Jump to content

Malwarebytes can't find my virus, what to do?


Recommended Posts

Hello,

 

First time posting here, hope I do this right. I have only had this computer for about a month, and already have a virus. Whatever I have is causing new-tab pop-ups and unwanted in-screen advertisements. There are also many of the "You must download X to continue" boxes that try to trick you into clicking them.

 

I have attempted to uninstall malware from my system. I saw both "V9 Uninstaller" and "IdleCrawler" in my applications. When I try to uninstall either of them, I am given the error message "An error occurred when trying to uninstall X. It may have already been uninstalled." I'm not sure if they are ACTUALLY uninstalled, or if this is a way the virus protects itself. I have tried uninstalling them in safe mode and regular mode, with the same result.

 

I have run dozens of scans with both malewarebytes and avast in regular and safe mode. Most times, the programs find a file or two to quarantine. However, with each new scan, another PUP shows up, so I know I'm not hitting the root of the problem.

 

Finally, I have reset all of my browsers to default settings multiple times, and uninstalled + reinstalled my primary browser (chrome) once.

 

Below are my logs, I hope someone can help! I'm a recent apple convert, so I don't have a ton of experience dealing with viruses :(

 

If you need any more information please let me know.

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-05-2014
Ran by maxfr_000 (administrator) on LENOVO-PC on 23-05-2014 11:03:31
Running from C:\Users\maxfr_000\Downloads
Platform: Windows 8.1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal
 
The only official download link for FRST:
Download link from any site other than Bleeping Computer is unpermitted or outdated.
 
==================== Processes (Whitelisted) =================
 
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Condusiv Technologies) C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDIntelligent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek semiconductor) C:\Windows\RTFTrack.exe
(Lenovo) C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Pokki) C:\Users\maxfr_000\AppData\Local\Pokki\Engine\StartMenuIndexer.exe
() C:\Windows\SysWOW64\UMonit64.exe
(Pokki) C:\Users\maxfr_000\AppData\Local\Pokki\Engine\HostAppService.exe
(Pokki) C:\Users\maxfr_000\AppData\Local\Pokki\Engine\HostAppService.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\ismagent.exe
() C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\updateui.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Reach\LenovoReach.exe
(The Privoxy team - www.privoxy.org) C:\Program Files (x86)\MSR\Privoxy\privoxy.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\EXCEL.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-27] (NVIDIA Corporation)
HKLM\...\Run: [iAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13648600 2013-08-29] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-30] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2894664 2013-08-13] (ELAN Microelectronics Corp.)
HKLM\...\Run: [bTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [7830328 2013-05-21] (Motorola Solutions, Inc.)
HKLM\...\Run: [RtsFT] => C:\windows\RTFTrack.exe [6340312 2013-10-17] (Realtek semiconductor)
HKLM\...\Run: [OnekeyStudio] => C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe [4196432 2012-09-14] (Lenovo)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17111056 2014-03-25] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [193008 2014-03-25] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [updateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3873704 2014-05-19] (AVAST Software)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-207404653-2777702700-3025062220-1002\...\Run: [Pokki] => C:\windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform
AppInit_DLLs: C:\windows\system32\nvinitx.dll => C:\windows\system32\nvinitx.dll [184048 2013-10-04] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\windows\SysWOW64\nvinit.dll => C:\windows\SysWOW64\nvinit.dll [156256 2013-10-04] (NVIDIA Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8118;https=127.0.0.1:8118
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {F5818767-0522-4381-999C-0BEB67D34CEB} URL = http://www.bing.com/search?q={searchTerms}&form=IE11TR&src=IE11TR&pc=LCJB
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {F5818767-0522-4381-999C-0BEB67D34CEB} URL = http://www.bing.com/search?q={searchTerms}&form=IE11TR&src=IE11TR&pc=LCJB
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.3.25
 
FireFox:
========
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
Chrome: 
=======
CHR HomePage: hxxp://www.v9.com/?type=hp&ts=1400533665&from=irs&uid=LITEONITXLSS-24L6G_S0C41176Z1ZSDW041900&i=psd&t=342c87a4d
CHR StartupUrls: "hxxp://www.v9.com/?type=hp&ts=1400533665&from=irs&uid=LITEONITXLSS-24L6G_S0C41176Z1ZSDW041900&i=psd&t=342c87a4d"
CHR Extension: (Google Docs) - C:\Users\maxfr_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-19]
CHR Extension: (Google Drive) - C:\Users\maxfr_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-19]
CHR Extension: (YouTube) - C:\Users\maxfr_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-19]
CHR Extension: (Google Search) - C:\Users\maxfr_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-19]
CHR Extension: (avast! Online Security) - C:\Users\maxfr_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-05-19]
CHR Extension: (Google Wallet) - C:\Users\maxfr_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-19]
CHR Extension: (Gmail) - C:\Users\maxfr_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-19]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-05-19]
 
==================== Services (Whitelisted) =================
 
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-19] (AVAST Software)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2211000 2014-03-30] (Microsoft Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [92160 2013-07-28] (ELAN Microelectronics Corp.)
R2 ExpressCache; C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe [107944 2013-01-08] (Condusiv Technologies)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel® Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-08-08] (Intel Corporation)
R2 Intel® Wireless Bluetooth® 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [155448 2013-09-23] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-08-08] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-08-23] ()
R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-08-17] (Nitro PDF Software)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 SystemUpdatekb70007; C:\windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe [18944 2014-05-08] ()
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-03-25] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-30] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3667696 2013-08-23] (Intel® Corporation)
 
==================== Drivers (Whitelisted) ====================
 
S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-19] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-19] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-19] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-19] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-19] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-19] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-19] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-19] ()
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-12] (Windows ® Win 7 DDK provider)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [224768 2013-08-22] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132920 2013-04-23] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1386296 2013-08-19] (Motorola Solutions, Inc.)
R3 ETDSMBus; C:\Windows\system32\DRIVERS\ETDSMBus.sys [22280 2013-08-04] (ELAN Microelectronic Corp.)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [26024 2013-01-08] (Condusiv Technologies)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [112552 2013-01-08] (Condusiv Technologies)
U5 GeneStor; C:\Windows\System32\Drivers\GeneStor.sys [105704 2013-08-15] (GenesysLogic)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-09] (Intel Corporation)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [118216 2013-09-23] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-10] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-23] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-08-08] (Intel Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3589600 2013-09-25] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8876248 2013-10-17] (Realtek Semiconductor Corp.)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-25] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-30] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2014-05-23 11:03 - 2014-05-23 11:03 - 00020013 _____ () C:\Users\maxfr_000\Downloads\FRST.txt
2014-05-23 11:03 - 2014-05-23 11:03 - 00000000 ____D () C:\FRST
2014-05-23 11:02 - 2014-05-23 11:02 - 02067456 _____ (Farbar) C:\Users\maxfr_000\Downloads\FRST64.exe
2014-05-22 17:56 - 2014-05-22 17:56 - 00000000 ___SH () C:\DkHyperbootSync
2014-05-22 11:32 - 2014-05-22 11:32 - 00000000 ____D () C:\windows\pss
2014-05-21 09:07 - 2014-05-21 09:07 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-21 09:07 - 2014-05-21 09:07 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-19 21:05 - 2014-05-22 13:22 - 00002235 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-05-19 21:05 - 2014-05-19 21:05 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\AVAST Software
2014-05-19 21:05 - 2014-05-19 21:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-05-19 21:04 - 2014-05-19 21:05 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update
2014-05-19 21:04 - 2014-05-19 21:04 - 01039096 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys.1400555096109
2014-05-19 21:04 - 2014-05-19 21:04 - 01039096 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00423240 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys.1400555096109
2014-05-19 21:04 - 2014-05-19 21:04 - 00423240 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00334648 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2014-05-19 21:04 - 2014-05-19 21:04 - 00208416 _____ () C:\windows\system32\Drivers\aswVmm.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00093568 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00085328 _____ (AVAST Software) C:\windows\system32\Drivers\aswstm.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00079184 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00065776 _____ () C:\windows\system32\Drivers\aswRvrt.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr
2014-05-19 21:04 - 2014-05-19 21:04 - 00029208 _____ () C:\windows\system32\Drivers\aswHwid.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00000000 ____D () C:\Program Files\AVAST Software
2014-05-19 20:57 - 2014-05-19 20:58 - 88882192 _____ (AVAST Software) C:\Users\maxfr_000\Downloads\avast_free_antivirus_setup (2).exe
2014-05-19 20:55 - 2014-05-19 20:57 - 88882192 _____ (AVAST Software) C:\Users\maxfr_000\Downloads\avast_free_antivirus_setup (1).exe
2014-05-19 20:54 - 2014-05-19 20:54 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-05-19 20:31 - 2014-05-19 20:32 - 88882192 _____ (AVAST Software) C:\Users\Public\Desktop\avast_free_antivirus_setup.exe
2014-05-19 20:31 - 2014-05-19 20:32 - 88882192 _____ (AVAST Software) C:\Users\maxfr_000\Downloads\avast_free_antivirus_setup.exe
2014-05-19 20:23 - 2014-05-23 10:19 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-19 20:23 - 2014-05-19 20:23 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-19 20:23 - 2014-05-19 20:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-19 20:23 - 2014-05-19 20:23 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-19 20:23 - 2014-05-19 20:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-19 20:23 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-05-19 20:23 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-05-19 20:23 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-05-19 20:21 - 2014-05-19 20:22 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\maxfr_000\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-19 20:11 - 2014-05-22 20:15 - 00002214 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-19 20:11 - 2014-05-19 20:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-19 20:10 - 2014-05-23 01:15 - 00000924 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-19 20:10 - 2014-05-22 20:15 - 00000920 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-19 20:10 - 2014-05-19 20:10 - 00003896 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-19 16:24 - 2014-05-19 20:10 - 00003660 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-19 15:17 - 2014-05-19 15:25 - 00000000 ____D () C:\Users\maxfr_000\Downloads\Nothing More - Nothing More (self titled)
2014-05-19 15:14 - 2014-05-21 09:36 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\uTorrent
2014-05-19 15:14 - 2014-05-19 15:14 - 01669456 _____ (BitTorrent Inc.) C:\Users\maxfr_000\Downloads\uTorrent.exe
2014-05-19 15:08 - 2014-05-19 22:18 - 00000000 ____D () C:\Users\maxfr_000\AppData\Local\IdleCrawler
2014-05-19 15:08 - 2014-05-19 20:40 - 00000000 ____D () C:\ProgramData\WPM
2014-05-19 15:08 - 2014-05-19 16:22 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\SupTab
2014-05-19 15:08 - 2014-05-19 15:08 - 00004584 _____ () C:\windows\System32\Tasks\IdleCrawler Runner
2014-05-19 15:08 - 2014-05-19 15:08 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\v9
2014-05-19 15:07 - 2014-05-19 15:08 - 00000000 ____D () C:\Program Files (x86)\MSR
2014-05-19 15:07 - 2014-05-19 15:07 - 00003256 _____ () C:\windows\System32\Tasks\GPUpdate
2014-05-19 15:07 - 2014-05-19 15:07 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-05-19 15:07 - 2014-05-19 15:07 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\Wise
2014-05-19 15:07 - 2014-05-19 15:07 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\GetPrivate
2014-05-19 14:03 - 2014-05-19 14:03 - 00013458 _____ () C:\Users\maxfr_000\Documents\5.19 Calls for Brian.xlsx
2014-05-17 18:12 - 2014-05-17 18:12 - 09033560 _____ () C:\Users\maxfr_000\Downloads\05-17-14 Trivia Set.pptx
2014-05-16 10:43 - 2014-05-16 10:43 - 00723731 _____ () C:\Users\maxfr_000\Downloads\image (1) (1).jpeg
2014-05-16 10:40 - 2014-05-16 10:40 - 00723731 _____ () C:\Users\maxfr_000\Downloads\image (1).jpeg
2014-05-16 10:31 - 2014-05-19 17:39 - 00092060 _____ () C:\Users\maxfr_000\Desktop\TIAC Attendance.pptx
2014-05-15 14:26 - 2014-05-15 14:26 - 00109133 _____ () C:\Users\maxfr_000\Downloads\index.cfm
2014-05-15 08:50 - 2014-05-15 08:50 - 00723731 _____ () C:\Users\maxfr_000\Downloads\image.jpeg
2014-05-14 23:17 - 2014-05-08 01:14 - 23134208 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-14 23:17 - 2014-05-07 23:52 - 17073152 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-14 23:17 - 2014-05-07 22:57 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-14 23:17 - 2014-05-07 22:04 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-14 21:44 - 2014-04-19 05:15 - 21186352 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2014-05-14 21:44 - 2014-04-19 00:49 - 18644072 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2014-05-13 19:48 - 2014-05-13 19:48 - 00026624 ___SH () C:\Users\maxfr_000\Documents\Thumbs.db
2014-05-13 17:09 - 2014-05-13 17:41 - 2149153342 _____ () C:\Users\maxfr_000\Downloads\documents-export-2014-05-13 (1).zip
2014-05-13 16:19 - 2014-05-13 16:19 - 06078123 _____ () C:\Users\maxfr_000\Documents\05-10-14 Tilted Kilt Trivia Set.pptx
2014-05-13 16:15 - 2014-05-13 16:15 - 08684496 _____ () C:\Users\maxfr_000\Downloads\04-26-14 Trivia Set (Tilted Kilt).pptx
2014-05-13 15:32 - 2014-05-13 15:32 - 10297452 _____ () C:\Users\maxfr_000\Downloads\documents-export-2014-05-13.zip
2014-05-12 22:24 - 2014-05-12 22:24 - 09108992 _____ () C:\Users\maxfr_000\Desktop\05-10-14 Trivia Set Alicia.ppt
2014-05-12 21:01 - 2014-05-12 21:01 - 08460346 _____ () C:\Users\maxfr_000\Downloads\05-10-14 Trivia Set.pptx
2014-05-10 15:31 - 2014-05-10 15:37 - 379766721 _____ () C:\Users\maxfr_000\Downloads\Intuit.QuickBooks.2009.Premier.rar
2014-05-09 14:28 - 2014-05-09 14:30 - 00000000 ____D () C:\Users\maxfr_000\Desktop\Backgrounds
2014-05-06 17:31 - 2014-05-06 17:32 - 17766912 _____ () C:\Users\maxfr_000\Desktop\05-03-14 Trivia Set Alicia.ppt
2014-05-06 15:17 - 2014-05-06 15:18 - 17089809 _____ () C:\Users\maxfr_000\Downloads\05-03-14 Trivia Set.pptx
2014-04-30 16:45 - 2014-04-30 16:45 - 09329152 _____ () C:\Users\maxfr_000\Desktop\04-26-14 Trivia Set Will.ppt
2014-04-30 10:10 - 2014-04-30 10:10 - 06517624 _____ () C:\Users\maxfr_000\Downloads\This is a Clue LLC v4 (1).qbb
2014-04-30 10:04 - 2014-04-30 10:04 - 06517624 _____ () C:\Users\maxfr_000\Downloads\This is a Clue LLC v4.qbb
2014-04-29 12:19 - 2014-04-30 10:04 - 00125598 _____ () C:\Users\maxfr_000\Desktop\Financial Analysis v2.xlsx
2014-04-29 11:48 - 2014-04-29 11:48 - 00125485 _____ () C:\Users\maxfr_000\Downloads\Financial Analysis MF-Edits.xlsx
2014-04-29 11:38 - 2014-04-29 11:39 - 08658797 _____ () C:\Users\maxfr_000\Downloads\04-26-14 Trivia Set.pptx
2014-04-28 18:38 - 2014-04-28 18:38 - 00133076 _____ () C:\Users\maxfr_000\Downloads\Financial Analysis MF Edits v2 (1)
2014-04-28 16:42 - 2014-04-28 16:42 - 00133076 _____ () C:\Users\maxfr_000\Downloads\Financial Analysis MF Edits v2
2014-04-28 15:02 - 2014-05-19 20:11 - 00193024 ___SH () C:\Users\maxfr_000\Desktop\Thumbs.db
2014-04-28 14:09 - 2014-04-28 14:09 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\Nitro
2014-04-28 14:09 - 2014-04-28 14:09 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\FileOpen
2014-04-28 14:09 - 2014-04-28 14:09 - 00000000 ____D () C:\ProgramData\FileOpen
2014-04-28 14:08 - 2014-05-22 21:21 - 00000000 ____D () C:\Users\maxfr_000\Desktop\April Invoices
2014-04-26 16:57 - 2014-04-26 16:57 - 00000000 ____D () C:\windows\Minidump
2014-04-25 22:05 - 2014-05-22 21:15 - 00000854 _____ () C:\Users\maxfr_000\AppData\Local\7396d5af-93b3-4d36-bfec-04bbd1449761.dat
2014-04-25 22:05 - 2014-05-22 21:15 - 00000000 ____D () C:\Users\maxfr_000\AppData\Local\cache
2014-04-25 17:41 - 2014-05-21 18:17 - 00147456 ___SH () C:\Users\maxfr_000\Downloads\Thumbs.db
2014-04-25 11:06 - 2014-05-19 17:38 - 00136704 _____ () C:\Users\maxfr_000\Desktop\Trivia Attendance.xls
2014-04-25 08:11 - 2014-04-28 10:14 - 00000000 ____D () C:\Users\maxfr_000\Documents\NCSOFT
2014-04-24 14:01 - 2014-05-15 10:27 - 00000000 ____D () C:\Users\maxfr_000\Desktop\Purchase Orders
2014-04-24 13:40 - 2014-05-14 09:47 - 00000000 ____D () C:\Users\maxfr_000\Desktop\New Hire
2014-04-24 13:39 - 2014-04-24 13:39 - 00816822 _____ () C:\Users\maxfr_000\Downloads\computerswap.zip
2014-04-23 20:44 - 2014-04-23 20:44 - 00003106 _____ () C:\windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-207404653-2777702700-3025062220-1002
2014-04-23 20:44 - 2014-04-23 20:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-04-23 20:43 - 2014-04-23 20:43 - 00962744 _____ (Microsoft Corporation) C:\Users\maxfr_000\Downloads\Setup.x86.en-US_HomeStudentRetail_TKPHB-8NHJK-M6P78-TYMPR-QGJ9Q_TX_PR_.exe
2014-04-23 20:33 - 2014-05-22 16:34 - 00004994 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for LENOVO-PC-maxfr_000 Lenovo-PC
2014-04-23 16:30 - 2014-04-23 16:30 - 00011426 _____ () C:\Users\maxfr_000\Downloads\4.17.2014 BWW - Superior Install.xlsx
2014-04-23 16:10 - 2014-05-07 13:12 - 00020765 _____ () C:\Users\maxfr_000\Downloads\Trivia Hosts 2014_3 (1).xlsx
2014-04-23 16:09 - 2014-04-23 16:09 - 00020666 _____ () C:\Users\maxfr_000\Downloads\Trivia Hosts 2014_3.xlsx
2014-04-23 15:45 - 2014-04-23 15:45 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-04-23 15:28 - 2014-04-23 15:30 - 00000982 _____ () C:\Users\maxfr_000\Desktop\Wildstar Dx9.lnk
2014-04-23 11:14 - 2014-05-22 14:28 - 00002174 _____ () C:\Users\maxfr_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk
2014-04-23 10:50 - 2014-04-23 10:50 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2014-04-23 08:13 - 2014-04-28 10:14 - 00000000 ____D () C:\Program Files (x86)\NCSOFT
2014-04-23 08:12 - 2014-04-28 10:14 - 00000000 ____D () C:\Users\maxfr_000\AppData\Local\NCSOFT
2014-04-23 08:12 - 2014-04-23 08:12 - 05354968 _____ (NCSOFT) C:\Users\maxfr_000\Downloads\Wildstar.exe
2014-04-23 08:12 - 2014-04-23 08:12 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\NCSOFT
 
==================== One Month Modified Files and Folders =======
 
2014-05-23 11:03 - 2014-05-23 11:03 - 00020013 _____ () C:\Users\maxfr_000\Downloads\FRST.txt
2014-05-23 11:03 - 2014-05-23 11:03 - 00000000 ____D () C:\FRST
2014-05-23 11:02 - 2014-05-23 11:02 - 02067456 _____ (Farbar) C:\Users\maxfr_000\Downloads\FRST64.exe
2014-05-23 11:00 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\system32\sru
2014-05-23 10:57 - 2014-04-21 13:26 - 00000000 ____D () C:\Users\maxfr_000\AppData\Local\Pokki
2014-05-23 10:19 - 2014-05-19 20:23 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-23 01:15 - 2014-05-19 20:10 - 00000924 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-23 00:51 - 2013-10-07 12:27 - 00865408 _____ () C:\windows\system32\PerfStringBackup.INI
2014-05-22 21:52 - 2014-04-21 20:43 - 00000000 ____D () C:\Users\maxfr_000\AppData\Local\PMB Files
2014-05-22 21:21 - 2014-04-28 14:08 - 00000000 ____D () C:\Users\maxfr_000\Desktop\April Invoices
2014-05-22 21:16 - 2014-04-21 13:26 - 00000000 ____D () C:\Users\maxfr_000
2014-05-22 21:15 - 2014-04-25 22:05 - 00000854 _____ () C:\Users\maxfr_000\AppData\Local\7396d5af-93b3-4d36-bfec-04bbd1449761.dat
2014-05-22 21:15 - 2014-04-25 22:05 - 00000000 ____D () C:\Users\maxfr_000\AppData\Local\cache
2014-05-22 20:55 - 2014-04-21 13:33 - 00003946 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{3BB6AE4A-6EEC-4A5B-9F66-28B4C286DC89}
2014-05-22 20:43 - 2014-04-21 13:35 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-207404653-2777702700-3025062220-1002
2014-05-22 20:15 - 2014-05-19 20:11 - 00002214 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-22 20:15 - 2014-05-19 20:10 - 00000920 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-22 17:56 - 2014-05-22 17:56 - 00000000 ___SH () C:\DkHyperbootSync
2014-05-22 16:34 - 2014-04-23 20:33 - 00004994 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for LENOVO-PC-maxfr_000 Lenovo-PC
2014-05-22 14:28 - 2014-04-23 11:14 - 00002174 _____ () C:\Users\maxfr_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk
2014-05-22 14:27 - 2014-04-21 13:30 - 00000000 __RDO () C:\Users\maxfr_000\SkyDrive
2014-05-22 14:16 - 2013-08-22 08:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-05-22 13:22 - 2014-05-19 21:05 - 00002235 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-05-22 13:11 - 2014-03-25 22:27 - 00002560 _____ () C:\windows\system32\VfService.trf
2014-05-22 12:21 - 2014-03-25 22:20 - 00000000 ____D () C:\ProgramData\McAfee
2014-05-22 12:21 - 2014-03-25 21:44 - 01906388 _____ () C:\windows\WindowsUpdate.log
2014-05-22 12:21 - 2013-10-07 12:23 - 00036546 _____ () C:\windows\PFRO.log
2014-05-22 12:20 - 2014-04-21 20:43 - 00000000 ____D () C:\ProgramData\PMB Files
2014-05-22 12:02 - 2013-08-22 09:36 - 00000000 ___HD () C:\windows\ELAMBKUP
2014-05-22 11:33 - 2013-08-22 07:25 - 00262144 ___SH () C:\windows\system32\config\BBI
2014-05-22 11:32 - 2014-05-22 11:32 - 00000000 ____D () C:\windows\pss
2014-05-22 09:40 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\LiveKernelReports
2014-05-21 18:17 - 2014-04-25 17:41 - 00147456 ___SH () C:\Users\maxfr_000\Downloads\Thumbs.db
2014-05-21 11:04 - 2014-04-21 13:27 - 00000000 ____D () C:\Users\maxfr_000\AppData\Local\Packages
2014-05-21 09:36 - 2014-05-19 15:14 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\uTorrent
2014-05-21 09:20 - 2014-04-21 16:56 - 00000000 ____D () C:\windows\system32\MRT
2014-05-21 09:19 - 2014-04-21 13:27 - 00000000 ___RD () C:\Users\maxfr_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-21 09:19 - 2014-04-21 13:27 - 00000000 ___RD () C:\Users\maxfr_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-21 09:17 - 2013-08-22 09:36 - 00000000 ___RD () C:\windows\ToastData
2014-05-21 09:08 - 2014-04-21 16:56 - 93223848 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-05-21 09:08 - 2013-08-22 07:25 - 00262144 ___SH () C:\windows\system32\config\ELAM
2014-05-21 09:07 - 2014-05-21 09:07 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-21 09:07 - 2014-05-21 09:07 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-21 09:07 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\system32\SecureBootUpdates
2014-05-21 09:07 - 2013-08-22 09:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-05-19 22:18 - 2014-05-19 15:08 - 00000000 ____D () C:\Users\maxfr_000\AppData\Local\IdleCrawler
2014-05-19 21:05 - 2014-05-19 21:05 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\AVAST Software
2014-05-19 21:05 - 2014-05-19 21:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-05-19 21:05 - 2014-05-19 21:04 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update
2014-05-19 21:04 - 2014-05-19 21:04 - 01039096 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys.1400555096109
2014-05-19 21:04 - 2014-05-19 21:04 - 01039096 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00423240 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys.1400555096109
2014-05-19 21:04 - 2014-05-19 21:04 - 00423240 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00334648 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2014-05-19 21:04 - 2014-05-19 21:04 - 00208416 _____ () C:\windows\system32\Drivers\aswVmm.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00093568 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00085328 _____ (AVAST Software) C:\windows\system32\Drivers\aswstm.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00079184 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00065776 _____ () C:\windows\system32\Drivers\aswRvrt.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr
2014-05-19 21:04 - 2014-05-19 21:04 - 00029208 _____ () C:\windows\system32\Drivers\aswHwid.sys
2014-05-19 21:04 - 2014-05-19 21:04 - 00000000 ____D () C:\Program Files\AVAST Software
2014-05-19 20:58 - 2014-05-19 20:57 - 88882192 _____ (AVAST Software) C:\Users\maxfr_000\Downloads\avast_free_antivirus_setup (2).exe
2014-05-19 20:57 - 2014-05-19 20:55 - 88882192 _____ (AVAST Software) C:\Users\maxfr_000\Downloads\avast_free_antivirus_setup (1).exe
2014-05-19 20:54 - 2014-05-19 20:54 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-05-19 20:40 - 2014-05-19 15:08 - 00000000 ____D () C:\ProgramData\WPM
2014-05-19 20:40 - 2013-08-22 13:12 - 00000000 ____D () C:\windows\ShellNew
2014-05-19 20:32 - 2014-05-19 20:31 - 88882192 _____ (AVAST Software) C:\Users\Public\Desktop\avast_free_antivirus_setup.exe
2014-05-19 20:32 - 2014-05-19 20:31 - 88882192 _____ (AVAST Software) C:\Users\maxfr_000\Downloads\avast_free_antivirus_setup.exe
2014-05-19 20:23 - 2014-05-19 20:23 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-19 20:23 - 2014-05-19 20:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-19 20:23 - 2014-05-19 20:23 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-19 20:23 - 2014-05-19 20:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-19 20:22 - 2014-05-19 20:21 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\maxfr_000\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-19 20:11 - 2014-05-19 20:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-19 20:11 - 2014-04-28 15:02 - 00193024 ___SH () C:\Users\maxfr_000\Desktop\Thumbs.db
2014-05-19 20:10 - 2014-05-19 20:10 - 00003896 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-19 20:10 - 2014-05-19 16:24 - 00003660 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-19 20:10 - 2014-04-21 14:12 - 00000000 ____D () C:\Users\maxfr_000\AppData\Local\Deployment
2014-05-19 20:10 - 2014-04-21 14:12 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-19 17:39 - 2014-05-16 10:31 - 00092060 _____ () C:\Users\maxfr_000\Desktop\TIAC Attendance.pptx
2014-05-19 17:38 - 2014-04-25 11:06 - 00136704 _____ () C:\Users\maxfr_000\Desktop\Trivia Attendance.xls
2014-05-19 16:22 - 2014-05-19 15:08 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\SupTab
2014-05-19 15:26 - 2013-08-22 08:46 - 00023421 _____ () C:\windows\setupact.log
2014-05-19 15:25 - 2014-05-19 15:17 - 00000000 ____D () C:\Users\maxfr_000\Downloads\Nothing More - Nothing More (self titled)
2014-05-19 15:14 - 2014-05-19 15:14 - 01669456 _____ (BitTorrent Inc.) C:\Users\maxfr_000\Downloads\uTorrent.exe
2014-05-19 15:08 - 2014-05-19 15:08 - 00004584 _____ () C:\windows\System32\Tasks\IdleCrawler Runner
2014-05-19 15:08 - 2014-05-19 15:08 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\v9
2014-05-19 15:08 - 2014-05-19 15:07 - 00000000 ____D () C:\Program Files (x86)\MSR
2014-05-19 15:07 - 2014-05-19 15:07 - 00003256 _____ () C:\windows\System32\Tasks\GPUpdate
2014-05-19 15:07 - 2014-05-19 15:07 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-05-19 15:07 - 2014-05-19 15:07 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\Wise
2014-05-19 15:07 - 2014-05-19 15:07 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\GetPrivate
2014-05-19 15:07 - 2014-04-21 13:27 - 00001689 _____ () C:\Users\maxfr_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-19 15:07 - 2013-08-22 09:36 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-05-19 15:07 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2014-05-19 14:03 - 2014-05-19 14:03 - 00013458 _____ () C:\Users\maxfr_000\Documents\5.19 Calls for Brian.xlsx
2014-05-17 18:12 - 2014-05-17 18:12 - 09033560 _____ () C:\Users\maxfr_000\Downloads\05-17-14 Trivia Set.pptx
2014-05-16 10:43 - 2014-05-16 10:43 - 00723731 _____ () C:\Users\maxfr_000\Downloads\image (1) (1).jpeg
2014-05-16 10:40 - 2014-05-16 10:40 - 00723731 _____ () C:\Users\maxfr_000\Downloads\image (1).jpeg
2014-05-15 14:26 - 2014-05-15 14:26 - 00109133 _____ () C:\Users\maxfr_000\Downloads\index.cfm
2014-05-15 10:27 - 2014-04-24 14:01 - 00000000 ____D () C:\Users\maxfr_000\Desktop\Purchase Orders
2014-05-15 08:50 - 2014-05-15 08:50 - 00723731 _____ () C:\Users\maxfr_000\Downloads\image.jpeg
2014-05-14 10:51 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\AppReadiness
2014-05-14 09:47 - 2014-04-24 13:40 - 00000000 ____D () C:\Users\maxfr_000\Desktop\New Hire
2014-05-14 07:58 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\system32\NDF
2014-05-13 19:48 - 2014-05-13 19:48 - 00026624 ___SH () C:\Users\maxfr_000\Documents\Thumbs.db
2014-05-13 17:41 - 2014-05-13 17:09 - 2149153342 _____ () C:\Users\maxfr_000\Downloads\documents-export-2014-05-13 (1).zip
2014-05-13 16:19 - 2014-05-13 16:19 - 06078123 _____ () C:\Users\maxfr_000\Documents\05-10-14 Tilted Kilt Trivia Set.pptx
2014-05-13 16:15 - 2014-05-13 16:15 - 08684496 _____ () C:\Users\maxfr_000\Downloads\04-26-14 Trivia Set (Tilted Kilt).pptx
2014-05-13 15:32 - 2014-05-13 15:32 - 10297452 _____ () C:\Users\maxfr_000\Downloads\documents-export-2014-05-13.zip
2014-05-12 22:24 - 2014-05-12 22:24 - 09108992 _____ () C:\Users\maxfr_000\Desktop\05-10-14 Trivia Set Alicia.ppt
2014-05-12 21:01 - 2014-05-12 21:01 - 08460346 _____ () C:\Users\maxfr_000\Downloads\05-10-14 Trivia Set.pptx
2014-05-10 15:37 - 2014-05-10 15:31 - 379766721 _____ () C:\Users\maxfr_000\Downloads\Intuit.QuickBooks.2009.Premier.rar
2014-05-09 14:30 - 2014-05-09 14:28 - 00000000 ____D () C:\Users\maxfr_000\Desktop\Backgrounds
2014-05-08 01:14 - 2014-05-14 23:17 - 23134208 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-07 23:52 - 2014-05-14 23:17 - 17073152 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-07 22:57 - 2014-05-14 23:17 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-07 22:04 - 2014-05-14 23:17 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-07 13:12 - 2014-04-23 16:10 - 00020765 _____ () C:\Users\maxfr_000\Downloads\Trivia Hosts 2014_3 (1).xlsx
2014-05-06 17:32 - 2014-05-06 17:31 - 17766912 _____ () C:\Users\maxfr_000\Desktop\05-03-14 Trivia Set Alicia.ppt
2014-05-06 15:18 - 2014-05-06 15:17 - 17089809 _____ () C:\Users\maxfr_000\Downloads\05-03-14 Trivia Set.pptx
2014-05-06 07:27 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\rescache
2014-05-01 14:30 - 2013-08-22 09:38 - 00693240 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-01 14:30 - 2013-08-22 09:38 - 00105464 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-30 16:45 - 2014-04-30 16:45 - 09329152 _____ () C:\Users\maxfr_000\Desktop\04-26-14 Trivia Set Will.ppt
2014-04-30 10:10 - 2014-04-30 10:10 - 06517624 _____ () C:\Users\maxfr_000\Downloads\This is a Clue LLC v4 (1).qbb
2014-04-30 10:04 - 2014-04-30 10:04 - 06517624 _____ () C:\Users\maxfr_000\Downloads\This is a Clue LLC v4.qbb
2014-04-30 10:04 - 2014-04-29 12:19 - 00125598 _____ () C:\Users\maxfr_000\Desktop\Financial Analysis v2.xlsx
2014-04-29 11:48 - 2014-04-29 11:48 - 00125485 _____ () C:\Users\maxfr_000\Downloads\Financial Analysis MF-Edits.xlsx
2014-04-29 11:39 - 2014-04-29 11:38 - 08658797 _____ () C:\Users\maxfr_000\Downloads\04-26-14 Trivia Set.pptx
2014-04-28 18:38 - 2014-04-28 18:38 - 00133076 _____ () C:\Users\maxfr_000\Downloads\Financial Analysis MF Edits v2 (1)
2014-04-28 16:42 - 2014-04-28 16:42 - 00133076 _____ () C:\Users\maxfr_000\Downloads\Financial Analysis MF Edits v2
2014-04-28 14:09 - 2014-04-28 14:09 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\Nitro
2014-04-28 14:09 - 2014-04-28 14:09 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\FileOpen
2014-04-28 14:09 - 2014-04-28 14:09 - 00000000 ____D () C:\ProgramData\FileOpen
2014-04-28 10:14 - 2014-04-25 08:11 - 00000000 ____D () C:\Users\maxfr_000\Documents\NCSOFT
2014-04-28 10:14 - 2014-04-23 08:13 - 00000000 ____D () C:\Program Files (x86)\NCSOFT
2014-04-28 10:14 - 2014-04-23 08:12 - 00000000 ____D () C:\Users\maxfr_000\AppData\Local\NCSOFT
2014-04-26 16:57 - 2014-04-26 16:57 - 00000000 ____D () C:\windows\Minidump
2014-04-26 16:57 - 2014-04-21 13:22 - 00154814 ____N () C:\windows\Minidump\042614-35750-01.dmp
2014-04-24 13:39 - 2014-04-24 13:39 - 00816822 _____ () C:\Users\maxfr_000\Downloads\computerswap.zip
2014-04-23 20:44 - 2014-04-23 20:44 - 00003106 _____ () C:\windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-207404653-2777702700-3025062220-1002
2014-04-23 20:44 - 2014-04-23 20:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-04-23 20:44 - 2014-04-21 15:05 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-04-23 20:43 - 2014-04-23 20:43 - 00962744 _____ (Microsoft Corporation) C:\Users\maxfr_000\Downloads\Setup.x86.en-US_HomeStudentRetail_TKPHB-8NHJK-M6P78-TYMPR-QGJ9Q_TX_PR_.exe
2014-04-23 16:30 - 2014-04-23 16:30 - 00011426 _____ () C:\Users\maxfr_000\Downloads\4.17.2014 BWW - Superior Install.xlsx
2014-04-23 16:09 - 2014-04-23 16:09 - 00020666 _____ () C:\Users\maxfr_000\Downloads\Trivia Hosts 2014_3.xlsx
2014-04-23 15:45 - 2014-04-23 15:45 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-04-23 15:30 - 2014-04-23 15:28 - 00000982 _____ () C:\Users\maxfr_000\Desktop\Wildstar Dx9.lnk
2014-04-23 11:15 - 2014-04-21 13:30 - 00002328 _____ () C:\Users\maxfr_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2014-04-23 11:06 - 2013-08-22 08:44 - 00484248 _____ () C:\windows\system32\FNTCACHE.DAT
2014-04-23 11:04 - 2013-08-22 09:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-04-23 11:04 - 2013-08-22 09:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-04-23 11:04 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\WinStore
2014-04-23 11:04 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\system32\migwiz
2014-04-23 11:04 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-04-23 11:04 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\MediaViewer
2014-04-23 11:04 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\FileManager
2014-04-23 11:04 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\Camera
2014-04-23 11:04 - 2013-08-22 09:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-04-23 11:04 - 2013-08-22 09:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-04-23 11:04 - 2013-08-22 07:36 - 00000000 ____D () C:\windows\SysWOW64\Dism
2014-04-23 11:04 - 2013-08-22 07:36 - 00000000 ____D () C:\windows\system32\Dism
2014-04-23 10:50 - 2014-04-23 10:50 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2014-04-23 08:12 - 2014-04-23 08:12 - 05354968 _____ (NCSOFT) C:\Users\maxfr_000\Downloads\Wildstar.exe
2014-04-23 08:12 - 2014-04-23 08:12 - 00000000 ____D () C:\Users\maxfr_000\AppData\Roaming\NCSOFT
 
Some content of TEMP:
====================
C:\Users\maxfr_000\AppData\Local\Temp\GPUpd.exe
C:\Users\maxfr_000\AppData\Local\Temp\oct1356.tmp.exe
C:\Users\maxfr_000\AppData\Local\Temp\OfficeSetup.exe
C:\Users\maxfr_000\AppData\Local\Temp\r53odqzu.1ad.exe
C:\Users\maxfr_000\AppData\Local\Temp\SetupO365HomePremRetail.x86.en-US_O365HomePremRetail_4RBNP-6MCTJ-WCX29-2Y3BB-PRY6J_act_1_.exe
C:\Users\maxfr_000\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\maxfr_000\AppData\Local\Temp\Wildstar.exe
 
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 
LastRegBack: 2014-05-17 10:26
 
==================== End Of Log ============================
 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-05-2014
Ran by maxfr_000 at 2014-05-23 11:03:52
Running from C:\Users\maxfr_000\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 
==================== Installed Programs ======================
 
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2018 - Avast Software)
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.4107 - CyberLink Corp.)
CyberLink PhotoDirector 3 (x32 Version: 3.0.1.4107 - CyberLink Corp.) Hidden
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 8.0.2.14 - Lenovo)
Energy Management (x32 Version: 8.0.2.14 - Lenovo) Hidden
ExpressCache (HKLM\...\{C123584F-9C84-45E8-AE5F-522328BB79A0}) (Version: 1.0.100.0 - Condusiv Technologies)
Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 4.3.0.8 - Genesys Logic)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
IdleCrawler (HKLM-x32\...\IdleCrawler) (Version: 35.0.0.84 - Internet Deep Research Foundation)
Intel® Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.20.1447 - Intel Corporation)
Intel® PRO/Wireless Driver (Version: 16.05.1000.0574 - Intel Corporation) Hidden
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3277 - Intel Corporation)
Intel® PROSet/Wireless Software for Bluetooth® Technology(patch version 3.0.1337.1) (HKLM\...\{302600C1-6BDF-4FD1-1307-148929CC1385}) (Version: 3.1.1307.0362 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Intel® Rapid Storage Technology (Version: 12.8.0.1016 - Intel Corporation) Hidden
Intel® PROSet/Wireless Software (HKLM-x32\...\{72814a2c-2e03-4a50-b30a-43e7884b3934}) (Version: 16.5.1 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 16.05.1000.0264 - Intel Corporation) Hidden
Intel® Trusted Connect Service Client (Version: 1.28.487.1 - Intel Corporation) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.0) (Version: 3.0.0 - Riot Games)
League of Legends (x32 Version: 3.0.0 - Riot Games) Hidden
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10249 - Realtek Semiconductor Corp.)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.4.0 - Lenovo)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: 4.8.5 - CEWE COLOR AG u Co. OHG)
Lenovo pointing device (HKLM\...\Elantech) (Version: 11.4.26.1 - ELAN Microelectronic Corp.)
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5630.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.) Hidden
Lenovo Reach (HKLM-x32\...\{0B5E0E89-4BCA-4035-BBA1-D1439724B6E2}) (Version: 1.1.0.166 - Stoneware, Inc.)
Lenovo VeriFace (HKLM\...\Lenovo VeriFace) (Version: 5.0.13.5261 - Lenovo)
Malwarebytes Anti-Malware version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Maxthon Cloud Browser (HKLM-x32\...\Maxthon3) (Version: 4.1.2.4000 - Maxthon International Limited)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4605.1003 - Microsoft Corporation)
Microsoft Office Home and Student 2013 - en-us (HKLM\...\HomeStudentRetail - en-us) (Version: 15.0.4605.1003 - Microsoft Corporation)
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.0.4041.0512 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Nitro Pro 8 (HKLM\...\{392C767D-4EE2-49B5-A3B4-A4C3AB6DC145}) (Version: 8.5.7.1 - Nitro)
NVIDIA Control Panel 327.45 (Version: 327.45 - NVIDIA Corporation) Hidden
NVIDIA GeForce Experience 1.6.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.6.1 - NVIDIA Corporation)
NVIDIA Graphics Driver 327.45 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.45 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.133.902 - NVIDIA Corporation) Hidden
NVIDIA Optimus 8.3.14 (Version: 8.3.14 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Update 8.3.14 (Version: 8.3.14 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 8.3.14 - NVIDIA Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4605.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4605.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4605.1003 - Microsoft Corporation) Hidden
Onekey Theater (HKLM-x32\...\{91CC5BAE-A098-40D3-A43B-C0DC7CE263FE}) (Version: 3.0.1.2 - Lenovo)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.10525 - CyberLink Corp.)
Qualcomm Atheros Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7030 - Realtek Semiconductor Corp.)
StageLight version 1.0.0.3508 (HKLM\...\StageLight) (Version: version 1.0.0.3508 - Open Labs, LLC.)
Start Menu (HKCU\...\Pokki) (Version: 0.269.2.430 - Pokki)
System Update kb70007 (x32 Version: 1.0.0 - MSR) Hidden
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.15 - Lenovo)
UserGuide (x32 Version: 1.0.0.15 - Lenovo) Hidden
v9 uninstaller (HKLM-x32\...\v9 uninstaller) (Version:  - v9)
Windows Driver Package - Lenovo (ACPIVPC) System  (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo)
Windows Driver Package - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
 
==================== Restore Points  =========================
 
10-05-2014 23:21:41 Scheduled Checkpoint
20-05-2014 03:04:06 avast! antivirus system restore point
 
==================== Hosts content: ==========================
 
2013-08-22 07:25 - 2013-08-22 07:25 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (whitelisted) =============
 
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {1AE065E4-DE52-4A8F-A6EC-C2D536CEB450} - System32\Tasks\Microsoft Office 15 Sync Maintenance for LENOVO-PC-maxfr_000 Lenovo-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-04-22] (Microsoft Corporation)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {21BDAC49-A7F4-4484-83DA-F37D88F3FB2E} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE [2013-03-08] (CyberLink Corp.)
Task: {25CEE362-A7CD-41B0-B8B0-E7C26CF8256E} - System32\Tasks\IdleCrawler Runner => %LOCALAPPDATA%\IdleCrawler\IdleCrawler.exe
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-21] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {3D7791EB-5C68-4F21-A93C-08F0D5D364E4} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-05-19] (AVAST Software)
Task: {44E100D9-E2BC-46B7-89FC-ED316DCF083B} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {56E92B6B-D70C-491B-B441-4DAB62D92F57} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-207404653-2777702700-3025062220-1002 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {598DF6C8-2E4B-42F5-88AA-DABBB67C3DCE} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-03-30] (Microsoft Corporation)
Task: {66D32244-42C1-4E67-BA0E-EEFFB60B2EEF} - System32\Tasks\GPUpdate => C:\Users\maxfr_000\AppData\Roaming\GetPrivate\gp_upd.exe [2014-05-19] ()
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {7B81D3BB-0F44-4684-8C98-94C75F20F832} - System32\Tasks\UMonitor Task => C:\windows\SysWOW64\UMonit64.exe [2013-10-25] ()
Task: {83EEE143-1B4D-4C4E-8E03-A8E20ECF32DE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-19] (Google Inc.)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {8FDDD121-0358-47BC-9A64-B2B720DFB190} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-19] (Google Inc.)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {BC4DAA84-3059-4882-9BAC-B110458D2C7B} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2013-06-03] (Lenovo)
Task: {C272C2DD-EAE0-4909-AA6A-03BF7BE6A250} - System32\Tasks\Maxthon Update => C:\Program Files (x86)\Maxthon\Bin\mxup.exe [2013-08-01] (Maxthon International ltd.)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D5866615-1233-46FB-AFA4-CB080ACD2884} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-04-22] (Microsoft Corporation)
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {DC88E35A-CF5B-4F28-ACB5-E08EEE608852} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)
Task: {E4317EC8-8849-4748-A46A-120709338BB6} - System32\Tasks\Microsoft\Windows\Maintenance\IdleCrawler Update => %LOCALAPPDATA%\IdleCrawler\IdleCrawler.exe
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {EC768BF3-8D3C-43C8-AD9E-9FFB0DA62AB0} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2014-05-21] (Microsoft Corporation)
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Loaded Modules (whitelisted) =============
 
2014-03-25 21:51 - 2013-10-04 01:58 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2014-04-23 11:57 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-04-21 15:05 - 2014-03-25 13:21 - 00629928 _____ () C:\Program Files\Microsoft Office 15\ClientX64\StreamServer.dll
2014-03-25 22:23 - 2012-04-24 20:43 - 00390632 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-05-19 15:08 - 2014-05-08 15:23 - 00018944 _____ () C:\windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
2014-03-25 22:27 - 2014-03-25 22:27 - 00068368 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
2014-03-25 22:27 - 2014-03-25 22:27 - 00669288 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfDataStorageInterface.dll
2014-04-22 04:35 - 2014-04-22 04:35 - 08884904 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2014-03-25 22:10 - 2013-10-25 03:23 - 00053248 _____ () C:\windows\SysWOW64\UMonit64.exe
2013-05-09 18:58 - 2013-05-09 18:58 - 00119808 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\updateui.exe
2014-05-22 09:47 - 2014-05-22 09:47 - 02254848 _____ () C:\Program Files\AVAST Software\Avast\defs\14052200\algo.dll
2014-05-19 15:08 - 2014-05-08 15:23 - 00064000 _____ () C:\windows\Microsoft\SystemUpdatekb70007\InstallerLibrary.dll
2014-05-19 15:08 - 2014-05-08 15:23 - 00016896 _____ () C:\windows\Microsoft\SystemUpdatekb70007\Installer.dll
2014-03-25 21:59 - 2013-08-08 14:25 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2014-04-22 04:35 - 2014-04-22 04:35 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2014-05-19 20:11 - 2014-05-07 17:29 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\chrome_elf.dll
2014-05-19 20:11 - 2014-05-07 17:29 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libglesv2.dll
2014-05-19 20:11 - 2014-05-07 17:29 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libegl.dll
2014-05-19 21:04 - 2014-05-19 21:04 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-01-17 10:32 - 2014-01-17 10:32 - 00569856 _____ () C:\Users\maxfr_000\AppData\Local\Pokki\Engine\ppGoogleNaClPluginChrome.dll
2014-01-17 10:32 - 2014-01-17 10:32 - 01400846 _____ () C:\Users\maxfr_000\AppData\Local\Pokki\Engine\avcodec-54.dll
2014-01-17 10:32 - 2014-01-17 10:32 - 00151054 _____ () C:\Users\maxfr_000\AppData\Local\Pokki\Engine\avutil-51.dll
2014-01-17 10:32 - 2014-01-17 10:32 - 00222734 _____ () C:\Users\maxfr_000\AppData\Local\Pokki\Engine\avformat-54.dll
2014-05-19 20:11 - 2014-05-07 17:29 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\pdf.dll
2014-05-19 20:11 - 2014-05-07 17:29 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll
2014-05-19 20:11 - 2014-05-07 17:29 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ffmpegsumo.dll
2010-12-17 13:56 - 2010-12-17 13:56 - 02603520 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\QtCore4.dll
2013-03-07 13:53 - 2013-03-07 13:53 - 00015872 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\featureController.dll
2010-12-17 13:56 - 2010-12-17 13:56 - 01006592 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\QtNetwork4.dll
2010-12-17 13:56 - 2010-12-17 13:56 - 00382464 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\QtXml4.dll
2010-01-12 17:55 - 2010-01-12 17:55 - 00400384 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\sqlite3.dll
2010-01-12 17:55 - 2010-01-12 17:55 - 00322048 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\log4cplus.dll
2010-12-16 13:16 - 2010-12-16 13:16 - 00195584 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\libgsoap.dll
2010-01-18 00:34 - 2010-01-18 00:34 - 00062464 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\zlib1.dll
2013-03-07 13:55 - 2013-03-07 13:55 - 00472576 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\DeviceProfile.dll
2013-03-07 13:58 - 2013-03-07 13:58 - 00499488 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\plugin\PServerPlugin.dll
2013-03-07 13:54 - 2013-03-07 13:54 - 00013824 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\eventsSender.dll
2010-12-17 13:56 - 2010-12-17 13:56 - 14978048 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\QtWebKit4.dll
2010-12-17 13:56 - 2010-12-17 13:56 - 09224704 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\QtGui4.dll
2010-12-17 13:56 - 2010-12-17 13:56 - 00317952 _____ () C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\phonon4.dll
2013-07-22 17:19 - 2013-07-22 17:19 - 22220288 _____ () C:\Program Files (x86)\Lenovo\Lenovo Reach\libcef.dll
2013-07-22 17:19 - 2013-07-22 17:19 - 00628224 _____ () C:\Program Files (x86)\Lenovo\Lenovo Reach\libglesv2.dll
2013-07-22 17:19 - 2013-07-22 17:19 - 00110592 _____ () C:\Program Files (x86)\Lenovo\Lenovo Reach\libegl.dll
2014-05-19 15:08 - 2014-05-23 10:19 - 00086528 _____ () C:\Program Files (x86)\MSR\Privoxy\mgwz.dll
2014-05-19 20:11 - 2014-05-07 17:29 - 13695816 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\PepperFlash\pepflashplayer.dll
2014-04-22 04:25 - 2014-04-22 04:25 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\Users\maxfr_000\SkyDrive:ms-properties
 
==================== Safe Mode (whitelisted) ===================
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
 
==================== EXE Association (whitelisted) =============
 
 
==================== Disabled items from MSCONFIG ==============
 
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (05/22/2014 05:20:25 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
 
Error: (05/22/2014 09:40:05 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
 
Error: (05/21/2014 06:18:03 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D000D; CorrelationId: {0D6072C6-4A67-47FC-B0A6-22B0D887791E}
 
Error: (05/21/2014 06:18:03 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D000D; CorrelationId: {0D6072C6-4A67-47FC-B0A6-22B0D887791E}
 
Error: (05/21/2014 09:16:53 AM) (Source: AVLogEvent) (EventID: 5007) (User: NT AUTHORITY)
Description: a7f42003
 
Error: (05/19/2014 09:04:18 PM) (Source: VSS) (EventID: 12305) (User: )
Description: Volume Shadow Copy Service error: Volume/disk not connected or not found.
Error context: DeviceIoControl(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 - 000000000000017C,0x00530194,0000000000000000,0,000000AAC6E21090,4096,[0]).
 
 
Operation:
   Query Shadow Copies
 
Error: (05/19/2014 09:04:08 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary idqpynux.
 
System Error:
The system cannot find the file specified.
.
 
Error: (05/19/2014 09:04:08 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary qcsrfjrb.
 
System Error:
The system cannot find the file specified.
.
 
Error: (05/19/2014 01:35:28 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
 
Error: (05/18/2014 05:48:17 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
 
 
System errors:
=============
Error: (05/22/2014 02:15:36 PM) (Source: DCOM) (EventID: 10005) (User: LENOVO-PC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/22/2014 02:15:20 PM) (Source: DCOM) (EventID: 10005) (User: LENOVO-PC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/22/2014 02:15:04 PM) (Source: DCOM) (EventID: 10005) (User: LENOVO-PC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/22/2014 02:13:39 PM) (Source: DCOM) (EventID: 10005) (User: LENOVO-PC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/22/2014 02:03:39 PM) (Source: DCOM) (EventID: 10005) (User: LENOVO-PC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/22/2014 01:53:39 PM) (Source: DCOM) (EventID: 10005) (User: LENOVO-PC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/22/2014 01:45:51 PM) (Source: DCOM) (EventID: 10005) (User: LENOVO-PC)
Description: 1084WSearchUnavailable{9E175B6D-F52A-11D8-B9A5-505054503030}
 
Error: (05/22/2014 01:45:51 PM) (Source: DCOM) (EventID: 10005) (User: LENOVO-PC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/22/2014 01:45:38 PM) (Source: DCOM) (EventID: 10005) (User: LENOVO-PC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/22/2014 01:43:39 PM) (Source: DCOM) (EventID: 10005) (User: LENOVO-PC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}
 
 
Microsoft Office Sessions:
=========================
Error: (05/22/2014 05:20:25 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
 
Error: (05/22/2014 09:40:05 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
 
Error: (05/21/2014 06:18:03 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D000D; CorrelationId: {0D6072C6-4A67-47FC-B0A6-22B0D887791E}
 
Error: (05/21/2014 06:18:03 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D000D; CorrelationId: {0D6072C6-4A67-47FC-B0A6-22B0D887791E}
 
Error: (05/21/2014 09:16:53 AM) (Source: AVLogEvent) (EventID: 5007) (User: NT AUTHORITY)
Description: a7f42003
 
Error: (05/19/2014 09:04:18 PM) (Source: VSS) (EventID: 12305) (User: )
Description: DeviceIoControl(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 - 000000000000017C,0x00530194,0000000000000000,0,000000AAC6E21090,4096,[0])
 
Operation:
   Query Shadow Copies
 
Error: (05/19/2014 09:04:08 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary idqpynux.
 
System Error:
The system cannot find the file specified.
 
Error: (05/19/2014 09:04:08 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary qcsrfjrb.
 
System Error:
The system cannot find the file specified.
 
Error: (05/19/2014 01:35:28 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
 
Error: (05/18/2014 05:48:17 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 60%
Total physical RAM: 8104.27 MB
Available physical RAM: 3238.03 MB
Total Pagefile: 16296.27 MB
Available Pagefile: 10973.2 MB
Total Virtual: 131072 MB
Available Virtual: 131071.81 MB
 
==================== Drives ================================
 
Drive c: (Windows8_OS) (Fixed) (Total:891.65 GB) (Free:835.94 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:21.68 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 22 GB) (Disk ID: 74F02DEA)
Partition 1: (Not Active) - (Size=22 GB) - (Type=73)
 
========================================================
Disk: 1 (Size: 932 GB) (Disk ID: 63627567)
 
Partition: GPT Partition Type.
 
==================== End Of Log ============================
 

 

Link to post
Share on other sites

  • 4 weeks later...
  • Root Admin

Very sorry for the delay. We've simply been overrun with requests for help and have not been able to get to everyone requesting help in a timely manner.

Now that we're finally getting our head a bit above water again I've been going back to review old missed requests. If you do still need help please let me know.

Thank you

Link to post
Share on other sites

  • 1 month later...
  • Root Admin

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.