jeremyandbindi Posted February 11, 2016 ID:1018811 Share Posted February 11, 2016 Hi,I cannot get the program to update, I believe a virus is hogging all my bandwidth. Help! See my logs below. ------------- Additional scan result of Farbar Recovery Scan Tool (x64) Version:07-02-2016Ran by Bindi (2016-02-12 08:30:12)Running from C:\Users\Bindi\DownloadsWindows 10 Home (X64) (2015-09-22 12:06:16)Boot Mode: Normal========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-4289484082-701374006-202168876-500 - Administrator - Disabled)Bindi (S-1-5-21-4289484082-701374006-202168876-1001 - Administrator - Enabled) => C:\Users\BindiDefaultAccount (S-1-5-21-4289484082-701374006-202168876-503 - Limited - Disabled)Guest (S-1-5-21-4289484082-701374006-202168876-501 - Limited - Disabled)HomeGroupUser$ (S-1-5-21-4289484082-701374006-202168876-1003 - Limited - Enabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 20.2.145.43581 - Alcor Micro Corp.)Alcor Micro USB Card Reader (x32 Version: 20.2.145.43581 - Alcor Micro Corp.) HiddenASUS Check Device (HKLM-x32\...\{DAAAD1A8-6798-4685-B9DA-E686D672A4CF}) (Version: 1.0.6 - ASUS)ASUS GIFTBOX Desktop (HKLM-x32\...\{9110969C-A4E5-4112-93A3-A8686BF7444C}) (Version: 1.0.2 - ASUS)ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.3.4 - ASUS)ASUS Screen Saver (HKLM-x32\...\{0FBEEDF8-30FA-4FA3-B31F-C9C7E7E8DFA2}) (Version: 2.1.0 - ASUS)ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 4.0.9 - ASUS)ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 3.03.0006 - ASUS)ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 4.0.2 - ASUS)ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0037 - ASUS)AudioWizard (HKLM-x32\...\{57E770A2-2BAF-4CAA-BAA3-BD896E2254D3}) (Version: 1.0.0.57 - ICEpower a/s)Brother MFL-Pro Suite MFC-J470DW (HKLM-x32\...\{7B4C83B6-17C1-4BFD-B86D-4D7AD4498CBB}) (Version: 1.0.4.0 - Brother Industries, Ltd.)CCleaner (HKLM\...\CCleaner) (Version: 5.14 - Piriform)Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.66.4.60 - Conexant)Device Setup (HKLM-x32\...\{1F07F2C7-596F-4F34-B805-2C61A3E50E5A}) (Version: 1.0.18 - ASUSTek Computer Inc.)Dropbox (HKLM-x32\...\Dropbox) (Version: 3.12.5 - Dropbox, Inc.)Dropbox Update Helper (x32 Version: 1.3.27.37 - Dropbox, Inc.) HiddenGoogle Chrome (HKLM-x32\...\Google Chrome) (Version: 48.0.2564.109 - Google Inc.)Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) HiddenIntel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1018 - Intel Corporation)Intel® Chipset Device Software (x32 Version: 10.0.22 - Intel® Corporation) HiddenIntel® Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.0.10101.101 - Intel Corporation)Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.39.1003 - Intel Corporation)Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)Intel® Wireless Bluetooth® (HKLM-x32\...\{B2913DAE-3EBC-4C88-8245-0AA34B2E461D}) (Version: 17.1.1450.0402 - Intel Corporation)Intel® PROSet/Wireless Software (HKLM-x32\...\{1663dca9-b4be-4a91-940e-d94c82761dbb}) (Version: 17.15.1 - Intel Corporation)Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4787.1002 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4787.1002 - Microsoft Corporation) HiddenOffice 15 Click-to-Run Licensing Component (Version: 15.0.4787.1002 - Microsoft Corporation) HiddenOffice 15 Click-to-Run Localization Component (x32 Version: 15.0.4787.1002 - Microsoft Corporation) HiddenPicasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.140.248 - Google, Inc.)Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.105 - Skype Technologies S.A.)Update Installer for WildTangent Games App (x32 Version: - WildTangent) HiddenWatchtower Library 2014 - English (HKLM-x32\...\{DB6F2EEA-CEEA-4096-8BD7-ABF100A90820}) (Version: 16.0 - Watchtower Bible and Tract Society of Pennsylvania, Inc.)WebStorage (HKLM-x32\...\WebStorage) (Version: 2.1.11.399 - ASUS Cloud Corporation)WildTangent Games App (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-asus) (Version: 4.0.11.14 - WildTangent)Windows Driver Package - ASUS (ATP) Mouse (10/21/2015 1.0.0.262) (HKLM\...\F84E8769D448654402782673214DE63760BE04A7) (Version: 10/21/2015 1.0.0.262 - ASUS)WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.42.0 - ASUS) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-4289484082-701374006-202168876-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\FileCoAuth.exe (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-4289484082-701374006-202168876-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\FileCoAuth.exe (Microsoft Corporation) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {0BAECA3A-0631-49DA-8225-CFADC6A981E5} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-12-22] (Microsoft Corporation)Task: {193A10DE-D77E-489A-BC3D-67B1CCE91338} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2014-09-12] (ASUSTek Computer Inc.)Task: {226A67BE-E228-48CC-938F-6692EA58FD82} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2014-09-12] (ASUS)Task: {34ABDD7D-5EC9-4285-A962-66E3671FBF55} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2014-09-03] (ASUSTek Computer Inc.)Task: {511F4F85-A019-4B98-9C07-7D0C7431C6C8} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2015-12-14] (AsusTek)Task: {5AAA4901-7C2D-4BE4-94B6-DBE3871C715F} - System32\Tasks\Update Checker => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2015-02-12] ()Task: {5C298E1C-6CDD-4B26-BDFD-5F4155988CF3} - System32\Tasks\GoogleUpdateTaskMachineUA1d0f3d8a4b11d2e => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-21] (Google Inc.)Task: {661A5E4A-F336-4172-86C7-F4109A218C56} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-09-28] (Dropbox, Inc.)Task: {6883B48E-00EA-4369-A0D9-590B7F0E4344} - System32\Tasks\ASUS Live Update1 => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2015-03-23] (ASUSTeK Computer Inc.)Task: {7057CB47-0E79-499E-BF77-374A8CC10559} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-21] (Google Inc.)Task: {758C2D5B-1C62-41CB-9CD5-138B77DCE7BF} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTIONTask: {7A5EDC92-8240-4A0E-89EA-6A493D25099B} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTIONTask: {84AE53CC-48D9-4319-A9C2-ED393CCD03ED} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-21] (Google Inc.)Task: {97A764B8-BCCF-4641-BE2D-DB79CA998D0B} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-12-22] (Microsoft Corporation)Task: {9B9DCE03-8BA3-4E9D-8EE6-E157963BF940} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-02-01] (Microsoft Corporation)Task: {A56DE83B-5689-4FBB-A794-E16095505D55} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-01-16] (Piriform Ltd)Task: {C36F1472-289E-49C7-89AE-5803C38FF70F} - System32\Tasks\ASUS Live Update2 => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2015-03-23] (ASUSTeK Computer Inc.)Task: {C8D38F51-B174-4CFA-BB3D-0B5E687897EE} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-09-28] (Dropbox, Inc.)Task: {DEF34EE7-2626-4D58-AA07-2FE99B637D61} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTIONTask: {E5685E5B-82A9-41B2-8321-D6CDCC83A7C4} - System32\Tasks\ASUS_Check => C:\Program Files (x86)\ASUS\ASUS Check Device\ASUS_Check.exe [2014-10-29] (ASUSTeK Computer Inc.)Task: {EBE2C061-372E-43AC-9F86-2D06A90D2FEA} - System32\Tasks\ATK Package 36D18D69AFC3 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2014-06-12] (ASUSTek Computer Inc.)Task: {ED12E057-42D5-4E82-B2FF-FB2589C5E908} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-02-08] (Microsoft Corporation)Task: {F2A3476D-DE4E-404A-9746-0F5F7C0F89D4} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTIONTask: {F8F1851F-AD76-459F-BE96-1794B0295C45} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTIONTask: {FC11FC05-24E3-41AD-B4A9-F74AD815560E} - System32\Tasks\ASUS GIFTBOX Desktop => C:\Program Files (x86)\ASUS\ASUS GIFTBOX Desktop\ASUSGIFTBOXDesktop.exe [2014-08-08] (ASUS) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exeTask: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exeTask: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1d0f3d8a4b11d2e.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== 2015-09-10 15:08 - 2015-09-10 15:08 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll2015-11-03 15:40 - 2005-04-22 14:36 - 00143360 _____ () C:\WINDOWS\system32\BrSNMP64.dll2015-10-11 22:49 - 2015-09-17 16:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll2015-10-11 22:49 - 2015-09-17 16:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll2015-07-18 00:35 - 2015-07-18 00:35 - 00396688 _____ () C:\WINDOWS\system32\igfxTray.exe2015-10-11 22:48 - 2015-09-17 15:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll2015-07-10 13:13 - 2015-07-10 13:13 - 00143360 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\XamlTileRendering.dll2015-12-20 15:13 - 2015-12-20 15:16 - 00173056 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.6.12153.0_x64__8wekyb3d8bbwe\CellNativeClientUniversal.dll2015-09-23 07:17 - 2015-09-23 07:17 - 04485808 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.6.12153.0_x64__8wekyb3d8bbwe\Microsoft.Advertising.dll2015-10-11 22:49 - 2015-09-17 15:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll2015-10-11 22:48 - 2015-09-17 15:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll2015-10-11 22:48 - 2015-09-17 15:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll2015-10-11 22:49 - 2015-09-17 15:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll2015-07-10 13:13 - 2015-09-10 15:08 - 00210432 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll2016-01-28 16:55 - 2016-01-28 16:55 - 08463872 _____ () C:\Program Files\WindowsApps\king.com.CandyCrushSaga_1.675.1.0_x86__kgqvnymyfvs32\candycrushsaga.exe2016-01-28 16:58 - 2016-01-28 16:59 - 09737216 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_2015.25.24.0_x64__8wekyb3d8bbwe\WinStore.Entertainment.Mobile.dll2015-09-21 05:12 - 2015-10-13 04:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll2015-09-10 15:08 - 2015-09-10 15:08 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll2014-09-12 11:31 - 2014-09-12 11:31 - 00037424 _____ () C:\Program Files (x86)\ASUS\Splendid\DetectDisplayDC.dll2014-09-12 11:31 - 2014-09-12 11:31 - 00018992 _____ () C:\Program Files (x86)\ASUS\Splendid\AMDColorEnhance.dll2014-09-12 11:31 - 2014-09-12 11:31 - 00124928 _____ () C:\Program Files (x86)\ASUS\Splendid\CCTAdjust.dll2014-09-12 11:31 - 2014-09-12 11:31 - 00020528 _____ () C:\Program Files (x86)\ASUS\Splendid\AMDRegammaAndGamut.dll2015-02-26 07:15 - 2015-02-26 07:15 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll2015-12-13 13:34 - 2015-10-31 10:59 - 00034768 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\faulthandler.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00022848 _____ () C:\Program Files (x86)\Dropbox\Client\Crypto.Random.OSRNG.winrandom.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00023352 _____ () C:\Program Files (x86)\Dropbox\Client\Crypto.Util._counter.