Additional scan result of Farbar Recovery Scan Tool (x64) Version:25-01-2016 Ran by [removed] (2016-01-27 02:37:35) Running from C:\Users\[removed]\Desktop Windows 7 Home Premium Service Pack 1 (X64) (2016-01-25 09:20:05) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-263944085-2965478262-2625758809-500 - Administrator - Disabled) Guest (S-1-5-21-263944085-2965478262-2625758809-501 - Limited - Disabled) JAN (S-1-5-21-263944085-2965478262-2625758809-1000 - Administrator - Enabled) => C:\Users\JAN UpdatusUser (S-1-5-21-263944085-2965478262-2625758809-1001 - Limited - Enabled) => C:\Users\UpdatusUser ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: COMODO Antivirus (Enabled - Up to date) {F25D0092-CDBE-B303-ADB7-88DE8CDECCF5} AS: Comodo Defense+ (Enabled - Up to date) {493CE176-EB84-BC8D-9707-B3ACF7598648} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: COMODO Firewall (Enabled) {CA6681B7-87D1-B25B-86E8-21EB720D8B8E} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Boot Camp Services (HKLM\...\{FA2B2C2A-EA41-495A-9308-60726125D562}) (Version: 5.1.5621 - Apple Inc.) Chromodo (HKLM-x32\...\Chromodo) (Version: 45.8.12.391 - Comodo) COMODO Internet Security Premium (HKLM\...\{04833277-EE61-4251-9273-0CF86C0FE710}) (Version: 8.2.0.4792 - COMODO Security Solutions Inc.) Comodo TrustConnect™ v.1.7.3 (HKLM-x32\...\Comodo TrustConnect™_is1) (Version: - COMODO) CPCTuneUp (HKLM\...\{FC4D0316-D3D8-4c07-9E45-7A2A4D75E069}) (Version: 1.0.265884.46 - COMODO) GeekBuddy (HKLM\...\{837C1C42-450E-40E3-B5C8-067BDC128628}) (Version: 4.25.164 - Comodo Security Solutions Inc) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.0.1428 - Intel Corporation) Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.7.248 - Intel Corporation) Microsoft Office Ultimate 2007 (HKLM-x32\...\ULTIMATER) (Version: 12.0.4518.1014 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation) NVIDIA 3D Vision Driver 332.28 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 332.28 - NVIDIA Corporation) NVIDIA Graphics Driver 332.28 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.28 - NVIDIA Corporation) NVIDIA HD Audio Driver 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation) NVIDIA Update 1.15.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.15.2 - NVIDIA Corporation) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5936 - Realtek Semiconductor Corp.) Windows Driver Package - Apple Inc. (AppleCamera) Image (11/21/2013 5.0.22.0) (HKLM\...\1FCF3C93707C46D648F0B00E216A55E96DEB5A17) (Version: 11/21/2013 5.0.22.0 - Apple Inc.) Windows Driver Package - Apple Inc. (AppleUSBEthernet) Net (02/01/2008 3.10.3.10) (HKLM\...\D53CBF2C12DF51DA5E9C1A9DA97FF0DCA0C524C5) (Version: 02/01/2008 3.10.3.10 - Apple Inc.) Windows Driver Package - Apple Inc. Apple Bluetooth (03/01/2010 3.0.0.5) (HKLM\...\EA3C044F6FD39CEC8F4F596836BF4197E97E1D39) (Version: 03/01/2010 3.0.0.5 - Apple Inc.) Windows Driver Package - Apple Inc. Apple Broadcom Bluetooth (04/10/2013 5.0.4.0) (HKLM\...\EC3BA08E32AD503AB708B97F11CE09D06BCC9604) (Version: 04/10/2013 5.0.4.0 - Apple Inc.) Windows Driver Package - Apple Inc. Apple Display (01/23/2009 3.0.0.0) (HKLM\...\E0EAD0CEA9119B77350ED4DE28D9A82E57014D94) (Version: 01/23/2009 3.0.0.0 - Apple Inc.) Windows Driver Package - Apple Inc. Apple IR Receiver (02/21/2008 2.0.4.0) (HKLM\...\D5BB697E7D0C75712F3AD00AB1B85412CB5C0FD3) (Version: 02/21/2008 2.0.4.0 - Apple Inc.) Windows Driver Package - Apple Inc. Apple Keyboard (01/10/2014 5.0.8.0) (HKLM\...\ABCCA6C3F97A148D7C69114CB55DFA9D46053BEA) (Version: 01/10/2014 5.0.8.0 - Apple Inc.) Windows Driver Package - Apple Inc. Apple Multitouch (09/04/2013 5.0.2.0) (HKLM\...\277F15E06E6EEB458048F41BCB8FB843B3241E95) (Version: 09/04/2013 5.0.2.0 - Apple Inc.) Windows Driver Package - Apple Inc. Apple Multitouch Mouse (09/11/2012 4.0.3.0) (HKLM\...\742CB1BDA52EA9F1BBE482DA6DAA17944652B476) (Version: 09/11/2012 4.0.3.0 - Apple Inc.) Windows Driver Package - Apple Inc. Apple ODD (05/17/2010 3.1.0.0) (HKLM\...\D6B4CB6AD2F81752C2EF8DCF6AD5EBC567ADD45C) (Version: 05/17/2010 3.1.0.0 - Apple Inc.) Windows Driver Package - Apple Inc. Apple SD Card Reader (07/22/2013 1.0.0.1) (HKLM\...\D323E2C0C5E4948B07EE346CF62161281B0A8578) (Version: 07/22/2013 1.0.0.1 - Apple Inc.) Windows Driver Package - Apple Inc. Apple System Device (05/20/2013 5.0.2.0) (HKLM\...\1A9F109A8ACEE4CA1F898708DBB0FBA6EF0587FC) (Version: 05/20/2013 5.0.2.0 - Apple Inc.) Windows Driver Package - Apple Inc. Apple Wireless Mouse (06/01/2011 4.0.0.1) (HKLM\...\D088EE4BD2819FBA2B349EF9D55176F223419BE6) (Version: 06/01/2011 4.0.0.1 - Apple Inc.) Windows Driver Package - Apple Inc. Apple Wireless Trackpad (10/29/2011 5.0.0.0) (HKLM\...\551732BB0872DA97E26385C221B172A5BD4DE93C) (Version: 10/29/2011 5.0.0.0 - Apple Inc.) Windows Driver Package - Atheros Communications Inc. (athr) Net (11/13/2010 9.2.0.113) (HKLM\...\F0A3F8394866FA91E82C8D5AB92C918FE40FE1DF) (Version: 11/13/2010 9.2.0.113 - Atheros Communications Inc.) Windows Driver Package - Broadcom (b57nd60a) Net (09/04/2012 15.4.0.17) (HKLM\...\75E64992A03EC5E73D33586790CC506561DCC5DB) (Version: 09/04/2012 15.4.0.17 - Broadcom) Windows Driver Package - Broadcom (B57ports) Net (06/16/2009 1.0.0.1) (HKLM\...\FC2077892425ED71A137B1CB6D99A9CA7475435D) (Version: 06/16/2009 1.0.0.1 - Broadcom) Windows Driver Package - Broadcom (BCM43XX) Net (11/13/2012 5.106.199.1) (HKLM\...\3D6DDDCF8961C8C866F6660579A59B5B6CFA281F) (Version: 11/13/2012 5.106.199.1 - Broadcom) Windows Driver Package - Broadcom (BCM43XX) Net (12/13/2013 6.30.223.215) (HKLM\...\A5E73046BA905B7B0235AB40FA98A4E3AB96E00E) (Version: 12/13/2013 6.30.223.215 - Broadcom) Windows Driver Package - Broadcom Corporation (bScsiSDa) SDHost (08/14/2012 1.0.0.243) (HKLM\...\ADF3AD5C5705E56E7DEA1447D58EFF216BA1223D) (Version: 08/14/2012 1.0.0.243 - Broadcom Corporation) Windows Driver Package - Cirrus Logic, Inc. (CirrusFilter) MEDIA (02/19/2013 6.6001.1.40) (HKLM\...\969EFE1D5E95B01D3C42B9D0363FA64AF9E336E7) (Version: 02/19/2013 6.6001.1.40 - Cirrus Logic, Inc.) Windows Driver Package - Cirrus Logic, Inc. (CirrusLFD) MEDIA (10/03/2013 6.6001.3.13) (HKLM\...\9EBC96DD99F2C854D540FBF6A16A557BADDBC228) (Version: 10/03/2013 6.6001.3.13 - Cirrus Logic, Inc.) Windows Driver Package - Intel (e1express) Net (03/26/2010 9.13.41.0) (HKLM\...\159439476E3A00F9FAE49DD6C1A78F2F6288A5B9) (Version: 03/26/2010 9.13.41.0 - Intel) Windows Driver Package - Intel (e1kexpress) Net (04/12/2010 11.6.92.0) (HKLM\...\5BEF08C10896D86DC13394FFA75874564B700368) (Version: 04/12/2010 11.6.92.0 - Intel) Windows Driver Package - Intel (e1qexpress) Net (12/04/2009 11.4.7.0) (HKLM\...\57AFA39B22ADEC4E383572E9331167546EB3C9C7) (Version: 12/04/2009 11.4.7.0 - Intel) Windows Driver Package - Intel (e1rexpress) Net (01/07/2010 11.4.16.0) (HKLM\...\F71DB41300D30088C8D3716343D1429488E605C1) (Version: 01/07/2010 11.4.16.0 - Intel) Windows Driver Package - Intel (e1yexpress) Net (04/07/2010 10.1.9.0) (HKLM\...