComObject
[#] Key deleted on reboot: HKLM\SOFTWARE\Classes\WebCommunication.WebComObject.WebCommunication.WebComObject.1
[-] Key deleted: HKLM\SOFTWARE\Classes\OCComSDK.ComSDK
[-] Key deleted: HKLM\SOFTWARE\Classes\OCComSDK.ComSDK.1
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\OCComSDK.ComSDK
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\OCComSDK.ComSDK.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{1112F282-7099-4624-A439-DB29D6551552}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{88803A01-4125-443B-B869-4062A160CEEA}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{88803A01-4125-443B-B869-4062A160CEEA}
[-] Key deleted: HKU\.DEFAULT\Software\AskPartnerNetwork
[-] Key deleted: HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\1ClickDownload
[-] Key deleted: HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\eSupport.com
[-] Key deleted: HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\PRODUCTSETUP
[-] Key deleted: HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\Softonic
[-] Key deleted: HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\WEBAPP
[-] Key deleted: HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\UCBrowserPID
[-] Key deleted: HKU\S-1-5-21-2198469641-46685643-2895634536-1004\Software\AppDataLow\Software\Crossrider
[#] Key deleted on reboot: HKU\S-1-5-18\Software\AskPartnerNetwork
[#] Key deleted on reboot: HKCU\Software\1ClickDownload
[#] Key deleted on reboot: HKCU\Software\eSupport.com
[#] Key deleted on reboot: HKCU\Software\PRODUCTSETUP
[#] Key deleted on reboot: HKCU\Software\Softonic
[#] Key deleted on reboot: HKCU\Software\WEBAPP
[#] Key deleted on reboot: HKCU\Software\UCBrowserPID
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Crossrider
[-] Key deleted: HKLM\SOFTWARE\UCBrowserPID
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverAgent_is1
[#] Key deleted on reboot: [x64] HKCU\Software\1ClickDownload
[#] Key deleted on reboot: [x64] HKCU\Software\eSupport.com
[#] Key deleted on reboot: [x64] HKCU\Software\PRODUCTSETUP
[#] Key deleted on reboot: [x64] HKCU\Software\Softonic
[#] Key deleted on reboot: [x64] HKCU\Software\WEBAPP
[#] Key deleted on reboot: [x64] HKCU\Software\UCBrowserPID
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\Crossrider
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\cdn.castplatform.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\azlyrics.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\claro.com.do
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\eshopcomp.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\metrolyrics.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\pstatic.eshopcomp.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\cdn.castplatform.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\azlyrics.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\claro.com.do
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\eshopcomp.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\metrolyrics.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\pstatic.eshopcomp.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
[-] Value deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 [ApnTBMon]
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\UCBrowser.exe
[-] Value deleted: HKLM\SOFTWARE\RegisteredApplications [UCBrowser]
[-] Key deleted: HKLM\SOFTWARE\Microsoft\MediaPlayer\ShimInclusionList\UCBrowser.exe


***** [ Web browsers ] *****

[-] [C:\Users\Joanne\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\Joanne\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\Joanne\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: zapmeta.do
[-] [C:\Users\Joanne\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: aaaaapdcjfaomkafnbpoclmfakjianjd
[-] [C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: aaaaapdcjfaomkafnbpoclmfakjianjd
[-] [C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\Ivan Reyes Ortega\AppData\Local\Google\Chrome\User Data\Profile 1] [extension] Deleted: aaaaapdcjfaomkafnbpoclmfakjianjd
[-] [C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\Joanne\AppData\Local\Google\Chrome SxS\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\Joanne\AppData\Local\Google\Chrome SxS\User Data\Default\Web data] [Search Provider] Deleted: ask.com


*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [12945 Bytes] - [28/11/2016 12:16:57]
C:\AdwCleaner\AdwCleaner[S0].txt - [12200 Bytes] - [28/11/2016 12:10:21]
C:\AdwCleaner\AdwCleaner[S1].txt - [12274 Bytes] - [28/11/2016 12:12:41]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [13167 Bytes] ##########
 
Status
Not open for further replies.
Top Bottom