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00042296 _____ () C:\Program Files (x86)\Dropbox\Client\Crypto.Cipher._AES.pyd2015-12-13 13:34 - 2015-10-31 10:59 - 00116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll2015-12-13 13:34 - 2015-10-31 10:59 - 00093640 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd2015-12-13 13:34 - 2015-10-31 10:59 - 00018376 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00019760 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd2015-12-13 13:34 - 2015-10-31 10:59 - 00392144 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll2015-12-13 13:34 - 2015-12-09 07:36 - 00381752 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd2015-12-13 13:34 - 2015-10-31 10:59 - 00692688 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00020816 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00109520 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 01737032 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00020808 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_python_x66cf7a7cx17a72769.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00021840 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00038696 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00114640 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00021320 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_pywin_kernel32_xde9e4433x360333f0.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00024392 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll2015-12-13 13:34 - 2015-10-31 11:00 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00117056 _____ () C:\Program Files (x86)\Dropbox\Client\breakpad.client.windows.handler.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00031568 _____ () C:\Program Files (x86)\Dropbox\Client\enterprise_data.compiled._enterprise_data.pyd2015-09-28 18:17 - 2015-11-05 10:04 - 00293392 _____ () C:\Program Files (x86)\Dropbox\Client\EnterpriseDataAdapter.dll2015-12-13 13:34 - 2015-12-09 07:36 - 00023376 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd2015-12-13 13:34 - 2015-10-31 10:59 - 00134608 _____ () C:\Program Files (x86)\Dropbox\Client\_elementtree.pyd2015-12-13 13:34 - 2015-10-31 10:59 - 00134088 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00240584 _____ () C:\Program Files (x86)\Dropbox\Client\jpegtran.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00020280 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00052024 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00021304 _____ () C:\Program Files (x86)\Dropbox\Client\Crypto.Util.strxor.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00350152 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00084792 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL2015-12-13 13:34 - 2015-12-09 07:36 - 01826608 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd2015-12-13 13:34 - 2015-10-31 11:00 - 00083912 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 03891504 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 01950000 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00519984 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00133936 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00225080 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00207672 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00024904 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00486704 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd2015-12-13 13:34 - 2015-12-09 07:36 - 00357680 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd2015-09-28 18:17 - 2015-10-31 11:01 - 00019920 _____ () C:\Program Files (x86)\Dropbox\Client\QtQuick.2\qtquick2plugin.dll2015-09-28 18:17 - 2015-10-31 11:00 - 00786904 _____ () C:\Program Files (x86)\Dropbox\Client\QtQuick\Controls\qtquickcontrolsplugin.dll2015-09-28 18:17 - 2015-10-31 11:00 - 00063448 _____ () C:\Program Files (x86)\Dropbox\Client\QtQuick\Layouts\qquicklayoutsplugin.dll2015-09-28 18:17 - 2015-10-31 11:00 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\QtQuick\Window.2\windowplugin.dll2015-09-28 18:17 - 2015-10-31 11:00 - 00063432 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.dll2015-09-28 18:17 - 2015-10-31 11:00 - 01135568 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll2015-11-03 15:40 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll2013-04-27 10:24 - 2013-04-27 10:24 - 00071680 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\checkmetro.dll2015-09-23 06:55 - 2015-09-23 07:01 - 01288192 _____ () C:\Program Files\WindowsApps\king.com.CandyCrushSaga_1.675.1.0_x86__kgqvnymyfvs32\SB_LIBEAY32.dll2015-10-20 06:21 - 2015-10-20 06:21 - 00097944 _____ () C:\Program Files\WindowsApps\king.com.CandyCrushSaga_1.675.1.0_x86__kgqvnymyfvs32\libEGL.dll2015-10-20 06:21 - 2015-10-20 06:21 - 02303640 _____ () C:\Program Files\WindowsApps\king.com.CandyCrushSaga_1.675.1.0_x86__kgqvnymyfvs32\libGLESv2.dll2015-09-23 06:55 - 2015-09-23 06:56 - 00257536 _____ () C:\Program Files\WindowsApps\king.com.CandyCrushSaga_1.675.1.0_x86__kgqvnymyfvs32\curl.dll2015-09-23 06:55 - 2015-09-23 07:01 - 00293888 _____ () C:\Program Files\WindowsApps\king.com.CandyCrushSaga_1.675.1.0_x86__kgqvnymyfvs32\SB_SSLEAY32.dll2015-09-23 06:55 - 2015-09-23 07:01 - 00066560 _____ () C:\Program Files\WindowsApps\king.com.CandyCrushSaga_1.675.1.0_x86__kgqvnymyfvs32\zlib.dll2015-09-25 16:54 - 2015-09-25 16:54 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll2015-09-25 16:53 - 2015-09-25 16:53 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll2015-09-25 16:53 - 2015-09-25 16:53 - 00194728 _____ () C:\Program Files\Microsoft Office 15\root\office15\IEAWSDC.DLL2016-02-12 07:56 - 2016-02-09 21:58 - 01632584 _____ () C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.109\libglesv2.dll2016-02-12 07:56 - 2016-02-09 21:58 - 00087880 _____ () C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.109\libegl.