Jump to content

IE Explorer running in background, log on and connectivity issues

5potatoes
 Share

Recommended Posts

5potatoes

5potatoes

Posted
Posted

Hello,

 For the last few weeks I have noticed that there is a great deal of activity going on through Internet Explorer even though I have it turned off. I have also had a few other issues and wanted to make sure that my computer was safe.

Issues:

(1) When I run CClearner, 10s to 100s of MB of data is cleaned from Internet Explorer 11; cookies, download history, sites visited, etc.

 

 (2) I tried, also, to delete and re-install my Mozilla- when I use that browser, the pages that load look 'fake', and often the copyright dates at the bottom are from 2012/13- several pops-ups also happen to casino sites, insurance sites, etc. When I delete Mozilla from my computer, it also wipes my ethernet drivers, disallowing me access to the internet. I did a system restore and am now able to access the internet. But, even though Mozilla is still listed in my Windows programs, the browser will not launch.

 

(3) Over the last week, whenever I log on to my computer, (start-up, restart, or wake-up from sleeping), several times I have had to enter my password three times.

 

 (4) When I do put my computer to sleep, it wakes up by itself usually after 2-3 hours.

 

 I ran MBAM and nothing came up. Attached are my Farbar reports.

 

 Thank you in advance for any help.

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Hello and welome,

 

P2P/Piracy Warning:

 

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

 

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.


The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

  • Please download Malwarebytes Anti-Malware FREE Version from here: http://downloads.malwarebytes.org/file/mbam
  • Save it to your Desktop.
    MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click to execute the installation. Accept the terms, and allow MBAM to install to the default location in your Program Files.
  • Please update the database by clicking on the Update Now button as shown below.
    MBAM1_zpsh9vpxuel.png
  • Following the update, click on the large blue Scan Now button to begin the Threat Scan.
    If Malware or Potentially Unwanted Programs are found you will receive a Prompt so that you can decide what you want to do. I suggest "Quarantine". Click the button: Apply All Actions.
  • After scanning, click on Save Results to copy the report to your clipboard.
    MBAM2_zpsod0ofhow.png
  • Return to our forum. Paste your log into your next reply.
  • Click Finish to close the scan.
  • Note: If you lose the Clipboard copy and need to retrieve the log again it can be found by opening Malwarebytes and clicking on History> Application Logs with the date of the scan. Simply double-click on that in order to see the options for Copying to Clipboard or to Export to a .txt file (Notepad). etc.. The .txt file can be saved and posted when you are ready.

 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.


Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button. <<<--- Ensure this option is completed
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

 

Next,

 

thisisujrt.gif Please download Junkware Removal Tool to your desktop.


Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Next,

 

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

 

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

 

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

 

notepad c:\windows\debug\mrt.log

 

Let me see those logs in your reply, also give an update on any remaining issues or concerns...

 

Thanks,

 

Kevin...

 

 

 

 

Fixlist.txt

Link to post
Share on other sites
5potatoes

5potatoes

Posted
  • Author
Posted

Hello and Thank You for the reply and instructions. Pasted below are the results from the MBAM scan. 

I have downloaded the other programs and will run them now.

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 4/1/2015
Scan Time: 4:24:27 PM
Logfile: MBAM Results.txt
Administrator: Yes
 
Version: 2.01.4.1018
Malware Database: v2015.04.01.11
Rootkit Database: v2015.03.31.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
 
OS: Windows 8.1
CPU: x64
File System: NTFS
User: io8
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 361207
Time Elapsed: 8 min, 58 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
Link to post
Share on other sites
5potatoes

5potatoes

Posted
  • Author
Posted

result for the AdwCleaner:

 

# AdwCleaner v4.200 - Logfile created 01/04/2015 at 16:37:49
# Updated 29/03/2015 by Xplode
# Database : 2015-03-29.1 [server]
# Operating system : Windows 8.1 Pro  (x64)
# Username : io8 - IO8D
# Running from : C:\Users\io8\Desktop\adwcleaner_4.200.exe
# Option : Cleaning
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
File Deleted : C:\Users\io8\AppData\Roaming\Mozilla\Firefox\Profiles\taz926wq.default\user.js
 
***** [ Scheduled tasks ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
 
***** [ Web browsers ] *****
 
-\\ Internet Explorer v0.0.0.0
 
 
-\\ Mozilla Firefox v36.0 (x86 en-US)
 
 
*************************
 
AdwCleaner[R6].txt - [813 bytes] - [01/04/2015 16:36:58]
AdwCleaner[s5].txt - [741 bytes] - [01/04/2015 16:37:49]
 
########## EOF - C:\AdwCleaner\AdwCleaner[s5].txt - [799  bytes] ##########
Link to post
Share on other sites
5potatoes

5potatoes

Posted
  • Author
Posted

Well, it seems I forgot to perform the first step, so I will redo everything from the top.