\CB599752301BCA080D135697FDD05900F5A5CF4C) (Version: 04/07/2010 10.1.9.0 - Intel) Windows Driver Package - Intel System (07/20/2007 1.2.76.0) (HKLM\...\E2708073906571A0B56F17FD825EF19281ECE29B) (Version: 07/20/2007 1.2.76.0 - Intel) Windows Driver Package - Marvell (yukonx64) Net (12/06/2007 10.51.1.3) (HKLM\...\CDD703ED0B390A5643DB748EBFA5BD55FEEC0D8A) (Version: 12/06/2007 10.51.1.3 - Marvell) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {115F0D53-9956-4323-9A93-4A2AEEF3A9D7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {2134AC30-D3F2-4C88-9362-8F08D9899E98} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-05] (COMODO) Task: {272E2CDA-7702-4446-847C-9E7B54A97250} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-05] (COMODO) Task: {3AEF37F5-DB04-438E-8E22-5C6E9F40CA13} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-08-05] (COMODO) Task: {3D476614-8722-4D72-BB44-2CB6073A7093} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-05] (COMODO) Task: {5A40E926-9E86-4B89-9CFD-B12311724371} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto Task: {CB372D7B-E738-4C2C-8C08-2606C8ECA132} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-05] (COMODO) Task: {DD9F510C-95F4-499A-90C8-BAC5BC372FF4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask => start sppsvc (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== 2014-01-31 17:59 - 2014-01-31 17:59 - 00226112 _____ () C:\Windows\system32\AppleOSSMgr.exe 2013-02-07 14:12 - 2013-02-07 14:12 - 00848584 _____ () C:\Program Files\COMODO\PC TuneUP\Plugins\RegistryScannerPlugin.dll 2016-01-25 02:27 - 2013-12-24 22:49 - 00117536 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2016-01-07 10:51 - 2016-01-07 10:51 - 01283776 _____ () C:\Program Files\COMODO\GeekBuddy\QtNetwork4.dll 2016-01-07 10:51 - 2016-01-07 10:51 - 02875584 _____ () C:\Program Files\COMODO\GeekBuddy\QtCore4.dll 2016-01-07 10:51 - 2016-01-07 10:51 - 10451648 _____ () C:\Program Files\COMODO\GeekBuddy\QtGui4.dll 2016-01-07 10:52 - 2016-01-07 10:52 - 00039104 _____ () C:\Program Files\COMODO\GeekBuddy\imageformats\qgif4.dll 2016-01-07 10:51 - 2016-01-07 10:51 - 01529024 _____ () C:\Program Files\COMODO\GeekBuddy\QtScript4.dll 2015-01-08 22:02 - 2015-01-08 22:02 - 00067808 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav 2016-01-25 02:32 - 2014-01-31 17:54 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll 2015-12-08 15:32 - 2015-12-08 15:32 - 01881784 _____ () C:\Program Files (x86)\Comodo\Chromodo\libglesv2.dll 2015-12-08 15:19 - 2015-12-08 15:19 - 00082104 _____ () C:\Program Files (x86)\Comodo\Chromodo\libegl.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) AlternateDataStreams: C:\Windows\notepad.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\aaclient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\adprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\adtschema.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\advapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\apisetschema.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\appidapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\appidcertstorecheck.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\appidpolicyconverter.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\appidsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\appinfo.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\atmfd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\atmlib.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\audiodg.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\AudioEng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AUDIOKSE.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\AudioSes.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\audiosrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\auditpol.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\authui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\basesrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\bcryptprimitives.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\blackbox.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\browcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\browser.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\capiprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\catsrvut.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cdd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cdosys.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\certcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\certenc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\certutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\cewmdm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ci.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\clfs.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\clfsw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cngprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\COLORCNV.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\comctl32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\comsvcs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\conhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\consent.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\CPFilters.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\credssp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\crypt32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptbase.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cryptui.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\cscript.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\csrsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\d3d10warp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\davclnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dciman32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\devenum.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dfshim.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dimsroam.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dnsapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dnscacheugc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\dnsrslvr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dpapiprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\dpnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\drmmgrtn.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\drmv2clt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\DWrite.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\els.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\EncDec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\EncDump.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\evr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ExplorerFrame.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fixmapi.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\FntCache.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\fontsub.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\FWPUCLNT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\gdi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\IEUDINIT.EXE:$CmdTcID AlternateDataStreams: C:\Windows\system32\IKEEXT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\imagehlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\IMJP10K.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\inetcomm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\InkEd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\kd1394.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\kdcom.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\kdusb.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\kerberos.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\kernel32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\KernelBase.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ksproxy.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\ksuser.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\localspl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\lpk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\lsasrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\lsass.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mapistub.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfc42.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfc42u.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mferror.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfplat.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfpmp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mfvdsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MFWMAAEC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\MP3DMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\MP43DECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\MP4SDECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\mpg2splt.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\MPG4DECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\MRT.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\msaudite.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mscorier.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mscories.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msctf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msiexec.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\msihnd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msimsg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msmmsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msmpeg2adec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\MSMPEG2ENC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\msmpeg2vdec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msnetobj.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msobjs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msscp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\mstsc.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\mstscax.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msv1_0.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msvcrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msxml3.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msxml3r.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msxml6.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\msxml6r.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ncrypt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ncsi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\netapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nlaapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\nlasvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\notepad.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\nshwfp.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntdll.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntoskrnl.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ntvdm64.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\objsel.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbccp32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbccr32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbccu32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\odbctrac.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\ole32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\oleacc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\oleaut32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\osk.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\packager.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcadm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcaevts.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcalua.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcasvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\pcawrk.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\pku2u.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\poqexec.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\profsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\psisdecd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\psisrndr.ax:$CmdTcID AlternateDataStreams: C:\Windows\system32\qasf.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\qdvd.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\qedit.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\quartz.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rastls.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdpcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdpcorekmts.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdpwsx.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rdrmemptylst.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\RESAMPLEDMO.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\rpcrt4.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\rrinstaller.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\rstrui.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\sbe.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\scesrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\schannel.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\schedsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\scrrun.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\secur32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\services.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\setbcdlocale.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shdocvw.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\shell32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\smss.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\srclient.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\srcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sspicli.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sspisrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\synceng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\sysmain.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\taskhost.