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 23:25 - 2013-08-22 23:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-4289484082-701374006-202168876-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Bindi\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\asus.jpgHKU\S-1-5-21-4289484082-701374006-202168876-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Bindi\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\asus.jpgDNS Servers: 8.8.8.8 - 8.8.4.4HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139FirewallRules: [{979337F3-7126-4664-BAB2-C86D9CB4D828}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exeFirewallRules: [{d05fc355-7378-4131-b023-8aa91373d69c}] => (Allow) C:\Program Files (x86)\ASUS\ASUS GIFTBOX Desktop\ASUSGIFTBOXDesktop.exeFirewallRules: [{564A4039-5CE5-402F-8AD0-C0C53DDC38B7}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exeFirewallRules: [{F9902B47-D429-4D88-BE62-FF440F699234}] => (Allow) C:\Program Files (x86)\Brother\Brmfl13b\FAXRX.EXEFirewallRules: [{050696D4-1500-4D2D-AF22-C63EC36BC0EE}] => (Allow) LPort=54925FirewallRules: [{AEA0698D-3983-43C2-B3B1-344B9A2B43A1}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exeFirewallRules: [{5F3A2DC3-BE43-4567-8520-12DB797C0431}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Restore Points ========================= ATTENTION: System Restore is disabled ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors:==================Error: (12/28/2015 03:54:45 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )Description: Office Subscription licensing exception: Error Code: 0x803D0006; CorrelationId: {0B59AB43-FE2F-459A-93B5-61938B200B55} Error: (12/28/2015 06:27:51 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: BINDIUX305)Description: Application or service 'Microsoft Office Document Cache Sync Client Interface' could not be shut down. Error: (12/20/2015 04:12:24 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program Microsoft.Photos.exe version 15.1208.10480.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel. Process ID: 1244 Start Time: 01d137079e3d215f Termination Time: 4294967295 Application Path: C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe Report Id: 9e6d60eb-a6e0-11e5-826b-34028670dff9 Faulting package full name: Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe Faulting package-relative application ID: App Error: (12/20/2015 04:12:17 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: BINDIUX305)Description: Package Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe+App was terminated because it took too long to suspend. Error: (12/20/2015 04:12:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: BINDIUX305)Description: Package Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe+App was terminated because it took too long to suspend. Error: (12/13/2015 01:41:38 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: BINDIUX305)Description: Activation of app Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (12/13/2015 01:41:38 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: BINDIUX305)Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (12/13/2015 01:40:38 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: MicrosoftEdge.exe, version: 11.0.10240.16590, time stamp: 0x563ad824Faulting module name: eModel.dll, version: 11.0.10240.16590, time stamp: 0x563ad3a7Exception code: 0xc0000409Fault offset: 0x0000000000112663Faulting process id: 0x24a4Faulting application start time: 0xMicrosoftEdge.exe0Faulting application path: MicrosoftEdge.exe1Faulting module path: MicrosoftEdge.exe2Report Id: MicrosoftEdge.exe3Faulting package full name: MicrosoftEdge.exe4Faulting package-relative application ID: MicrosoftEdge.exe5 Error: (12/13/2015 01:39:27 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: BINDIUX305)Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (11/17/2015 01:19:27 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: BINDIUX305)Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information. System errors:=============Error: (02/09/2016 07:31:18 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0xc190020e: Upgrade to Windows 10 Home, version 1511, 10586. Error: (02/08/2016 10:19:02 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x80246013: Security Update for Internet Explorer Flash Player for Windows 10 for x64-based Systems (KB3132372). Error: (01/28/2016 04:26:58 PM) (Source: disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR9. Error: (01/27/2016 11:30:29 AM) (Source: disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR9. Error: (01/27/2016 11:30:29 AM) (Source: disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR9. Error: (01/27/2016 11:30:29 AM) (Source: disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR9. Error: (01/27/2016 11:30:29 AM) (Source: disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR9. Error: (01/27/2016 