Below is the Fixlog(text):

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by io8 at 2015-04-01 17:07:07 Run:1
Running from C:\Users\io8\Desktop
Loaded Profiles: io8 (Available profiles: io8)
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
start
HKLM\...\Run: [CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}] => C:\ProgramData\cis56EC.exe [5404888 2015-01-30] (COMODO)
HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] => C:\ProgramData\cisADC3.exe [5404888 2015-01-30] (COMODO)
FF user.js: detected! => C:\Users\io8\AppData\Roaming\Mozilla\Firefox\Profiles\taz926wq.default\user.js [2015-04-01]
FF Extension: No Name - C:\Users\io8\AppData\Roaming\Mozilla\Firefox\Profiles\taz926wq.default\extensions\YoutubeDownloader@PeterOlayev.com.xpi [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
S0 qhpbzs; No ImagePath
S3 utm3otq0; C:\Windows\SysWOW64\Drivers\utm3otq0.sys [7168 2015-03-31] () [File not signed]
U4 CmdAgent; No ImagePath
2015-04-01 06:38 - 2015-01-30 12:27 - 05404888 _____ (COMODO) C:\ProgramData\cisADC3.exe
2015-04-01 06:37 - 2015-01-30 12:27 - 05404888 _____ (COMODO) C:\ProgramData\cis56EC.exe
C:\Program Files\COMODO
C:\Windows\%LOCALAPPDATA%
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
C:\Program Files (x86)\Comodo
C:\Users\io8\AppData\Local\Comodo
C:\ProgramData\cis45DA.exe
C:\ProgramData\cis56EC.exe
C:\ProgramData\cisADC3.exe
AlternateDataStreams: C:\Windows\explorer.exe:$CmdTcID
AlternateDataStreams: C:\Windows\HelpPane.exe:$CmdTcID
AlternateDataStreams: C:\Windows\hh.exe:$CmdTcID
AlternateDataStreams: C:\Windows\notepad.exe:$CmdTcID
AlternateDataStreams: C:\Windows\regedit.exe:$CmdTcID
AlternateDataStreams: C:\Windows\splwow64.exe:$CmdTcID
AlternateDataStreams: C:\Windows\twain_32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\winhlp32.exe:$CmdTcID
AlternateDataStreams: C:\Windows\write.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\accessibilitycpl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\acledit.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aclui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\acmigration.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\acppage.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\acproxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ActionCenter.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ActionCenterCPL.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ActionQueue.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\activeds.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\actxprxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adhapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adhsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AdmTmpl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AdobePDF.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AdobePDFUI.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adrclient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adsldp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adsldpc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adsmsext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adsnt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adtschema.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\advapi32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\advpack.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aecache.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aeinv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aelupsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aepdu.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aepic.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AepRoam.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aitagent.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aitstatic.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\alg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AltTab.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\amstream.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\apds.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\apphelp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Apphlpdm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appidapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appidcertstorecheck.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appidpolicyconverter.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppIdPolicyEngineApi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appidsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appinfo.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appmgmts.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appmgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appraiser.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppReadiness.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\apprepapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\apprepsync.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appsruprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appwiz.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxAllUserStore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxApplicabilityEngine.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppXDeploymentClient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppXDeploymentExtensions.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppXDeploymentServer.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxPackaging.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxSip.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxStreamingDataSourcePS.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxSysprep.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ARP.EXE:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aspnet_counters.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\asycfilt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\at.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AtBroker.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\atl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\atlthunk.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\atmfd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\atmlib.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\attrib.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\audiodg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AudioEndpointBuilder.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AudioEng.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AUDIOKSE.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AudioSes.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\audiosrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\auditcse.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuditNativeSnapIn.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\auditpol.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuditPolicyGPInterop.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthBroker.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthExt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\authfwcfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthFWGP.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthFWSnapin.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthFWWizFwk.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthHostProxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\authui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\authz.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\autochk.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\autoconv.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\autofmt.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\autoplay.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AutoWorkplaceN.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\avicap32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\avifil32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\avrt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AxInstSv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AxInstUI.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\azroles.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\azroleui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AzSqlExt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\baaupdate.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\backgroundTaskHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BackgroundTransferHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\basecsp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\basesrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\batmeter.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcdboot.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcdedit.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcdprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcdsrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BCP47Langs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcrypt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcryptprimitives.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bdaplgin.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bdechangepin.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BdeHdCfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BdeHdCfgLib.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bderepair.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bdesvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BdeSysprep.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bdeui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BdeUISrv.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bdeunlock.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BFE.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bidispl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BioCredProv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bisrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BitLockerDeviceEncryption.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BitLockerWizard.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BitLockerWizardElev.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsadmin.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsigd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsperf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx3.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx4.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx5.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx7.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\biwinrt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\blackbox.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\blb_ps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BluetoothApis.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bootcfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bootim.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BootMenuUX.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bootsect.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bootux.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\brdgcfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bridgeunattend.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BrokerLib.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\browcli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\browser.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\browseui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bthci.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BthHFSrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BthMtpContextHandler.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bthpanapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BthpanContextHandler.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bthprops.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BthRadioMedia.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bthserv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BthSQM.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bthudtask.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\btpanui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Bubbles.scr:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BulkOperationHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BWContextHandler.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ByteCodeGenerator.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cabinet.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cabview.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cacls.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\calc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CallButtons.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CallButtons.ProxyStub.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CameraSettingsUIHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\capiprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\capisp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\catsrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\catsrvps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\catsrvut.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cca.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cdd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cdosys.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certca.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certcli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certCredProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certenc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CertEnroll.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CertEnrollCtrl.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CertEnrollUI.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certmgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CertPolEng.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certprop.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certreq.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certutil.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cewmdm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cfgbkend.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cfgmgr32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cfmifs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cfmifsproxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\change.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\charmap.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chartv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chcp.com:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CheckNetIsolation.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chglogon.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chgport.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chgusr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chkdsk.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chkntfs.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chkwudrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\choice.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CHxReadingStringIME.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ci.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cic.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cipher.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CIRCoInst.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clb.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clbcatq.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cleanmgr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clfsw32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cliconfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cliconfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clip.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CloudNotifications.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CloudStorageWizard.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clrhost.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clusapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmcfg32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmd.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmdext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmdial32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmdkey.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmdl32.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmifw.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmlua.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmmon32.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmpbk32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmstp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmstplua.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmutil.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cngcredui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cngprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cnvfat.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cofire.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cofiredm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\coin95ip.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\colbact.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\COLORCNV.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\colorcpl.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\colorui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\combase.