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\termsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\tsgqec.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TSpkg.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\TSWbPrxy.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\ubpm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\umpnpmgr.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\user32.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\usp10.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\VIDRESZR.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\wdigest.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WebClnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\webio.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wer.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\win32k.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\win32spl.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wincredprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WindowsCodecs.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winload.efi:$CmdTcID AlternateDataStreams: C:\Windows\system32\winload.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\winlogon.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\winresume.efi:$CmdTcID AlternateDataStreams: C:\Windows\system32\winresume.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\WinSetupUI.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winsrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\winsta.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wintrust.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMADMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMADMOE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmdrmsdk.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wmi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMPhoto.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMSPDMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMSPDMOE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMVDECOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMVENCOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMVSDECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMVSENCD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\WMVXENCD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\system32\wow64.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wow64cpu.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wow64win.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wscript.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wshom.ocx:$CmdTcID AlternateDataStreams: C:\Windows\system32\wshrm.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wu.upgrade.ps.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wuapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wuapp.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wuauclt.exe:$CmdTcID AlternateDataStreams: C:\Windows\system32\wuaueng.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wucltux.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wudriver.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wups.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wups2.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\wuwebv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\aaclient.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\adprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\adtschema.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\advapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\apisetschema.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\appidapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\atmfd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\atmlib.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AudioEng.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AUDIOKSE.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\AudioSes.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\auditpol.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\authui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\bcryptprimitives.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\blackbox.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\browcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\capiprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\catsrvut.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cdosys.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\certcli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\certenc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\certutil.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cewmdm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cfgmgr32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\clfsw32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cngprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\COLORCNV.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\comctl32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\comsvcs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\CPFilters.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\credssp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\crypt32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptbase.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptsvc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cryptui.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\cscript.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\d3d10warp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\davclnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dciman32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\devenum.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\devobj.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\devrtl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dfshim.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dimsroam.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dnsapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dnscacheugc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dpapiprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\dpnet.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\drmmgrtn.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\drmv2clt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\drvinst.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\DWrite.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\els.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\EncDec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\evr.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ExplorerFrame.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fixmapi.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\fontsub.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\FWPUCLNT.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\gdi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\imagehlp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\IMJP10K.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\inetcomm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\InkEd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\instnm.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\kerberos.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\kernel32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\KernelBase.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ksproxy.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ksuser.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\lpk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mapistub.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfc42.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfc42u.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mferror.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfplat.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfpmp.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfps.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mfvdsp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MFWMAAEC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MP3DMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MP43DECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MP4SDECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mpg2splt.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MPG4DECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msaudite.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mscorier.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mscories.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msctf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msiexec.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msihnd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msimsg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msmpeg2adec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\MSMPEG2ENC.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msmpeg2vdec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msnetobj.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msobjs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msscp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mstsc.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\mstscax.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msv1_0.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msvcrt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msxml3.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msxml3r.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msxml6.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\msxml6r.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ncrypt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ncsi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\netapi32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nlaapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\notepad.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\nshwfp.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntdll.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntkrnlpa.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntoskrnl.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ntvdm64.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\objsel.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbccp32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbccr32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbccu32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbcjt32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\odbctrac.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ole32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\oleacc.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\oleaut32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\osk.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\packager.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\pku2u.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\poqexec.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\psisdecd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\psisrndr.ax:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\qasf.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\qdvd.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\qedit.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\quartz.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rastls.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rdpcore.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\RESAMPLEDMO.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rpcrt4.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\rrinstaller.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sbe.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\scesrv.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\schannel.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\scrrun.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\secur32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\setup16.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shdocvw.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\shell32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\srclient.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\sspicli.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\synceng.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\tsgqec.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\TSpkg.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\ubpm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\user.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\user32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\usp10.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\VIDRESZR.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wdigest.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WebClnt.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\webio.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wer.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\win32spl.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wincredprovider.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WindowsCodecs.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\winsta.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wintrust.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WISPTIS.EXE:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMADMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMADMOE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmdrmsdk.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wmi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMPhoto.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMSPDMOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMSPDMOE.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMVDECOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMVENCOD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMVSDECD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMVSENCD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\WMVXENCD.DLL:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wow32.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wscript.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wshom.ocx:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wshrm.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wuapi.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wuapp.exe:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wudriver.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wups.dll:$CmdTcID AlternateDataStreams: C:\Windows\SysWOW64\wuwebv.dll:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\afd.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\appid.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\bowser.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\cng.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\drmk.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\drmkaud.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\dxgkrnl.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\dxgmms1.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\fs_rec.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\FWPKCLNT.SYS:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\hidclass.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\hidparse.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\http.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ksecdd.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ksecpkg.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mountmgr.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mrxdav.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb10.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb20.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ndis.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\netio.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\ntfs.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\partmgr.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\PEAuth.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\portcls.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\rdpwd.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\rmcast.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\srv.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\srv2.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\srvnet.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\tap0901.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\tcpip.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\tdtcp.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\tdx.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\tssecsrv.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usb8023.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbccgp.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbcir.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbd.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbehci.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbhub.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbport.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\usbvideo.sys:$CmdTcID AlternateDataStreams: C:\Windows\system32\Drivers\Wdf01000.sys:$CmdTcID AlternateDataStreams: C:\Users\JAN\Desktop\FRST64.exe:$CmdTcID AlternateDataStreams: C:\Users\JAN\Desktop\FRST64.exe:$CmdZnID AlternateDataStreams: C:\Users\JAN\Downloads\bluescreenview.zip:$CmdZnID ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-263944085-2965478262-2625758809-1000\Control Panel\Desktop\\Wallpaper -> DNS Servers: [removed] - [removed] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is disabled. ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [RemoteAssistance-PnrpSvc-UDP-OUT-Active] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [RemoteAssistance-PnrpSvc-UDP-In-EdgeScope-Active] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [RemoteAssistance-SSDPSrv-Out-TCP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteAssistance-SSDPSrv-In-TCP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteAssistance-SSDPSrv-Out-UDP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteAssistance-SSDPSrv-In-UDP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteAssistance-Out-TCP-Active] => (Block) %SystemRoot%\system32\msra.exe FirewallRules: [RemoteAssistance-In-TCP-EdgeScope-Active] => (Block) %SystemRoot%\system32\msra.exe FirewallRules: [RemoteAssistance-DCOM-In-TCP-NoScope-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteAssistance-RAServer-Out-TCP-NoScope-Active] => (Block) %SystemRoot%\system32\raserver.exe FirewallRules: [RemoteAssistance-RAServer-In-TCP-NoScope-Active] => (Block) %SystemRoot%\system32\raserver.exe FirewallRules: [RemoteAssistance-PnrpSvc-UDP-OUT] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [RemoteAssistance-PnrpSvc-UDP-In-EdgeScope] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [RemoteAssistance-Out-TCP] => (Block) %SystemRoot%\system32\msra.exe FirewallRules: [RemoteAssistance-In-TCP-EdgeScope] => (Block) %SystemRoot%\system32\msra.exe FirewallRules: [RemoteFwAdmin-RPCSS-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteFwAdmin-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteFwAdmin-RPCSS-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteFwAdmin-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteEventLogSvc-RPCSS-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteEventLogSvc-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteEventLogSvc-RPCSS-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteEventLogSvc-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MSDTC-RPCSS-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MSDTC-KTMRM-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MSDTC-Out-TCP] => (Block) %SystemRoot%\system32\msdtc.exe FirewallRules: [MSDTC-In-TCP] => (Block) %SystemRoot%\system32\msdtc.exe FirewallRules: [MSDTC-RPCSS-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MSDTC-KTMRM-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MSDTC-Out-TCP-NoScope] => (Block) %SystemRoot%\system32\msdtc.exe FirewallRules: [MSDTC-In-TCP-NoScope] => (Block) %SystemRoot%\system32\msdtc.exe FirewallRules: [RemoteTask-RPCSS-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteTask-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteTask-RPCSS-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteTask-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteSvcAdmin-RPCSS-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteSvcAdmin-In-TCP] => (Block) %SystemRoot%\system32\services.exe FirewallRules: [RemoteSvcAdmin-RPCSS-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RemoteSvcAdmin-In-TCP-NoScope] => (Block) %SystemRoot%\system32\services.exe FirewallRules: [NETDIS-FDRESPUB-WSD-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-FDRESPUB-WSD-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-LLMNR-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-LLMNR-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-FDPHOST-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-FDPHOST-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-UPnP-Out-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-SSDPSrv-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-SSDPSrv-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-FDRESPUB-WSD-Out-UDP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-FDRESPUB-WSD-In-UDP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-LLMNR-Out-UDP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-LLMNR-In-UDP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-FDPHOST-Out-UDP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-FDPHOST-In-UDP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-UPnP-Out-TCP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-SSDPSrv-Out-UDP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [NETDIS-SSDPSrv-In-UDP-Active] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [WMI-ASYNC-In-TCP] => (Block) %systemroot%\system32\wbem\unsecapp.exe FirewallRules: [WMI-WINMGMT-Out-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [WMI-WINMGMT-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [WMI-RPCSS-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [WMI-ASYNC-In-TCP-NoScope] => (Block) %systemroot%\system32\wbem\unsecapp.exe FirewallRules: [WMI-WINMGMT-Out-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [WMI-WINMGMT-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [WMI-RPCSS-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MsiScsi-Out-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MsiScsi-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MsiScsi-Out-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MsiScsi-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [PerfLogsAlerts-DCOM-In-TCP-NoScope] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [PerfLogsAlerts-PLASrv-In-TCP-NoScope] => (Block) %systemroot%\system32\plasrv.exe FirewallRules: [PerfLogsAlerts-DCOM-In-TCP] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [PerfLogsAlerts-PLASrv-In-TCP] => (Block) %systemroot%\system32\plasrv.exe FirewallRules: [CoreNet-GP-LSASS-Out-TCP] => (Block) %SystemRoot%\system32\lsass.exe FirewallRules: [CoreNet-DNS-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [CoreNet-GP-Out-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [CoreNet-IPHTTPS-Out] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [CoreNet-Teredo-Out] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [CoreNet-Teredo-In] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [CoreNet-DHCPV6-Out] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [CoreNet-DHCPV6-In] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [CoreNet-DHCP-Out] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [CoreNet-DHCP-In] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [FPS-LLMNR-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [FPS-LLMNR-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [FPS-SpoolSvc-In-TCP] => (Block) %SystemRoot%\system32\spoolsv.exe FirewallRules: [FPS-SpoolSvc-In-TCP-NoScope] => (Block) %SystemRoot%\system32\spoolsv.exe FirewallRules: [Collab-PNRP-SSDPSrv-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [Collab-PNRP-SSDPSrv-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [Collab-PNRP-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [Collab-PNRP-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [Collab-P2PHost-WSD-Out-UDP] => (Block) %SystemRoot%\system32\p2phost.exe FirewallRules: [Collab-P2PHost-WSD-In-UDP] => (Block) %SystemRoot%\system32\p2phost.exe FirewallRules: [Collab-P2PHost-Out-TCP] => (Block) %SystemRoot%\system32\p2phost.exe FirewallRules: [Collab-P2PHost-In-TCP] => (Block) %SystemRoot%\system32\p2phost.exe FirewallRules: [RVM-RPCSS-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RVM-VDSLDR-In-TCP] => (Block) %SystemRoot%\system32\vdsldr.exe FirewallRules: [RVM-VDS-In-TCP] => (Block) %SystemRoot%\system32\vds.exe FirewallRules: [RVM-RPCSS-In-TCP-NoScope] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [RVM-VDSLDR-In-TCP-NoScope] => (Block) %SystemRoot%\system32\vdsldr.exe FirewallRules: [RVM-VDS-In-TCP-NoScope] => (Block) %SystemRoot%\system32\vds.exe FirewallRules: [PNRPMNRS-SSDPSrv-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [PNRPMNRS-SSDPSrv-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [PNRPMNRS-PNRP-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [PNRPMNRS-PNRP-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [Microsoft-Windows-HomeGroup-ProvSvc-UDP3540-Out] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [Microsoft-Windows-HomeGroup-ProvSvc-UDP3540-In] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [Microsoft-Windows-HomeGroup-ProvSvc-TCP3587-Out] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [Microsoft-Windows-HomeGroup-ProvSvc-TCP3587-In] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [SNMPTRAP-In-UDP-NoScope] => (Block) %SystemRoot%\system32\snmptrap.exe FirewallRules: [SNMPTRAP-In-UDP] => (Block) %SystemRoot%\system32\snmptrap.exe FirewallRules: [NetPres-In-TCP-NoScope] => (Block) %SystemRoot%\system32\netproj.exe FirewallRules: [NetPres-Out-TCP-NoScope] => (Block) %SystemRoot%\system32\netproj.exe FirewallRules: [NetPres-WSD-In-UDP] => (Block) %SystemRoot%\system32\netproj.exe FirewallRules: [NetPres-WSD-Out-UDP] => (Block) %SystemRoot%\system32\netproj.exe FirewallRules: [NetPres-In-TCP] => (Block) %SystemRoot%\system32\netproj.exe FirewallRules: [NetPres-Out-TCP] => (Block) %SystemRoot%\system32\netproj.exe FirewallRules: [WPDMTP-Out-TCP-NoScope] => (Block) %SystemRoot%\system32\wudfhost.exe FirewallRules: [WPDMTP-Out-TCP] => (Block) %SystemRoot%\system32\wudfhost.exe FirewallRules: [WPDMTP-SSDPSrv-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [WPDMTP-SSDPSrv-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [WPDMTP-UPnPHost-Out-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [WPDMTP-UPnP-Out-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MCX-SSDPSrv-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MCX-SSDPSrv-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MCX-In-TCP] => (Block) %SystemRoot%\ehome\ehshell.exe FirewallRules: [MCX-Out-TCP] => (Block) %SystemRoot%\ehome\ehshell.exe FirewallRules: [MCX-QWave-In-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MCX-QWave-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MCX-QWave-In-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MCX-QWave-Out-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MCX-In-UDP] => (Block) %SystemRoot%\ehome\ehshell.exe FirewallRules: [MCX-Out-UDP] => (Block) %SystemRoot%\ehome\ehshell.exe FirewallRules: [MCX-MCX2SVC-Out-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MCX-Prov-Out-TCP] => (Block) %SystemRoot%\ehome\mcx2prov.exe FirewallRules: [MCX-PlayTo-Out-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MCX-McrMgr-Out-TCP] => (Block) %SystemRoot%\ehome\mcrmgr.exe FirewallRules: [MCX-PlayTo-Out-UDP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [MCX-FDPHost-Out-TCP] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{D009437C-A899-4916-8427-FC02D5ACFAEC}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{F0E42CAB-8E5D-4F9E-8EAF-318EEC41163D}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{353EF302-3460-4872-B5D5-D40F4A7A8626}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{18D07A1E-8F20-4050-9B3E-7737974A37C0}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{6EBCB813-3254-4954-8EC5-53A6CA665A98}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{0C2970DD-DD6B-4185-B44F-40B036ADCDC3}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{F8846B28-66C6-464D-B1F2-9DF617E244F5}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{86482E4C-FF33-47AC-9227-E4D7B019C674}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{E09F5DAD-D46D-4584-AEAB-37859EE7B1B1}] => (Block) %SystemRoot%\system32\msra.exe FirewallRules: [{CC374A1F-73EE-4D84-B5FC-33F6695C6A89}] => (Block) %SystemRoot%\system32\msra.exe FirewallRules: [{30DB4DA6-71EE-460F-B319-37E68B26617F}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{52438994-D7DF-4DF9-BDBB-AF6067EA689A}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{113ADA0F-4DBE-4206-AA98-5BC518F3B9D8}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{466E16F7-089B-47C4-9F82-A00BF56B3A29}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{84C9419F-C173-4704-B255-42435940D35B}] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [{2720677C-A5C2-449C-8F30-580386219EFE}] => (Block) %systemroot%\system32\svchost.exe FirewallRules: [{2DE72720-AD9B-4AE3-9B8D-3B11AF812E2C}] => (Block) %SystemRoot%\system32\svchost.exe FirewallRules: [{3AEDBC17-99A4-4F5B-B932-6EC059D40411}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe FirewallRules: [{D8361DE2-B600-4C5D-B4C1-27A953CEC858}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe ==================== Restore Points ========================= 25-01-2016 02:23:27 Installed Apple Software Update 25-01-2016 02:28:24 Installed Boot Camp Services 25-01-2016 02:36:54 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 25-01-2016 11:22:50 ib 25-01-2016 11:25:14 Windows Modules Installer 25-01-2016 11:29:12 Windows Modules Installer 25-01-2016 14:40:14 Windows Update 25-01-2016 14:44:28 Windows Modules Installer 25-01-2016 15:07:11 Installing COMODO Internet Security Premium 25-01-2016 15:07:23 Device Driver Package Install: COMODO Network Service 25-01-2016 15:35:40 Comodo 25-01-2016 15:46:27 Comodo 25-01-2016 17:47:14 Installed Microsoft Office Ultimate 2007 25-01-2016 19:51:10 COMODO Support Agent Restore Point 25-01-2016 20:35:41 Device Driver Package Install: TAP-Win32 Provider V9 Network adapters 25-01-2016 21:34:13 Windows Update 25-01-2016 23:32:09 Windows Update ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (01/27/2016 01:29:49 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/25/2016 11:06:08 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/25/2016 10:41:59 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/25/2016 10:37:13 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: daemonu.exe, version: 1.15.2.0, time stamp: 0x52b9e1ba Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x74567374 Faulting process id: 0x112c Faulting application start time: 0xdaemonu.exe0 Faulting application path: daemonu.exe1 Faulting module path: daemonu.exe2 Report Id: daemonu.exe3 Error: (01/25/2016 10:37:12 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: LMS.exe, version: 9.5.0.1428, time stamp: 0x51436232 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x74567374 Faulting process id: 0x1098 Faulting application start time: 0xLMS.exe0 Faulting application path: LMS.exe1 Faulting module path: LMS.exe2 Report Id: LMS.exe3 Error: (01/25/2016 10:37:11 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: GeekBuddyRSP.exe, version: 2.7.10.0, time stamp: 0x521ef20c Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x74567374 Faulting process id: 0x4b0 Faulting application start time: 0xGeekBuddyRSP.exe0 Faulting application path: GeekBuddyRSP.exe1 Faulting module path: GeekBuddyRSP.exe2 Report Id: GeekBuddyRSP.exe3 Error: (01/25/2016 10:37:10 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: chromodo_updater.exe, version: 1.0.0.1, time stamp: 0x5666cc96 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x74567374 Faulting process id: 0x7a4 Faulting application start time: 0xchromodo_updater.exe0 Faulting application path: chromodo_updater.exe1 Faulting module path: chromodo_updater.exe2 Report Id: chromodo_updater.exe3 Error: (01/25/2016 10:37:09 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: nvSCPAPISvr.exe, version: 7.17.13.3228, time stamp: 0x52b9fa3d Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x74567374 Faulting process id: 0x3c8 Faulting application start time: 0xnvSCPAPISvr.exe0 Faulting application path: nvSCPAPISvr.exe1 Faulting module path: nvSCPAPISvr.exe2 Report Id: nvSCPAPISvr.exe3 Error: (01/25/2016 10:06:09 PM) (Source: PerfNet) (EventID: 2006) (User: ) Description: Error: (01/25/2016 10:00:09 PM) (Source: PerfNet) (EventID: 2006) (User: ) Description: System errors: ============= Error: (01/27/2016 01:28:07 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1058 Error: (01/27/2016 01:28:07 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1058 Error: (01/27/2016 01:28:07 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1058 Error: (01/27/2016 01:28:04 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1058 Error: (01/27/2016 01:28:04 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1058 Error: (01/27/2016 01:28:03 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1058 Error: (01/27/2016 01:28:03 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1058 Error: (01/27/2016 01:28:03 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1058 Error: (01/27/2016 01:28:03 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1058 Error: (01/27/2016 01:28:03 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1058 ==================== Memory info =========================== Processor: Intel(R) Core(TM) i7-3720QM CPU @ 2.60GHz Percentage of memory in use: 40% Total physical RAM: 8130.7 MB Available physical RAM: 4831.25 MB Total Virtual: 16259.6 MB Available Virtual: 12620.95 MB ==================== Drives ================================ Drive c: (BOOTCAMP) (Fixed) (Total:391.15 GB) (Free:352.71 GB) NTFS ==>[drive with boot components (obtained from BCD)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 476.9 GB) (Disk ID: 657ABA87) Partition: GPT. Partition 2: (Not Active) - (Size=85 GB) - (Type=AC) Partition 3: (Not Active) - (Size=620 MB) - (Type=AB) Partition 4: (Active) - (Size=391.2 GB) - (Type=07 NTFS) ==================== End of Addition.txt ============================