11:30:29 AM) (Source: disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR9. Error: (12/20/2015 03:03:40 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x80073d02: Microsoft Photos. Error: (12/17/2015 10:14:36 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x8024200d: Upgrade to Windows 10 Home, version 1511, 10586. ==================== Memory info =========================== Processor: Intel® Core M-5Y10c CPU @ 0.80GHzPercentage of memory in use: 38%Total physical RAM: 8094.67 MBAvailable physical RAM: 4995.24 MBTotal Virtual: 9374.67 MBAvailable Virtual: 4115.03 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:95.39 GB) (Free:1.41 GB) NTFS ==>[system with boot components (obtained from drive)]Drive d: (Data) (Fixed) (Total:127.85 GB) (Free:127.75 GB) NTFS ==================== MBR & Partition Table ================== ========================================================Disk: 0 (Size: 238.5 GB) (Disk ID: 069A931A) Partition: GPT. ==================== End of Addition.txt ============================ Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-02-2016Ran by Bindi (administrator) on BINDIUX305 (12-02-2016 08:29:31)Running from C:\Users\Bindi\DownloadsLoaded Profiles: Bindi & (Available Profiles: Bindi)Platform: Windows 10 Home (X64) Language: English (United States)Internet Explorer Version 11 (Default browser: Chrome)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Intel Corporation) C:\Windows\System32\igfxCUIService.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\AsusWSWinService.exe(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist.exe(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Check Device\ASUS_Check.exe(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe(ASUS) C:\Program Files (x86)\ASUS\ASUS GIFTBOX Desktop\ASUSGIFTBOXDesktop.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe(Intel Corporation) C:\Windows\System32\igfxEM.exe(Intel Corporation) C:\Windows\System32\igfxHK.exe() C:\Windows\System32\igfxTray.exe(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Microsoft Corporation) C:\Windows\System32\StikyNot.exe(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe(Conexant Systems, Inc) C:\Program Files\CONEXANT\SAII\SmartAudio.exe(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\AsusWSPanel.exe(Microsoft Corporation) C:\Windows\System32\NetworkUXBroker.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe(Microsoft Inc.) C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.6.12153.0_x64__8wekyb3d8bbwe\Solitaire.exe(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe(Microsoft Corporation) C:\Windows\System32\rundll32.exe(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1512.28020.0_x64__8wekyb3d8bbwe\Time.exe(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6525.42271.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6525.42271.0_x64__8wekyb3d8bbwe\HxTsr.exe(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.6605.23751.0_x64__8wekyb3d8bbwe\OHub.exe(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe() C:\Program Files\WindowsApps\king.com.CandyCrushSaga_1.675.1.0_x86__kgqvnymyfvs32\candycrushsaga.exe(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_2015.25.24.0_x64__8wekyb3d8bbwe\WinStore.Mobile.exe(Microsoft Corporation) C:\Windows\System32\wuapihost.exe(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.6568.15581.0_x64__8wekyb3d8bbwe\onenoteim.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.6605.23751.0_x64__8wekyb3d8bbwe\HubTaskHost.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\WINWORD.EXE(Microsoft Corporation) C:\Windows\splwow64.exe(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [920280 2015-04-17] (Conexant Systems, Inc.)HKLM\...\Run: [smartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\ASUSWSLoader.exe [63296 2014-08-20] ()HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [24952456 2015-12-09] (Dropbox, Inc.)HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2013-04-05] (Brother Industries, Ltd.)HKLM-x32\...\Run: [brStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [4522496 2012-12-27] (Brother Industries, Ltd.)HKLM-x32\...\Run: [brHelp] => C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe [2009088 2013-01-18] (Brother Industries, Ltd.)HKU\S-1-5-21-4289484082-701374006-202168876-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [465920 2015-09-10] (Microsoft Corporation)HKU\S-1-5-21-4289484082-701374006-202168876-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8619224 2016-01-16] (Piriform Ltd)HKU\S-1-5-21-4289484082-701374006-202168876-1001\...\Run: [GoogleChromeAutoLaunch_45126A694051E333BCE010342C82AF39] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [748872 2016-02-09] (Google Inc.)HKU\S-1-5-21-4289484082-701374006-202168876-1001\...\RunOnce: [uninstall C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.5951.0827_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.5951.0827_1\amd64"HKU\S-1-5-21-4289484082-701374006-202168876-1001\...\RunOnce: [uninstall C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64"HKU\S-1-5-21-4289484082-701374006-202168876-1001\...