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comcat.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comctl32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comdlg32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\compact.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CompMgmtLauncher.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CompPkgSup.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\compstui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ComputerDefaults.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comrepl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comsnap.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comsvcs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comuid.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ConfigureExpandedStorage.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\conhost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\connect.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ConnectedAccountState.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\consent.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ConsentUX.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\console.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\control.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\convert.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\correngine.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CPFilters.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CredentialMigrationHandler.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CredentialUIBroker.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\credssp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\credui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\credwiz.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\crypt32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptbase.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptcatsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptdlg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptdll.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptnet.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CryptoWinRT.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptsp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\crypttpmeksvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptuiwizard.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptxml.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscdll.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CscMig.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscobj.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscript.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CSystemEventsBrokerClient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ctfmon.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cttune.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cttunesvr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\C_G18030.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\C_IS2022.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\C_ISCII.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d2d1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10core.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10level9.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10warp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10_1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10_1core.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d11.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d8thk.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d9.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_33.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_34.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_35.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_36.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_37.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_38.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_39.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_40.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_41.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_43.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_47.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dcsx_42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dcsx_43.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_33.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_34.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_35.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_36.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_37.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_38.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_39.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_40.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_41.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_43.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx11_42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx11_43.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_24.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_25.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_26.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_27.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_28.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_29.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_30.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_31.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_33.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_34.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_35.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_36.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_37.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_38.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_39.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_40.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_41.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_43.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dab.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dabapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DAConn.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dafBth.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DafPrintProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dafupnp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dafWCN.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dafWfdProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DAFWSD.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DAMM.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DaOtpCredentialProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\das.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dasHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dataclen.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\datusage.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\davclnt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\davhlpr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dbgeng.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dbghelp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dbnetlib.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dbnmpntw.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dccw.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dciman32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dcomcnfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dcomp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DDACLSys.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddodiag.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DDOIProxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DDORes.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddpchunk.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddptrace.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddputils.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddp_ps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddraw.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddrawex.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DefaultDeviceManager.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DefaultPrinterProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Defrag.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\defragproxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\defragsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\delegatorprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\desk.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\deskadp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\deskmon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevDispItemProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devenum.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\deviceaccess.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\deviceassociation.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceCenter.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceDisplayStatusManager.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceDriverRetrievalClient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceEject.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceElementSource.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceMetadataRetrievalClient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevicePairing.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevicePairingFolder.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevicePairingProxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevicePairingWizard.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceProperties.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\deviceregistration.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceSetupManager.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceSetupManagerAPI.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceSetupStatusProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceUxRes.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devinv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devmgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devobj.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevPropMgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devrtl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dfdts.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DFDWiz.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dfp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DfpCommon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dfrgui.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dfscli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DfsShlEx.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpcmonitor.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpcore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpcore6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpcsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpcsvc6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DHCPQEC.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpsapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DiagCpl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diagperf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dialer.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\difxapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dimsjob.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dimsroam.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dinput.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dinput8.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\discan.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskcomp.com:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskcopy.com:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskcopy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskpart.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskperf.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskraid.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Dism.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DismApi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dispci.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dispdiag.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dispex.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Display.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DisplaySwitch.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\djoin.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dllhost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dllhst3g.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dlnashext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmdlgs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmdskmgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmintf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmloader.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmocx.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DMRServer.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmsynth.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmusic.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmutil.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmvdsitf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmview.ocx:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dns-sd.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dnsapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dnscacheugc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dnsext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dnshc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dnsrslvr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\docprop.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\doskey.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3api.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3cfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Dot3Conn.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3dlg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3gpclnt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3gpui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3hc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3mm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3msm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3svc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3ui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dpapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dpapimig.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dpapiprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dpapisrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DpiScaling.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\driverquery.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drmmgrtn.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drmv2clt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drtprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drttransport.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drvcfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drvinst.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drvstore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsauth.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DscCore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DscCoreConfProv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsdmo.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dskquota.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dskquoui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DsmUserTask.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsound.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsparse.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsprop.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsquery.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsrole.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dssec.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dssenh.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Dsui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsuiext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dswave.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dtsh.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dui70.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\duser.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dvdplay.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dvdupgrd.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dwm.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dwmapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dwmcore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dwmredir.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DWrite.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DWWIN.EXE:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxdiag.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxdiagn.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxgi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxgwdi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DXP.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxpps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Dxpserver.exe:$CmdTcID
EmptyTemp:
end
 
 
 
*****************
 
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805} => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82} => value deleted successfully.
C:\Users\io8\AppData\Roaming\Mozilla\Firefox\Profiles\taz926wq.default\user.js not found.
C:\Users\io8\AppData\Roaming\Mozilla\Firefox\Profiles\taz926wq.default\extensions\YoutubeDownloader@PeterOlayev.com.xpi not found.
C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} not found.
qhpbzs => Service deleted successfully.
utm3otq0 => Service deleted successfully.
CmdAgent => Service deleted successfully.
C:\ProgramData\cisADC3.exe => Moved successfully.
C:\ProgramData\cis56EC.exe => Moved successfully.
C:\Program Files\COMODO => Moved successfully.
C:\Windows\%LOCALAPPDATA% => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo => Moved successfully.
 
"C:\Program Files (x86)\Comodo" directory move:
 
Could not move "C:\Program Files (x86)\Comodo" directory. => Scheduled to move on reboot.
 
 
"C:\Users\io8\AppData\Local\Comodo" directory move:
 
Could not move "C:\Users\io8\AppData\Local\Comodo" directory. => Scheduled to move on reboot.
 
C:\ProgramData\cis45DA.exe => Moved successfully.
"C:\ProgramData\cis56EC.exe" => File/Directory not found.
"C:\ProgramData\cisADC3.exe" => File/Directory not found.
C:\Windows\explorer.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\HelpPane.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\hh.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\notepad.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\regedit.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\splwow64.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\twain_32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\winhlp32.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\write.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\accessibilitycpl.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\acledit.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\aclui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\acmigration.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\acppage.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\acproxy.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ActionCenter.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ActionCenterCPL.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ActionQueue.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\activeds.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\actxprxy.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\adhapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\adhsvc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AdmTmpl.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AdobePDF.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AdobePDFUI.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\adprovider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\adrclient.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\adsldp.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\adsldpc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\adsmsext.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\adsnt.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\adtschema.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\advapi32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\advpack.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\aecache.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\aeinv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\aelupsvc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\aepdu.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\aepic.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AepRoam.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\aitagent.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\aitstatic.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\alg.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AltTab.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\amstream.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\apds.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\apphelp.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\Apphlpdm.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\appidapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\appidcertstorecheck.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\appidpolicyconverter.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AppIdPolicyEngineApi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\appidsvc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\appinfo.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\appmgmts.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\appmgr.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\appraiser.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AppReadiness.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\apprepapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\apprepsync.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\appsruprov.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\appwiz.cpl => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AppxAllUserStore.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AppxApplicabilityEngine.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AppXDeploymentClient.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AppXDeploymentExtensions.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AppXDeploymentServer.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AppxPackaging.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AppxSip.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AppxStreamingDataSourcePS.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AppxSysprep.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ARP.EXE => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\aspnet_counters.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\asycfilt.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\at.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AtBroker.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\atl.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\atlthunk.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\atmfd.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\atmlib.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\attrib.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\audiodg.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AudioEndpointBuilder.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AudioEng.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AUDIOKSE.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AudioSes.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\audiosrv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\auditcse.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AuditNativeSnapIn.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\auditpol.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AuditPolicyGPInterop.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AuthBroker.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AuthExt.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\authfwcfg.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AuthFWGP.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AuthFWSnapin.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AuthFWWizFwk.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AuthHost.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AuthHostProxy.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\authui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\authz.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\autochk.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\autoconv.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\autofmt.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\autoplay.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AutoWorkplaceN.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\avicap32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\avifil32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\avrt.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AxInstSv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AxInstUI.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\azroles.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\azroleui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\AzSqlExt.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\baaupdate.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\backgroundTaskHost.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BackgroundTransferHost.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\basecsp.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\basesrv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\batmeter.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bcd.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bcdboot.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bcdedit.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bcdprov.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bcdsrv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BCP47Langs.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bcrypt.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bcryptprimitives.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bdaplgin.ax => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bdechangepin.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BdeHdCfg.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BdeHdCfgLib.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bderepair.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bdesvc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BdeSysprep.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bdeui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BdeUISrv.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bdeunlock.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BFE.DLL => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bidispl.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BioCredProv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bisrv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BitLockerDeviceEncryption.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BitLockerWizard.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BitLockerWizardElev.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bitsadmin.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bitsigd.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bitsperf.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bitsprx2.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bitsprx3.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bitsprx4.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bitsprx5.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bitsprx6.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bitsprx7.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\biwinrt.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\blackbox.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\blb_ps.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BluetoothApis.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bootcfg.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bootim.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BootMenuUX.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bootsect.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bootux.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\brdgcfg.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bridgeunattend.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BrokerLib.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\browcli.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\browser.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\browseui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bthci.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BthHFSrv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BthMtpContextHandler.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bthpanapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BthpanContextHandler.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bthprops.cpl => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BthRadioMedia.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bthserv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BthSQM.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\bthudtask.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\btpanui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\Bubbles.scr => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BulkOperationHost.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\BWContextHandler.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ByteCodeGenerator.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cabinet.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cabview.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cacls.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\calc.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CallButtons.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CallButtons.ProxyStub.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CameraSettingsUIHost.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\capiprovider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\capisp.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\catsrv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\catsrvps.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\catsrvut.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cca.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cdd.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cdosys.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\certca.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\certcli.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\certCredProvider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\certenc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CertEnroll.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CertEnrollCtrl.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CertEnrollUI.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\certmgr.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CertPolEng.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\certprop.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\certreq.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\certutil.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cewmdm.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cfgbkend.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cfgmgr32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cfmifs.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cfmifsproxy.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\change.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\charmap.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\chartv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\chcp.com => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CheckNetIsolation.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\chglogon.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\chgport.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\chgusr.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\chkdsk.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\chkntfs.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\chkwudrv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\choice.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CHxReadingStringIME.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ci.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cic.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cipher.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CIRCoInst.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\clb.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\clbcatq.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cleanmgr.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\clfsw32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cliconfg.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cliconfg.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\clip.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CloudNotifications.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CloudStorageWizard.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\clrhost.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\clusapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmcfg32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmd.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmdext.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmdial32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmdkey.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmdl32.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmifw.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmlua.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmmon32.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmpbk32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmstp.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmstplua.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cmutil.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cngcredui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cngprovider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cnvfat.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cofire.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cofiredm.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\coin95ip.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\colbact.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\COLORCNV.DLL => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\colorcpl.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\colorui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\combase.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\comcat.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\comctl32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\comdlg32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\comp.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\compact.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CompMgmtLauncher.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CompPkgSup.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\compstui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ComputerDefaults.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\comrepl.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\comsnap.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\comsvcs.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\comuid.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ConfigureExpandedStorage.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\conhost.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\connect.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ConnectedAccountState.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\consent.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ConsentUX.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\console.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\control.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\convert.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\correngine.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CPFilters.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CredentialMigrationHandler.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CredentialUIBroker.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\credssp.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\credui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\credwiz.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\crypt32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cryptbase.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cryptcatsvc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cryptdlg.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cryptdll.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cryptext.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cryptnet.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CryptoWinRT.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cryptsp.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cryptsvc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\crypttpmeksvc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cryptui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cryptuiwizard.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cryptxml.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cscapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cscdll.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CscMig.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cscobj.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cscript.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cscsvc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cscui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\CSystemEventsBrokerClient.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ctfmon.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cttune.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\cttunesvr.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\C_G18030.DLL => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\C_IS2022.DLL => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\C_ISCII.DLL => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d2d1.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3d10.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3d10core.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3d10level9.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3d10warp.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3d10_1.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3d10_1core.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3d11.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3d8thk.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3d9.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_33.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_34.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_35.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_36.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_37.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_38.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_39.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_40.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_41.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_42.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_43.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DCompiler_47.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dcsx_42.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dcsx_43.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10_33.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10_34.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10_35.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10_36.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10_37.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10_38.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10_39.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10_40.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10_41.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10_42.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx10_43.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx11_42.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx11_43.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_24.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_25.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_26.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_27.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_28.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_29.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_30.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_31.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_33.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_34.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_35.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\d3dx9_36.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DX9_37.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DX9_38.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DX9_39.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DX9_40.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DX9_41.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DX9_42.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\D3DX9_43.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dab.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dabapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DAConn.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dafBth.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DafPrintProvider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dafupnp.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dafWCN.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dafWfdProvider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DAFWSD.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DAMM.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DaOtpCredentialProvider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\das.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dasHost.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dataclen.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\datusage.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\davclnt.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\davhlpr.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dbgeng.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dbghelp.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dbnetlib.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dbnmpntw.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dccw.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dciman32.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dcomcnfg.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dcomp.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DDACLSys.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ddodiag.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DDOIProxy.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DDORes.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ddpchunk.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ddptrace.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ddputils.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ddp_ps.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ddraw.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\ddrawex.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DefaultDeviceManager.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DefaultPrinterProvider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\Defrag.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\defragproxy.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\defragsvc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\delegatorprovider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\desk.cpl => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\deskadp.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\deskmon.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DevDispItemProvider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\devenum.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\deviceaccess.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\deviceassociation.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DeviceCenter.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DeviceDisplayStatusManager.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DeviceDriverRetrievalClient.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DeviceEject.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DeviceElementSource.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DeviceMetadataRetrievalClient.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DevicePairing.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DevicePairingFolder.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DevicePairingProxy.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DevicePairingWizard.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DeviceProperties.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\deviceregistration.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DeviceSetupManager.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DeviceSetupManagerAPI.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DeviceSetupStatusProvider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DeviceUxRes.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\devinv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\devmgr.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\devobj.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DevPropMgr.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\devrtl.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dfdts.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DFDWiz.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dfp.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DfpCommon.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dfrgui.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dfscli.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DfsShlEx.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dhcpcmonitor.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dhcpcore.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dhcpcore6.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dhcpcsvc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dhcpcsvc6.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DHCPQEC.DLL => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dhcpsapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DiagCpl.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\diagperf.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dialer.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\difxapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dimsjob.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dimsroam.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dinput.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dinput8.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\discan.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\diskcomp.com => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\diskcopy.com => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\diskcopy.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\diskpart.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\diskperf.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\diskraid.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\Dism.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DismApi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dispci.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dispdiag.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dispex.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\Display.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DisplaySwitch.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\djoin.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dllhost.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dllhst3g.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dlnashext.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dmdlgs.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dmdskmgr.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dmintf.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dmloader.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dmocx.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DMRServer.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dmsynth.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dmusic.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dmutil.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dmvdsitf.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dmview.ocx => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dns-sd.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dnsapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dnscacheugc.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dnsext.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dnshc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dnsrslvr.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\docprop.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\doskey.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dot3api.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dot3cfg.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\Dot3Conn.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dot3dlg.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dot3gpclnt.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dot3gpui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dot3hc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dot3mm.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dot3msm.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dot3svc.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dot3ui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dpapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dpapimig.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dpapiprovider.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dpapisrv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DpiScaling.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dps.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\driverquery.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\drmmgrtn.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\drmv2clt.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\drprov.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\drt.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\drtprov.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\drttransport.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\drvcfg.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\drvinst.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\drvstore.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dsauth.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DscCore.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DscCoreConfProv.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dsdmo.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dskquota.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dskquoui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DsmUserTask.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dsound.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dsparse.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dsprop.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dsquery.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dsrole.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dssec.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dssenh.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\Dsui.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dsuiext.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dswave.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dtsh.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dui70.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\duser.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dvdplay.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dvdupgrd.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dwm.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dwmapi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dwmcore.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dwmredir.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DWrite.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DWWIN.EXE => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dxdiag.exe => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dxdiagn.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dxgi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dxgwdi.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\DXP.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\dxpps.dll => ":$CmdTcID" ADS removed successfully.
C:\Windows\system32\Dxpserver.exe => ":$CmdTcID" ADS removed successfully.
EmptyTemp: => Removed 14.7 MB temporary data.
 
=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-04-01 17:13:10)<=
 
C:\Program Files (x86)\Comodo => Is moved successfully.
C:\Users\io8\AppData\Local\Comodo => Is moved successfully.
 
==== End of Fixlog 17:13:10 ====
Link to post
Share on other sites
5potatoes

5potatoes

Posted
  • Author
Posted

MBAM reRun results:

 

Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 4/1/2015
Scan Time: 5:19:00 PM
Logfile: MBAM 2nd Results.txt
Administrator: Yes
 
Version: 2.01.4.1018
Malware Database: v2015.04.01.11
Rootkit Database: v2015.03.31.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
 
OS: Windows 8.1
CPU: x64
File System: NTFS
User: io8
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 361300
Time Elapsed: 5 min, 19 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
Link to post
Share on other sites
5potatoes

5potatoes

Posted
  • Author
Posted

reRun for Adwcleaner:

 

 

# AdwCleaner v4.200 - Logfile created 01/04/2015 at 17:27:48
# Updated 29/03/2015 by Xplode
# Database : 2015-03-29.1 [server]
# Operating system : Windows 8.1 Pro  (x64)
# Username : io8 - IO8D
# Running from : C:\Users\io8\Desktop\adwcleaner_4.200.exe
# Option : Cleaning
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
 
***** [ Web browsers ] *****
 
-\\ Internet Explorer v0.0.0.0
 
 
-\\ Mozilla Firefox v36.0 (x86 en-US)
 
 
*************************
 
AdwCleaner[R6].txt - [813 bytes] - [01/04/2015 16:36:58]
AdwCleaner[R7].txt - [836 bytes] - [01/04/2015 17:26:28]
AdwCleaner[R8].txt - [952 bytes] - [01/04/2015 17:27:28]
AdwCleaner[s5].txt - [878 bytes] - [01/04/2015 16:37:49]
AdwCleaner[s6].txt - [557 bytes] - [01/04/2015 17:26:48]
AdwCleaner[s7].txt - [878 bytes] - [01/04/2015 17:27:48]
 
########## EOF - C:\AdwCleaner\AdwCleaner[s7].txt - [936  bytes] ##########
Link to post
Share on other sites
5potatoes

5potatoes

Posted
  • Author
Posted

reRun for JRT: 

 

 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.0 (03.31.2015:2)
OS: Windows 8.1 Pro x64
Ran by io8 on Wed 04/01/2015 at 17:36:01.84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 04/01/2015 at 17:39:52.63
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Link to post
Share on other sites
5potatoes

5potatoes

Posted
  • Author
Posted

While the last program is running, here is an update:

 

 After I ran the FIXlog, I have no longer had to type in my password more than once. Also, my main computer browser (Comodo Chromium) reset all back to defaults, losing all bookmarks (but that is fine). The Comodo Chromium browser looks quite different, too. It looks far more crisp and clean in the colors and there is content on the main page I never saw before- news columns and such. I am UNABLE to run Mozilla, a error pops up that "Couldn't Load XPCOM".

Finally, restarting takes a few minutes, about 3-4 minutes on the light blue Windows restating screen. But after that, everything loads up in seconds. I also did a shut-down and hard start...AMAZING! From the time I pressed the power button to the time the password screen came up took about 3 seconds. I typed in the password and my desktop popped right up- no load time at all. So, I am going from a computer that is completely turned off to my desktop in about 4 second! Thank you for that!!

 I will post the last results when finished.

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Uninstall Firefox, do not remove "Profile Data"  http://kb.mozillazine.org/Uninstalling_Firefox

 

Reinstall Firefox https://www.mozilla.org/en-GB/firefox/new/

 

Does Firefox now respond ok?

 

Next,

 

What makes you believe Internet Explorer is active? Open Task manager  http://www.eightforums.com/tutorials/5014-task-manager-open-windows-8-a.html

 

With TM running select Processes tab, do you see any entery named iexplore.exe? Also let me know of any remaining issues or concerns....

 

Thanks,

 

Kevin

Link to post
Share on other sites
5potatoes

5potatoes

Posted
  • Author
Posted

ok, I uninstalled and reinstalled Firefox, it does seems to be working fine, but it does take up to 10 seconds to open.

I do not see IE in my TM list of running processes now, but I have in the past. Also, when I run CCleaner, it cleans up stuff from IE.

The attached file is an example, but in the very recent past, like just before I started this thread, 100s of MB of data (temp files and cookies) was being cleaned from IE by CCleaner. 

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

The image you show is "Analyze" function, CC will analyze all options that are selected, I do not see entry showing data removed or data to be removed. I do not understand what you are trying to show??

Just because Internet Explorer is listed in CC log it does not mean it is actually active, Internet Explorer entries are selected in options, CC is duty bound to check for data to remove....

 

Run this please:

 

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

 


Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes select "Report", log will open. Close the program > Don't Fix anything!
Post back the report which should also be located here:

 

C:\Programdata\RogueKiller\Logs <-------- W7/8

 

Thanks,

 

Kevin...

Link to post
Share on other sites
5potatoes

5potatoes

Posted
  • Author
Posted

Hi, the above snapshot was after I ran the 'Run Cleaner' option. Below is another, though the data removed does appear to be much much less than before.

Rogue Killer results:

 

RogueKiller V10.5.8.0 [Mar 30 2015] by Adlice Software
 
Operating System : Windows 8.1 (6.3.9200 ) 64 bits version
Started in : Normal mode
User : io8 [Administrator]
Started from : C:\Users\io8\Desktop\RogueKiller.exe
Mode : Scan -- Date : 04/02/2015  21:19:37
 
¤¤¤ Processes : 0 ¤¤¤
 
¤¤¤ Registry : 6 ¤¤¤
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-115855252-3136697186-667742157-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0  -> Found
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-115855252-3136697186-667742157-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0  -> Found
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> Found
 
¤¤¤ Tasks : 0 ¤¤¤
 
¤¤¤ Files : 0 ¤¤¤
 
¤¤¤ Hosts File : 0 [Too big!] ¤¤¤
 
¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤
 
¤¤¤ Web browsers : 0 ¤¤¤
 
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000LM014-1EJ164 +++++
--- User ---
[MBR] dd946804812467408c6bbe17ac30bcd3
[bSP] b74bd17f057df3d312f780079aa5f342 : Windows Vista/7/8 MBR Code
Partition table:
User = LL1 ... OK
User = LL2 ... OK
 
+++++ PhysicalDrive1: Samsung SSD 840 EVO 250GB +++++
--- User ---
[MBR] f8113b9d42cf69f519dcf286e883714d
[bSP] 76bd8cbefe5767146a9ffb664b200108 : Windows Vista/7/8 MBR Code
Partition table:
User = LL1 ... OK
User = LL2 ... OK
 
+++++ PhysicalDrive2: Generic- Compact Flash USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )
 
+++++ PhysicalDrive3: Generic- SD/MMC USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )
 
+++++ PhysicalDrive4: Generic- MS/MS-PRO USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )
 
+++++ PhysicalDrive5: Generic- xD-Picture USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )
 
+++++ PhysicalDrive6: Generic- MicroSD/M2 USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )
Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

RogueKiller log is clean, CC snapshot looks normal to me. Lets run FRST one more time, see if we have missed anything....

 

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the two logs....

 

Thanks,

 

Kevin...

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Thanks for the logs, one step still to run...

 

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.


The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Let me know if any remaining issues or concerns...

 

Thank you,

 

Kevin...

Fixlist.txt

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

If no remaining issues run the following to clean up:

 

Download "Delfix by Xplode" and save it to your desktop.

 

Or use the following if first link is down:

 

"Delfix link mirror"

 

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

 

Make Sure the following items are checked:

 

 


    Remove disinfection tools
    Purge System Restore <--- this will remove all previous restore points and create a fresh point relative to system status at present.
    Reset system settings

 

Now click on "Run" and wait patiently until the tool has completed.

 

The tool will create a log when it has completed. We don't need you to post this.

 

Any remnant files/logs from tools we have used can be deleted…

 

Next,

 

Read the following link to fully understand PC security and best practices, you may find it useful....

 

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

 

Let me know if we are ok to close out....

 

Thanks,

 

Kevin...

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.