\RunOnce: [uninstall C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.6281.1202] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.6281.1202"HKU\S-1-5-21-4289484082-701374006-202168876-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [465920 2015-09-10] (Microsoft Corporation)HKU\S-1-5-21-4289484082-701374006-202168876-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8619224 2016-01-16] (Piriform Ltd)HKU\S-1-5-21-4289484082-701374006-202168876-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GoogleChromeAutoLaunch_45126A694051E333BCE010342C82AF39] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [748872 2016-02-09] (Google Inc.)HKU\S-1-5-21-4289484082-701374006-202168876-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [uninstall C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.5951.0827_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.5951.0827_1\amd64"HKU\S-1-5-21-4289484082-701374006-202168876-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [uninstall C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64"HKU\S-1-5-21-4289484082-701374006-202168876-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [uninstall C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.6281.1202] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Bindi\AppData\Local\Microsoft\OneDrive\17.3.6281.1202"ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-09] (Dropbox, Inc.)ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-12-09] (Dropbox, Inc.)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk [2016-02-12]ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> (No File)Startup: C:\Users\Bindi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk [2015-09-23]ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1Tcpip\..\Interfaces\{22bd1a4f-0add-4919-9bf1-2eb42d70ec65}: [NameServer] 8.8.8.8,8.8.4.4Tcpip\..\Interfaces\{22bd1a4f-0add-4919-9bf1-2eb42d70ec65}: [DhcpNameServer] 192.168.0.1 Internet Explorer:==================HKU\S-1-5-21-4289484082-701374006-202168876-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus13.msn.com/?pc=ASJBHKU\S-1-5-21-4289484082-701374006-202168876-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus13.msn.com/?pc=ASJBHKU\S-1-5-21-4289484082-701374006-202168876-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus13.msn.com/?pc=ASJBHKU\S-1-5-21-4289484082-701374006-202168876-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus13.msn.com/?pc=ASJBBHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-12-20] (Microsoft Corporation)BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-02-01] (Microsoft Corporation)Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-09-25] (Microsoft Corporation) FireFox:========FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [No File]FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-08-27] (Google, Inc.)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-02-26] (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-02-26] (Intel Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-09-21] (Microsoft Corporation)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-08-06] () Chrome: =======CHR Session Restore: Default -> is enabled.CHR Profile: C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Google Slides) - C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-09-21]CHR Extension: (Google Docs) - C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-21]CHR Extension: (Google Drive) - C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-24]CHR Extension: (YouTube) - C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-27]CHR Extension: (Google Search) - C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-03]CHR Extension: (Google Sheets) - C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-09-21]CHR Extension: (Google Docs Offline) - C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-19]CHR Extension: (Unlimited Free VPN - Betternet) - C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjknjjomckknofjidppipffbpoekiipm [2016-02-12]CHR Extension: (AwardWallet) - C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\Default\Extensions\lppkddfmnlpjbojooindbmcokchjgbib [2015-10-26]CHR Extension: (Chrome Web Store Payments) - C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-09-21]CHR Extension: (Gmail) - C:\Users\Bindi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-09-21] ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S2 0150011455227716mcinstcleanup; C:\Users\Bindi\AppData\Local\Temp\015001~1.EXE [882000 2015-06-18] (McAfee, Inc.)S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2015-09-23] (Adobe Systems) [File not signed]R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\AsusWSWinService.exe [71168 2014-08-20] (ASUS Cloud Corporation) [File not signed]R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2012-10-26] (Brother Industries, Ltd.) [File not signed]R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2787512 2015-12-22] (Microsoft Corporation)S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-09-28] (Dropbox, Inc.)S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-09-28] (Dropbox, Inc.)R2 esifsvc; C:\Windows\SysWOW64\esif_uf.exe [1037568 2015-02-03] (Intel Corporation)R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-25] (WildTangent)S2 ibtsiva; C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe [125168 2014-12-13] (Intel Corporation)R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [351120 2015-07-18] (Intel Corporation)S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2014-10-03] (Intel® Corporation)R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [156960 2015-02-26] (Intel Corporation)S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation) ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [101368 2015-12-14] (ASUS Corporation)R3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [165376 2015-07-10] (Microsoft Corporation)R3 BthHFAud; C:\Windows\system32\DRIVERS\BthHfAud.sys [36864 2015-07-10] (Microsoft Corporation)R3 dptf_acpi; C:\Windows\System32\drivers\dptf_acpi.sys [41824 2015-02-03] (Intel Corporation)R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [38720 2015-02-03] (Intel Corporation)R3 esif_lf; C:\Windows\System32\drivers\esif_lf.sys [216904 2015-02-03] (Intel Corporation)R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [266512 2015-07-15] (Intel Corporation)R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [79528 2014-10-16] (Intel Corporation)S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2016-02-12] (Malwarebytes)S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2015-02-26] (Intel Corporation)S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [80920 2015-07-02] (McAfee, Inc.)R3 NETwNb64; C:\Windows\System32\drivers\Netwbw02.sys [3495704 2015-03-03] (Intel Corporation)R3 SensorsAlsDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [214016 2015-07-10] (Microsoft Corporation)S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-02-12 08:29 - 2016-02-12 08:29 - 00022850 _____ C:\Users\Bindi\Downloads\FRST.txt2016-02-12 08:29 - 2016-02-12 08:29 - 00000000 ____D C:\FRST2016-02-12 08:28 - 2016-02-12 08:29 - 02370560 _____ (Farbar) C:\Users\Bindi\Downloads\FRST64.exe2016-02-12 08:25 - 2016-02-12 08:25 - 00016148 _____ C:\WINDOWS\system32\BINDIUX305_Bindi_HistoryPrediction.bin2016-02-12 08:12 - 2016-02-12 08:12 - 00001173 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2016-02-12 08:12 - 2016-02-12 08:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2016-02-12 08:12 - 2016-02-12 08:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware2016-02-12 08:12 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys2016-02-12 08:12 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys2016-02-12 08:12 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys2016-02-12 08:11 - 2016-02-12 08:12 - 22908888 _____ (Malwarebytes ) C:\Users\Bindi\Downloads\mbam-setup-2.2.0.1024.exe2016-02-12 07:55 - 2016-02-12 07:55 - 00000000 ____D C:\Program Files\McAfee2016-02-12 07:54 - 2016-02-12 07:54 - 00040826 _____ C:\Users\Bindi\Desktop\cc_20160212_075414.reg2016-02-12 07:49 - 2016-02-12 07:52 - 06828320 _____ (Piriform Ltd) C:\Users\Bindi\Downloads\ccsetup514.exe2016-02-08 22:22 - 2016-02-08 22:22 - 00003628 _____ C:\WINDOWS\System32\Tasks\ASUS Smart Gesture Launcher2016-02-08 22:21 - 2016-02-08 22:21 - 00056952 _____ C:\WINDOWS\system32\ASGCoInstaller_x64.dll2016-02-08 21:46 - 2016-02-08 21:46 - 00000000 ___HD C:\OneDriveTemp2016-02-04 20:24 - 2016-02-04 20:26 - 21908550 _____ C:\Users\Bindi\Downloads\IMG_0429.MOV.mov2016-02-02 18:14 - 2016-02-02 18:14 - 00066757 _____ C:\Users\Bindi\Downloads\L-C-2016-01-01-E.pdf2016-02-02 18:12 - 2016-02-02 18:12 - 00059716 _____ C:\Users\Bindi\Downloads\L-C-2016-01-21-EAu.pdf2016-02-02 18:11 - 2016-02-02 18:11 - 00061627 _____ C:\Users\Bindi\Downloads\L-BOE-2016-01-31-E.pdf2016-02-02 18:09 - 2016-02-02 18:09 - 00055798 _____ C:\Users\Bindi\Downloads\L-BOE-2016-02-01-E.pdf ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-02-12 08:28 - 2015-11-17 10:57 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys2016-02-12 08:20 - 2015-09-28 18:15 - 00000928 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job2016-02-12 08:10 - 2015-07-31 08:42 - 00000000 ____D C:\WINDOWS\system32\NDF2016-02-12 07:56 - 2015-09-21 05:20 - 00002274 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk2016-02-12 07:56 - 2015-09-21 05:20 - 00002262 _____ C:\Users\Public\Desktop\Google Chrome.lnk2016-02-12 07:55 - 2015-09-21 05:04 - 00000000 ____D C:\Users\Bindi\AppData\Local\Packages2016-02-12 07:55 - 2015-07-31 08:42 - 00000000 ___HD C:\Program Files\WindowsApps2016-02-12 07:55 - 2015-07-31 08:42 - 00000000 ____D C:\WINDOWS\AppReadiness2016-02-12 07:55 - 2015-05-08 22:16 - 00000000 ____D C:\ProgramData\McAfee2016-02-12 07:53 - 2015-09-21 05:26 - 00000865 _____ C:\Users\Public\Desktop\CCleaner.lnk2016-02-12 07:53 - 2015-07-31 08:40 - 00000000 ____D C:\WINDOWS\INF2016-02-12 07:47 - 2015-07-31 08:25 - 00000000 ____D C:\WINDOWS\CbsTemp2016-02-12 07:45 - 2015-09-21 05:07 - 00004154 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{32121387-CCC8-45E3-A14E-407E9B7CAAE5}2016-02-12 07:45 - 2015-09-21 05:05 - 00000125 _____ C:\Users\Bindi\AppData\Roaming\sp_data.sys2016-02-12 07:42 - 2015-09-28 18:21 - 00000000 ___RD C:\Users\Bindi\Dropbox2016-02-09 19:34 - 2015-11-03 15:40 - 00007891 _____ C:\WINDOWS\BRRBCOM.INI2016-02-09 19:31 - 2015-12-17 10:11 - 00000000 ____D C:\WINDOWS\Panther2016-02-09 19:27 - 2015-10-30 19:42 - 00000000 ___HD C:\$WINDOWS.~BT2016-02-08 22:22 - 2015-05-08 22:09 - 00000000 ____D C:\Program Files\DIFX2016-02-08 22:22 - 2014-09-24 22:20 - 00000000 ____D C:\Program Files (x86)\ASUS2016-02-08 22:21 - 2015-09-23 17:27 - 00000000 ____D C:\WINDOWS\system32\MRT2016-02-08 22:21 - 2015-09-23 06:47 - 00000000 ____D C:\ProgramData\SetupTPDriver2016-02-08 22:19 - 2015-09-23 17:27 - 143671360 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe2016-02-08 21:46 - 2015-09-23 06:44 - 00002407 _____ C:\Users\Bindi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk2016-02-08 21:46 - 2015-09-21 05:05 - 00000000 ___RD C:\Users\Bindi\OneDrive2016-02-02 19:55 - 2015-09-21 05:14 - 00000924 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job2016-02-02 19:50 - 2015-09-21 05:14 - 00004016 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA1d0f3d8a4b11d2e2016-02-02 19:50 - 2015-09-21 05:14 - 00003754 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore2016-02-02 19:50 - 2015-09-21 05:14 - 00000928 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1d0f3d8a4b11d2e.job2016-02-01 22:24 - 2015-09-21 05:12 - 00000000 ____D C:\Program Files\Microsoft Office 152016-02-01 22:24 - 2015-07-31 08:42 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft2016-02-01 14:08 - 2015-09-22 19:01 - 00875126 _____ C:\WINDOWS\system32\PerfStringBackup.INI2016-01-28 18:03 - 2015-07-31 08:42 - 00000000 ____D C:\WINDOWS\LiveKernelReports2016-01-28 16:27 - 2015-09-21 05:22 - 00003544 _____ C:\WINDOWS\System32\Tasks\ASUS Live Update12016-01-28 16:27 - 2015-09-21 05:22 - 00003534 _____ C:\WINDOWS\System32\Tasks\ASUS Live Update2 ==================== Files in the root of some directories ======= 2015-09-21 05:05 - 2016-02-12 07:45 - 0000125 _____ () C:\Users\Bindi\AppData\Roaming\sp_data.sys2014-09-24 22:20 - 2012-09-07 21:40 - 0000256 _____ () C:\ProgramData\SetStretch.cmd2014-09-24 22:20 - 2009-07-22 20:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe2014-09-24 22:20 - 2012-09-07 21:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS Some files in TEMP:====================C:\Users\Bindi\AppData\Local\Temp\0150011455227716mcinst.exe ==================== Bamital & volsnap ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\system32\winlogon.exe => File is digitally signedC:\WINDOWS\system32\wininit.exe => File is digitally signedC:\WINDOWS\explorer.exe => File is digitally signedC:\WINDOWS\SysWOW64\explorer.exe => File is digitally signedC:\WINDOWS\system32\svchost.exe => File is digitally signedC:\WINDOWS\SysWOW64\svchost.exe => File is digitally signedC:\WINDOWS\system32\services.exe => File is digitally signedC:\WINDOWS\system32\User32.dll => File is digitally signedC:\WINDOWS\SysWOW64\User32.dll => File is digitally signedC:\WINDOWS\system32\userinit.exe => File is digitally signedC:\WINDOWS\SysWOW64\userinit.exe => File is digitally signedC:\WINDOWS\system32\rpcss.dll => File is digitally signedC:\WINDOWS\system32\dnsapi.dll => File is digitally signedC:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signedC:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2016-02-01 22:58 ==================== End of FRST.txt ============================ Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 12, 2016 ID:1018885 Share Posted February 12, 2016 Hello, They call me TwinHeadedEagle around here, and I'll be working with you. Before we start please read and note the following:At the top of your post, please click on the "Watch thread" button and make sure to check Watch this thread...and receive email notifications. This will send an email to you as soon as I reply to your topic, allowing me to solve your problem faster.Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process. Please do not perform System Restore or any other restore.Instructions I give to you are very simple and made for complete beginner to follow. That's why you need to read through my instructions carefully and completely before executing them.Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.All tools we use here are completely clean and do not contain any malware. If your antivirus detects them as malicious, please disable your antivirus and then continue.If during the process you run across anything that is not in my instructions, please stop and ask. If any tool is running too much time (few hours), please stop and inform me.I visit forum several times at day, making sure to respond to everyone's topic as fast as possible. But bear in mind that I have private life like everyone and I cannot be here 24/7. So please be patient with me. Also, some infections require less, and some more time to be removed completely, so bear this in mind and be patient.Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. If you solved your problem yourself, set aside two minutes to let me know.Please attach all report using button below. Doing this, you make it easier for me to analyze and fix your problem.Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay for the repair.If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed. Rules and policies We won't support any piracy. That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding! The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding! Failure to follow these guidelines will result with closing your topic and withdrawning any assistance. Scan with Farbar Recovery Scan Tool Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.Right-click on icon and select Run as Administrator to start the tool. (XP users click run after receipt of Windows Security Warning - Open File).Make sure that Addition option is checked.Press Scan button and wait.The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.Please include their content into your next reply. Link to post Share on other sites More sharing options...
jeremyandbindi Posted February 13, 2016 Author ID:1019105 Share Posted February 13, 2016 Don't know how, but appears my problem is gone now! THanks! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 13, 2016 Root Admin ID:1019144 Share Posted February 13, 2016 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts