MylesA Posted October 24, 2014 ID:895729 Share Posted October 24, 2014 Thank You for your help with my infection.As instructed, I ran the Farbar Recovery Scan Tool and I am posting the results. I had trouble posting to this forum from the infected computer - I could not cut and paste and I could not upload files. I don't know why or if it related to the infection. So I am posting to this forum from another computer (clean I believe). I emailed the FRST txt files to myself and then I could cut and paste on the good computer. Here is the FRST.txt below. I will send the addition.txt in another post. Please Help Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-10-2014Ran by David Angeley (administrator) on GIGANTOR on 24-10-2014 13:20:32Running from C:\Users\David Angeley\DesktopLoaded Profiles: UpdatusUser & David Angeley (Available profiles: UpdatusUser & David Angeley)Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Webroot) C:\Program Files (x86)\Webroot\WRSA.exe(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe(DigitalPersona, Inc.) C:\Program Files\Dell\Dell Data Protection\Security Tools\Authentication\Bin\DpHostW.exe(DigitalPersona, Inc.) C:\Program Files\Dell\Dell Data Protection\Security Tools\Authentication\Bin\DpCardEngine.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE(Microsoft Corporation) C:\Windows\System32\wlanext.exe(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\BCMWLTRY.EXE(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe(Authentec Inc.) C:\Program Files\Common Files\SPBA\upeksvr.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe() C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Loader.exe(Webroot) C:\Program Files (x86)\Webroot\WRSA.exe(FileOpen Systems Inc.) C:\Program Files\FileOpen\Services\FileOpenManager64.exe(DigitalPersona, Inc.) C:\Program Files (x86)\Dell\Dell Data Protection\Security Tools Authentication\Bin\DPAgent.exe(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(Dell Inc.) C:\Program Files\Dell\PPO\poaService.exe(Dell Inc.) C:\Program Files\Dell\PPO\poaSmSrv.exe(Dell Inc.) C:\Program Files\Dell\PPO\poaTaServ.exe(SafeNet, Inc.) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe(Dell Inc.) C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.exe(DigitalPersona, Inc.) C:\Program Files\Dell\Dell Data Protection\Security Tools\Authentication\Bin\DpAgent.exe(Dell, Inc.) C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.MgmtServer.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe(Dell Inc.) C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.exe(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe(O2Micro International) C:\Windows\System32\drivers\o2flash.exe(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe() C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe(Microsoft Corporation) C:\Windows\System32\perfmon.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [698712 2013-05-02] (Alps Electric Co., Ltd.)HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7188552 2013-05-27] (Realtek Semiconductor)HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1291848 2013-03-22] (Realtek Semiconductor)HKLM\...\Run: [RtHDVBg_PushButton] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1291848 2013-03-22] (Realtek Semiconductor)HKLM-x32\...\Run: [] => [X]HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)HKLM-x32\...\Run: [WRSVC] => C:\Program Files (x86)\Webroot\WRSA.exe [767600 2014-10-22] (Webroot)HKLM\...\Winlogon: [userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\Dell\Dell Data Protection\Security Tools Authentication\Bin\DPAgent.exe,Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)Winlogon\Notify\spba: C:\Program Files\Common Files\SPBA\homefus2.dll (Authentec Inc.)HKU\S-1-5-21-815478023-2570439054-1862698040-1000\...\Policies\Explorer: [NoDesktopCleanupWizard] 1HKU\S-1-5-21-815478023-2570439054-1862698040-1001\...\Policies\Explorer: [NoDesktopCleanupWizard] 1HKU\S-1-5-21-815478023-2570439054-1862698040-1001\...\MountPoints2: {a7ff626e-52d2-11e3-bdbb-24fd52447a7a} - "E:\WD Drive Unlock.exe" autoplay=trueHKU\S-1-5-21-815478023-2570439054-1862698040-1001\...\MountPoints2: {daaaa67a-39dc-11e3-aabd-806e6f6e6963} - D:\mri.exeHKU\S-1-5-21-815478023-2570439054-1862698040-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dllStartup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install Webroot FF RunOnce.lnkShortcutTarget: Install Webroot FF RunOnce.lnk -> C:\Program Files (x86)\Common Files\wruninstall.exe (Webroot Software, Inc.)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install Webroot IE RunOnce.lnkShortcutTarget: Install Webroot IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\wruninstall.exe (Webroot Software, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blankHKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/SearchScopes: HKCU - DefaultScope {18BB9F07-485C-4D36-BDB2-82E9340177AE} URL = https://www.google.com/search?q={searchTerms}SearchScopes: HKCU - {18BB9F07-485C-4D36-BDB2-82E9340177AE} URL = https://www.google.com/search?q={searchTerms}BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)BHO: Webroot Vault -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> C:\ProgramData\WRData\pkg\LPBar64.dll (Webroot)BHO: Webroot Filtering Extension -> {C9C42510-9B41-42c1-9DCD-7282A2D07C61} -> C:\Program Files (x86)\Webroot\WRData\PKG\Vistax64\wrflt.dll (Webroot)BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)BHO-x32: Webroot Vault -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> C:\ProgramData\WRData\pkg\LPBar.dll (Webroot)BHO-x32: Webroot Filtering Extension -> {C9C42510-9B41-42c1-9DCD-7282A2D07C61} -> C:\Program Files (x86)\Webroot\WRData\PKG\Vistax86\wrflt.dll (Webroot)BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)Toolbar: HKLM - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar64.dll (Webroot)Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)Toolbar: HKLM-x32 - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar.dll (Webroot)Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox:========FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.29 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)FF Plugin-x32: digitalpersona.com/ChromeDPAgent -> C:\Program Files (x86)\Dell\Dell Data Protection\Security Tools Authentication\Bin\ChromeExt\components\npChromeDPAgent.dll (DigitalPersona, Inc.)FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtnFF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2013-11-01]FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files (x86)\Dell\Dell Data Protection\Security Tools Authentication\Bin\FirefoxExtFF Extension: DigitalPersona Extension - C:\Program Files (x86)\Dell\Dell Data Protection\Security Tools Authentication\Bin\FirefoxExt [2013-11-11] Chrome: =======CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-09-12]CHR HKLM-x32\...\Chrome\Extension: [ncffjdbbodifgldkcbhmiiljfcnbgjab] - C:\Program Files (x86)\Dell\Dell Data Protection\Security Tools Authentication\Bin\ChromeExt\dpchrome.crx [2013-08-13]CHR HKLM-x32\...\Chrome\Extension: [okfhiodnpcnnnpgbjbhfebjnbagmfhab] - C:\ProgramData\WRData\pkg\lpchrome.crx [2014-10-22] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2436280 2014-09-25] (Microsoft Corporation)S3 CVShell Service; C:\Program Files (x86)\ACD Systems\Canvas 14\CVShellSrv.exe [259192 2012-11-29] (ACD Systems of America Inc.)R2 Dell.PowerManager.Service; C:\Windows\system32\dllhost.exe [9728 2009-07-13] (Microsoft Corporation)R2 Dell.PowerManager.Service; C:\Windows\SysWOW64\dllhost.exe [7168 2009-07-13] (Microsoft Corporation)S3 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2486272 2013-04-30] (Dell Inc.) [File not signed]R2 DellMgmtAgent; C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.exe [247136 2013-10-08] (Dell Inc.)R2 DellMgmtLoader; C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Loader.exe [26464 2013-10-08] ()R2 DellMgmtServer; C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.MgmtServer.exe [33632 2013-10-08] (Dell, Inc.)R2 DpHost; C:\Program Files\Dell\Dell Data Protection\Security Tools\Authentication\Bin\DpHostW.exe [472400 2013-08-27] (DigitalPersona, Inc.)R2 FileOpenManager; C:\Program Files\FileOpen\Services\FileOpenManager64.exe [337264 2013-03-19] (FileOpen Systems Inc.)R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-07-15] (Intel Corporation)R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel® Corporation) [File not signed]S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel® Corporation)S3 InvProtectSvc; C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectSvc64.exe [2947856 2013-07-30] (Invincea, Inc.)R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-06-18] (Intel Corporation)R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)R2 poaService; C:\Program Files\Dell\PPO\poaService.exe [641232 2013-07-19] (Dell Inc.)R2 PoaSMSrv; C:\Program Files\Dell\PPO\poaSmSrv.exe [277712 2013-07-19] (Dell Inc.)R2 poaTaServ; C:\Program Files\Dell\PPO\poaTaServ.exe [516304 2013-07-19] (Dell Inc.)R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [223816 2013-01-09] (Realtek Semiconductor)S3 SboxSvc; C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe [124616 2013-07-30] ()R2 SentinelSecurityRuntime; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe [293216 2013-01-09] (SafeNet, Inc.)R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe [1915480 2013-05-23] (SoftThinks SAS)S2 tcsd_win32.exe; C:\Program Files\Dell\Dell Data Protection\TSS\bin\tcsd_win32.exe [1636352 2012-12-10] (Security Innovation, Inc.) [File not signed]R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2014-07-22] (Western Digital Technologies, Inc.)R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [296312 2014-07-22] (Western Digital Technologies, Inc.)R2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe [6169600 2013-10-20] (Dell Inc.) [File not signed]R2 WRSVC; C:\Program Files (x86)\Webroot\WRSA.exe [767600 2014-10-22] (Webroot) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170200 2013-10-20] (Broadcom Corporation.)S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2014-10-11] (Emsisoft GmbH)R0 CredFltL; C:\Windows\System32\DRIVERS\CredFltL.sys [34048 2013-10-08] ()R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [23312 2013-04-29] (Dell Computer Corporation)R2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2010-01-20] (Samsung Electronics Co., Ltd.)R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [489752 2014-08-14] (Intel Corporation)R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2013-07-10] (Intel Corporation)R3 IntcAzAudAddService; C:\Windows\System32\drivers\RTDVHD64.sys [2136520 2013-06-07] (Realtek Semiconductor Corp.)S3 InvProtectDrv; C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectDrv64.sys [34824 2013-07-30] ()R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-24] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-04] (NVIDIA Corporation)R3 O2FJ2RDR; C:\Windows\System32\DRIVERS\O2FJ2w7x64.sys [185760 2013-05-07] (O2Micro )R3 POADrvr; C:\Windows\System32\drivers\POADrvr.sys [21264 2013-07-19] (Dell Computer Corporation)S3 SboxDrv; C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxDrv.sys [202248 2013-07-30] ()R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-09-17] (SafeNet, Inc.)S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)R3 SNTUSB64; C:\Windows\System32\DRIVERS\SNTUSB64.SYS [63528 2011-05-27] (SafeNet, Inc.)R3 ST_Accel; C:\Windows\System32\DRIVERS\ST_Accel.sys [89312 2013-03-27] (STMicroelectronics)S3 uc480; C:\Windows\System32\DRIVERS\uc480_64.sys [6456640 2013-02-11] (OEM)S3 uc480_boot; C:\Windows\System32\DRIVERS\uc480_boot_64.sys [6453056 2013-02-11] (OEM)R3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [257536 2012-01-19] (Jungo)R0 WRkrn; C:\Windows\System32\drivers\WRkrn.sys [115680 2014-10-22] (Webroot) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-24 13:20 - 2014-10-24 13:20 - 00021263 _____ () C:\Users\David Angeley\Desktop\FRST.txt2014-10-24 13:20 - 2014-10-24 13:20 - 00000000 ____D () C:\FRST2014-10-24 13:16 - 2014-10-24 13:16 - 02112000 _____ (Farbar) C:\Users\David Angeley\Desktop\FRST64.exe2014-10-24 07:44 - 2014-10-24 07:44 - 00000000 ____D () C:\Windows\system32\appmgmt2014-10-24 07:41 - 2014-10-24 07:41 - 00001304 _____ () C:\Users\David Angeley\Desktop\Notepad.lnk2014-10-23 19:37 - 2014-10-23 19:37 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2014-10-23 19:37 - 2014-10-23 19:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2014-10-23 19:37 - 2014-10-23 19:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2014-10-23 19:37 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys2014-10-23 19:37 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys2014-10-23 19:37 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys2014-10-23 19:26 - 2014-10-23 19:36 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\David Angeley\Desktop\mbam-setup-2.0.3.1025.exe2014-10-23 14:49 - 2014-10-23 14:58 - 00000000 ____D () C:\Users\David Angeley\Documents\work2014-10-22 15:42 - 2014-10-22 15:42 - 00000000 ____D () C:\Windows\pss2014-10-22 15:11 - 2014-10-22 15:42 - 00000000 ____D () C:\Users\David Angeley\AppData\Local\lptmp1818943582014-10-22 15:10 - 2014-10-24 12:22 - 00000000 ____D () C:\ProgramData\WRData2014-10-22 15:10 - 2014-10-22 15:16 - 00154760 _____ (Webroot) C:\Windows\SysWOW64\WRusr.dll2014-10-22 15:10 - 2014-10-22 15:16 - 00115680 _____ (Webroot) C:\Windows\system32\Drivers\WRkrn.sys2014-10-22 15:10 - 2014-10-22 15:16 - 00105320 _____ (Webroot) C:\Windows\system32\WRusr.dll2014-10-22 15:10 - 2014-10-22 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webroot SecureAnywhere2014-10-22 15:10 - 2014-09-05 17:02 - 00168104 ____N (Geek Squad) C:\Users\Public\Desktop\Geek Squad Support.exe2014-10-22 15:09 - 2014-10-22 15:10 - 00000000 ____D () C:\Program Files (x86)\Webroot2014-10-22 15:07 - 2014-10-22 15:07 - 00002021 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk2014-10-21 15:06 - 2014-10-21 15:06 - 00000000 _____ () C:\detestfrag.txt2014-10-21 14:46 - 2014-10-24 09:30 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2014-10-21 14:46 - 2014-10-21 15:50 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)2014-10-21 14:40 - 2014-10-24 07:54 - 00000000 ___RD () C:\Users\David Angeley\Desktop\Desktop Items2014-10-21 14:19 - 2014-09-04 19:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll2014-10-21 14:19 - 2014-09-04 18:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll2014-10-21 13:38 - 2014-10-21 13:53 - 00000000 ____D () C:\ProgramData\TEMP2014-10-21 13:34 - 2013-10-01 19:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys2014-10-21 13:34 - 2013-10-01 19:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe2014-10-21 13:34 - 2013-10-01 19:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll2014-10-21 13:34 - 2013-10-01 18:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll2014-10-21 13:34 - 2013-10-01 18:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll2014-10-21 13:34 - 2013-10-01 18:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll2014-10-21 13:34 - 2013-10-01 18:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll2014-10-21 13:34 - 2013-10-01 17:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll2014-10-21 13:34 - 2013-10-01 17:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll2014-10-21 13:34 - 2013-10-01 17:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll2014-10-21 13:34 - 2013-10-01 17:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe2014-10-21 13:34 - 2013-10-01 17:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe2014-10-21 13:34 - 2013-10-01 16:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll2014-10-21 13:34 - 2013-10-01 16:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe2014-10-21 13:34 - 2013-10-01 16:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll2014-10-21 13:34 - 2013-10-01 15:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe2014-10-21 13:02 - 2014-10-06 19:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2014-10-21 13:02 - 2014-10-06 19:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2014-10-21 13:02 - 2014-09-25 15:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-10-21 13:02 - 2014-09-25 15:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-10-21 13:02 - 2014-09-25 15:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-10-21 13:02 - 2014-09-25 15:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-10-21 13:02 - 2014-09-25 15:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-10-21 13:02 - 2014-09-25 15:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-10-21 13:02 - 2014-09-25 15:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-10-21 13:02 - 2014-09-18 19:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-10-21 13:02 - 2014-09-18 18:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-10-21 13:02 - 2014-09-18 18:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2014-10-21 13:02 - 2014-09-18 18:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-10-21 13:02 - 2014-09-18 18:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-10-21 13:02 - 2014-09-18 18:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-10-21 13:02 - 2014-09-18 18:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2014-10-21 13:02 - 2014-09-18 18:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2014-10-21 13:02 - 2014-09-18 18:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll2014-10-21 13:02 - 2014-09-18 18:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-10-21 13:02 - 2014-09-18 18:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-10-21 13:02 - 2014-09-18 18:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2014-10-21 13:02 - 2014-09-18 18:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-10-21 13:02 - 2014-09-18 18:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-10-21 13:02 - 2014-09-18 18:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-10-21 13:02 - 2014-09-18 18:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2014-10-21 13:02 - 2014-09-18 18:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2014-10-21 13:02 - 2014-09-18 18:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2014-10-21 13:02 - 2014-09-18 18:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-10-21 13:02 - 2014-09-18 18:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-10-21 13:02 - 2014-09-18 18:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2014-10-21 13:02 - 2014-09-18 18:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-10-21 13:02 - 2014-09-18 18:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2014-10-21 13:02 - 2014-09-18 18:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2014-10-21 13:02 - 2014-09-18 18:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2014-10-21 13:02 - 2014-09-18 18:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-10-21 13:02 - 2014-09-18 17:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll2014-10-21 13:02 - 2014-09-18 17:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-10-21 13:02 - 2014-09-18 17:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-10-21 13:02 - 2014-09-18 17:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-10-21 13:02 - 2014-09-18 17:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2014-10-21 13:02 - 2014-09-18 17:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-10-21 13:02 - 2014-09-18 17:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-10-21 13:02 - 2014-09-18 17:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2014-10-21 13:02 - 2014-09-18 17:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-10-21 13:02 - 2014-09-18 17:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2014-10-21 13:02 - 2014-09-18 17:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll2014-10-21 13:02 - 2014-09-18 17:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2014-10-21 13:02 - 2014-09-18 17:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-10-21 13:02 - 2014-09-18 17:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2014-10-21 13:02 - 2014-09-18 17:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-10-21 13:02 - 2014-09-18 17:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2014-10-21 13:02 - 2014-09-18 17:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-10-21 13:02 - 2014-09-18 16:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-10-21 13:02 - 2014-09-18 16:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2014-10-21 13:02 - 2014-09-18 16:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-10-21 13:02 - 2014-09-18 16:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2014-10-21 13:02 - 2014-09-17 19:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll2014-10-21 13:02 - 2014-09-17 18:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll2014-10-21 13:02 - 2014-08-28 19:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll2014-10-21 13:02 - 2014-07-16 19:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll2014-10-21 13:02 - 2014-07-16 19:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe2014-10-21 13:02 - 2014-07-16 19:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll2014-10-21 13:02 - 2014-07-16 19:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll2014-10-21 13:02 - 2014-07-16 19:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll2014-10-21 13:02 - 2014-07-16 19:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll2014-10-21 13:02 - 2014-07-16 18:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll2014-10-21 13:02 - 2014-07-16 18:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll2014-10-21 13:02 - 2014-07-16 18:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll2014-10-21 13:02 - 2014-07-16 18:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys2014-10-21 13:02 - 2014-07-16 18:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys2014-10-21 13:01 - 2014-09-28 17:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2014-10-21 13:01 - 2014-09-12 18:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll2014-10-21 13:01 - 2014-09-12 18:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll2014-10-21 13:01 - 2014-09-03 22:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll2014-10-21 13:01 - 2014-09-03 22:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll2014-10-21 13:01 - 2014-06-18 15:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll2014-10-21 13:01 - 2014-06-18 15:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll2014-10-21 13:01 - 2014-06-18 15:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll2014-10-21 13:01 - 2014-06-18 15:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll2014-10-21 13:01 - 2014-06-18 15:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll2014-10-21 13:01 - 2014-06-18 15:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll2014-10-20 11:06 - 2014-10-20 13:50 - 00000000 ___HD () C:\MRI_PE_TEMP2014-10-20 09:38 - 2014-10-22 15:05 - 00000000 ____D () C:\Users\David Angeley\AppData\Local\LogMeIn Rescue Applet2014-10-20 09:24 - 2014-10-22 15:09 - 00000000 ____D () C:\ProgramData\Geek Squad2014-10-12 13:27 - 2014-10-12 13:27 - 00000000 ____D () C:\ProgramData\Sophos2014-10-12 09:48 - 2014-10-12 09:59 - 00000000 ____D () C:\NPE2014-10-12 09:47 - 2014-10-12 10:04 - 00000000 ____D () C:\Users\David Angeley\AppData\Local\NPE2014-10-12 09:47 - 2014-10-12 09:47 - 00000000 ____D () C:\ProgramData\Norton2014-10-11 12:27 - 2014-10-11 12:27 - 00000000 ____D () C:\Users\David Angeley\AppData\Local\Dell2014-10-11 11:54 - 2014-10-11 12:06 - 00000000 ____D () C:\EEK2014-10-11 08:13 - 2014-10-11 08:13 - 00000000 ____D () C:\Windows\ERUNT2014-10-10 23:03 - 2014-10-11 07:13 - 00000000 ____D () C:\AdwCleaner2014-10-10 22:39 - 2014-10-12 19:30 - 00037624 _____ () C:\Windows\system32\Drivers\TrueSight.sys2014-10-10 22:39 - 2014-10-10 22:39 - 00000000 ____D () C:\ProgramData\RogueKiller2014-10-10 17:36 - 2014-10-10 17:36 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe2014-10-10 16:53 - 2014-10-11 07:17 - 00000000 ____D () C:\ProgramData\HitmanPro2014-10-10 16:22 - 2014-10-12 19:34 - 00000000 ____D () C:\Users\David Angeley\Documents\Computer virus2014-10-10 16:13 - 2014-10-21 14:46 - 00000000 ____D () C:\ProgramData\Malwarebytes2014-10-10 13:53 - 2014-10-12 13:09 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage2014-10-10 13:53 - 2014-10-10 13:53 - 00000000 _____ () C:\Windows\system32\eekhj.dll2014-10-07 10:33 - 2014-05-08 02:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll2014-10-06 17:34 - 2012-08-23 07:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll2014-10-06 17:34 - 2012-08-23 07:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys2014-10-06 17:34 - 2012-08-23 07:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys2014-10-06 17:34 - 2012-08-23 04:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll2014-10-06 17:34 - 2012-08-23 03:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll2014-10-06 17:21 - 2014-07-08 19:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL2014-10-06 17:21 - 2014-07-08 19:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL2014-10-06 17:21 - 2014-07-08 19:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL2014-10-06 17:21 - 2014-07-08 19:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL2014-10-06 17:21 - 2014-07-08 19:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL2014-10-06 17:21 - 2014-07-08 18:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL2014-10-06 17:21 - 2014-07-08 18:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL2014-10-06 17:21 - 2014-07-08 18:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL2014-10-06 17:21 - 2014-07-08 18:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL2014-10-06 17:21 - 2014-07-08 18:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL2014-10-06 17:21 - 2014-07-08 15:38 - 00419992 _____ () C:\Windows\system32\locale.nls2014-10-06 17:21 - 2014-07-08 15:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls2014-10-04 13:57 - 2014-10-04 13:57 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat XI Pro.lnk2014-10-04 12:47 - 2014-10-21 13:09 - 00000000 ____D () C:\Windows\system32\MRT2014-10-04 12:47 - 2014-10-21 13:03 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2014-10-04 12:38 - 2014-10-24 07:39 - 00007606 _____ () C:\Users\David Angeley\AppData\Local\Resmon.ResmonCfg2014-10-02 17:02 - 2014-10-02 17:02 - 00000165 ____H () C:\Users\David Angeley\Desktop\~$spie openings aug2014.xlsx2014-10-01 07:56 - 2014-10-01 07:56 - 00000000 __SHD () C:\Users\David Angeley\AppData\Local\EmieUserList2014-10-01 07:56 - 2014-10-01 07:56 - 00000000 __SHD () C:\Users\David Angeley\AppData\Local\EmieSiteList2014-09-30 17:08 - 2014-09-24 19:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll2014-09-30 17:08 - 2014-09-24 18:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll2014-09-30 07:19 - 2014-09-30 07:19 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.02014-09-30 05:03 - 2014-09-30 05:03 - 00001415 _____ () C:\Users\David Angeley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk2014-09-30 04:08 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE2014-09-30 04:06 - 2014-09-30 04:06 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll2014-09-30 04:06 - 2014-09-30 04:06 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat2014-09-30 04:06 - 2014-09-30 04:06 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec2014-09-30 04:06 - 2014-09-30 04:06 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll2014-09-30 04:06 - 2014-09-30 04:06 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2014-09-30 04:06 - 2014-09-30 04:06 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll2014-09-30 04:06 - 2014-09-30 04:06 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll2014-09-30 04:06 - 2014-09-30 04:06 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll2014-09-30 04:06 - 2014-09-30 04:06 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe2014-09-30 04:06 - 2014-09-30 04:06 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe2014-09-30 04:06 - 2014-09-30 04:06 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll2014-09-30 04:06 - 2014-09-30 04:06 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe2014-09-30 04:06 - 2014-09-30 04:06 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll2014-09-30 04:06 - 2014-09-30 04:06 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx2014-09-30 04:06 - 2014-09-30 04:06 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll2014-09-30 04:06 - 2014-09-30 04:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat2014-09-30 04:05 - 2014-09-30 04:05 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec2014-09-30 04:05 - 2014-09-30 04:05 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe2014-09-30 04:05 - 2014-09-30 04:05 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe2014-09-30 04:05 - 2014-09-30 04:05 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe2014-09-30 04:05 - 2014-09-30 04:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe2014-09-30 04:05 - 2014-09-30 04:05 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx2014-09-30 04:05 - 2014-09-30 04:05 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe2014-09-30 04:05 - 2014-09-30 04:05 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll2014-09-30 04:05 - 2014-09-30 04:05 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe2014-09-30 04:05 - 2014-09-30 04:05 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe2014-09-30 04:05 - 2014-09-30 04:05 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe2014-09-30 04:05 - 2014-09-30 04:05 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe2014-09-30 04:03 - 2014-09-30 04:08 - 00008872 _____ () C:\Windows\IE11_main.log2014-09-30 03:46 - 2014-09-30 07:19 - 00287594 _____ () C:\Windows\msxml4-KB973688-enu.LOG2014-09-30 03:31 - 2014-09-30 07:19 - 00291686 _____ () C:\Windows\msxml4-KB954430-enu.LOG2014-09-30 03:14 - 2012-07-25 20:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll2014-09-30 03:14 - 2012-07-25 20:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll2014-09-30 03:14 - 2012-07-25 19:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys2014-09-30 03:14 - 2012-07-25 19:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys2014-09-30 03:13 - 2012-07-25 20:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll2014-09-30 03:13 - 2012-07-25 20:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe2014-09-30 03:13 - 2012-07-25 20:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll2014-09-30 03:13 - 2012-06-02 07:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf2014-09-30 03:08 - 2014-06-26 19:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll2014-09-30 03:08 - 2014-06-26 18:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll2014-09-30 03:01 - 2014-06-30 15:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll2014-09-30 03:01 - 2014-06-30 15:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll2014-09-30 03:01 - 2014-03-09 14:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe2014-09-30 03:01 - 2014-03-09 14:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll2014-09-30 03:01 - 2014-03-09 14:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe2014-09-30 03:01 - 2014-03-09 14:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll2014-09-30 03:00 - 2014-06-05 23:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe2014-09-30 03:00 - 2014-06-05 23:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe2014-09-29 21:14 - 2011-04-08 23:58 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe2014-09-29 21:14 - 2011-04-08 22:56 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe2014-09-29 18:32 - 2014-06-17 19:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe2014-09-29 18:32 - 2014-06-17 18:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe2014-09-29 18:31 - 2014-03-04 02:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe2014-09-29 18:31 - 2014-03-04 02:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll2014-09-29 18:31 - 2014-03-04 02:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll2014-09-29 18:31 - 2014-03-04 02:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll2014-09-29 18:31 - 2014-03-04 02:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll2014-09-29 18:31 - 2014-03-04 02:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll2014-09-29 18:31 - 2014-03-04 02:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll2014-09-29 18:31 - 2014-03-04 02:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll2014-09-29 18:31 - 2014-03-04 02:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll2014-09-29 18:31 - 2014-03-04 02:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe2014-09-29 18:31 - 2014-03-04 02:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe2014-09-29 18:31 - 2014-03-04 02:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll2014-09-29 18:31 - 2014-03-04 02:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll2014-09-29 18:31 - 2014-03-04 02:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll2014-09-29 18:31 - 2014-03-04 02:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll2014-09-29 18:31 - 2014-03-04 02:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll2014-09-29 18:31 - 2014-03-04 02:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll2014-09-29 18:31 - 2014-03-04 02:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll2014-09-29 18:31 - 2014-03-04 02:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll2014-09-29 18:31 - 2013-11-26 18:42 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys2014-09-29 18:31 - 2013-11-26 18:42 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys2014-09-29 18:31 - 2013-11-26 18:42 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys2014-09-29 18:31 - 2013-11-26 18:42 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys2014-09-29 18:31 - 2013-11-26 18:42 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys2014-09-29 18:31 - 2013-10-03 19:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll2014-09-29 18:31 - 2013-10-03 19:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll2014-09-29 18:31 - 2013-10-03 18:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll2014-09-29 18:31 - 2013-10-03 18:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll2014-09-29 18:31 - 2013-08-04 19:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys2014-09-29 18:31 - 2013-08-01 19:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll2014-09-29 18:31 - 2013-08-01 19:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll2014-09-29 18:31 - 2013-08-01 18:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll2014-09-29 18:31 - 2013-08-01 17:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe2014-09-29 17:39 - 2014-06-06 03:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll2014-09-29 17:39 - 2014-06-06 02:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll2014-09-29 17:39 - 2014-06-03 03:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll2014-09-29 17:39 - 2013-07-12 03:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys2014-09-29 17:39 - 2013-07-12 03:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys2014-09-29 17:39 - 2013-07-12 03:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys2014-09-29 17:39 - 2013-07-02 21:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys2014-09-29 17:39 - 2013-07-02 21:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys2014-09-29 17:39 - 2013-07-02 21:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys2014-09-29 17:39 - 2013-06-25 15:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys2014-09-29 17:38 - 2014-06-03 03:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll2014-09-29 17:38 - 2014-06-03 03:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe2014-09-29 17:38 - 2014-06-03 02:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll2014-09-29 17:38 - 2014-06-03 02:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll2014-09-29 17:38 - 2013-11-26 01:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll2014-09-29 17:38 - 2013-11-22 15:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll2014-09-29 17:37 - 2014-08-22 19:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll2014-09-29 17:37 - 2014-08-22 18:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll2014-09-29 17:37 - 2014-07-06 19:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll2014-09-29 17:37 - 2014-07-06 19:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll2014-09-29 17:37 - 2014-07-06 18:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll2014-09-29 17:37 - 2014-07-06 18:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2014-09-29 17:37 - 2014-07-06 18:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2014-09-29 17:37 - 2014-05-30 01:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll2014-09-29 17:37 - 2014-05-30 01:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll2014-09-29 17:37 - 2014-05-30 01:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll2014-09-29 17:37 - 2014-05-30 01:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll2014-09-29 17:37 - 2014-05-30 00:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll2014-09-29 17:37 - 2014-05-30 00:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2014-09-29 17:37 - 2014-05-30 00:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll2014-09-29 17:37 - 2014-05-30 00:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll2014-09-29 17:37 - 2014-04-11 19:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys2014-09-29 17:37 - 2014-04-11 19:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys2014-09-29 17:37 - 2014-04-11 19:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll2014-09-29 17:37 - 2014-04-11 19:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe2014-09-29 17:37 - 2014-04-11 19:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll2014-09-29 17:37 - 2014-04-11 19:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll2014-09-29 17:37 - 2014-01-27 19:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll2014-09-29 17:37 - 2013-10-29 19:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll2014-09-29 17:37 - 2013-10-29 19:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll2014-09-29 17:37 - 2013-08-28 19:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll2014-09-29 17:37 - 2013-08-28 19:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll2014-09-29 17:37 - 2013-08-28 19:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll2014-09-29 17:37 - 2013-08-28 18:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll2014-09-29 17:37 - 2013-08-28 18:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll2014-09-29 17:37 - 2013-08-28 18:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll2014-09-29 17:37 - 2013-07-04 05:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll2014-09-29 17:37 - 2013-07-04 05:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys2014-09-29 17:37 - 2013-07-04 04:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll2014-09-29 17:36 - 2014-08-01 04:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll2014-09-29 17:36 - 2014-08-01 04:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll2014-09-29 17:36 - 2014-04-24 19:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll2014-09-29 17:36 - 2014-04-24 19:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll2014-09-29 17:36 - 2014-04-04 19:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys2014-09-29 17:36 - 2014-04-04 19:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS2014-09-29 17:36 - 2014-01-28 19:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll2014-09-29 17:36 - 2014-01-28 19:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll2014-09-29 17:36 - 2013-11-26 04:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys2014-09-29 17:36 - 2013-11-23 11:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll2014-09-29 17:36 - 2013-11-23 10:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll2014-09-29 17:36 - 2013-10-18 19:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll2014-09-29 17:36 - 2013-10-18 18:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll2014-09-29 17:36 - 2013-10-05 13:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll2014-09-29 17:36 - 2013-10-05 12:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll2014-09-29 17:35 - 2014-06-23 20:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll2014-09-29 17:35 - 2014-06-23 19:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll2014-09-29 17:35 - 2014-03-26 07:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll2014-09-29 17:35 - 2014-03-26 07:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll2014-09-29 17:35 - 2014-03-26 07:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll2014-09-29 17:35 - 2014-03-26 07:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll2014-09-29 17:35 - 2014-03-26 07:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll2014-09-29 17:35 - 2014-03-26 07:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll2014-09-29 17:35 - 2014-03-26 07:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll2014-09-29 17:35 - 2014-03-26 07:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll2014-09-29 17:34 - 2013-10-03 19:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys2014-09-29 17:34 - 2013-10-03 18:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys2014-09-29 17:33 - 2013-12-03 19:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll2014-09-29 17:33 - 2013-12-03 19:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll2014-09-29 17:33 - 2013-12-03 19:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll2014-09-29 17:33 - 2013-12-03 19:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll2014-09-29 17:33 - 2013-12-03 19:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll2014-09-29 17:33 - 2013-12-03 19:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe2014-09-29 17:33 - 2013-12-03 19:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe2014-09-29 17:33 - 2013-12-03 19:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe2014-09-29 17:33 - 2013-12-03 19:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe2014-09-29 17:33 - 2013-12-03 19:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll2014-09-29 17:33 - 2013-12-03 19:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll2014-09-29 17:33 - 2013-12-03 19:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll2014-09-29 17:33 - 2013-12-03 19:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll2014-09-29 17:33 - 2013-12-03 19:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll2014-09-29 17:33 - 2013-12-03 18:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe2014-09-29 17:33 - 2013-12-03 18:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe2014-09-29 17:33 - 2013-12-03 18:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe2014-09-29 17:33 - 2013-12-03 18:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe2014-09-29 17:33 - 2013-06-05 22:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll2014-09-29 17:33 - 2013-06-05 22:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll2014-09-29 17:33 - 2013-06-05 22:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll2014-09-29 17:33 - 2013-06-05 22:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll2014-09-29 17:33 - 2013-06-05 21:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll2014-09-29 17:33 - 2013-06-05 21:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll2014-09-29 17:33 - 2013-06-05 21:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll2014-09-29 17:33 - 2013-06-05 20:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll2014-09-29 17:33 - 2013-06-05 20:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll2014-09-29 17:33 - 2013-06-05 20:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll2014-09-29 17:32 - 2014-05-29 23:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys2014-09-29 17:30 - 2013-07-04 05:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll2014-09-29 17:30 - 2013-07-04 05:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll2014-09-29 17:30 - 2013-07-04 04:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll2014-09-29 17:30 - 2013-07-04 04:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll2014-09-29 17:30 - 2013-07-04 03:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys2014-09-29 17:28 - 2014-06-15 19:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys2014-09-29 17:28 - 2013-09-07 19:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll2014-09-29 17:28 - 2013-09-07 19:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll2014-09-29 17:27 - 2014-02-03 19:37 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys2014-09-29 17:27 - 2014-02-03 19:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys2014-09-29 17:27 - 2014-02-03 19:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys2014-09-29 17:27 - 2014-02-03 19:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll2014-09-29 17:27 - 2014-02-03 19:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll2014-09-29 17:26 - 2014-09-09 15:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll2014-09-29 17:26 - 2014-09-09 14:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll2014-09-29 17:26 - 2014-06-24 19:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll2014-09-29 17:26 - 2014-06-24 18:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll2014-09-29 17:26 - 2013-07-25 19:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll2014-09-29 17:26 - 2013-07-25 18:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll2014-09-29 17:25 - 2014-03-04 02:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll2014-09-29 17:25 - 2014-03-04 02:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll2014-09-29 17:25 - 2014-03-04 02:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll2014-09-29 17:25 - 2014-03-04 02:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll2014-09-29 17:25 - 2014-03-04 02:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll2014-09-29 17:25 - 2014-03-04 02:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll2014-09-29 17:25 - 2014-03-04 02:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll2014-09-29 17:25 - 2014-03-04 02:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe2014-09-29 17:25 - 2014-03-04 02:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll2014-09-29 17:25 - 2014-03-04 01:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe2014-09-29 17:25 - 2014-03-04 01:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe2014-09-29 17:25 - 2014-01-23 19:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys2014-09-29 17:25 - 2013-10-11 19:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx2014-09-29 17:25 - 2013-10-11 19:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll2014-09-29 17:25 - 2013-10-11 19:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx2014-09-29 17:25 - 2013-10-11 19:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll2014-09-29 17:25 - 2013-10-11 18:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe2014-09-29 17:25 - 2013-10-11 18:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe2014-09-29 17:25 - 2013-10-11 18:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe2014-09-29 17:25 - 2013-10-11 18:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe2014-09-29 17:25 - 2013-08-01 19:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 18:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe2014-09-29 17:25 - 2013-08-01 17:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 17:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 17:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll2014-09-29 17:25 - 2013-08-01 17:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll2014-09-29 17:25 - 2013-07-20 03:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll2014-09-29 17:25 - 2013-07-20 03:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll2014-09-29 17:23 - 2014-07-13 19:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll2014-09-29 17:23 - 2014-07-13 18:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll2014-09-29 17:23 - 2014-02-03 19:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll2014-09-29 17:23 - 2014-02-03 19:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll2014-09-29 17:23 - 2013-10-11 19:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll2014-09-29 17:23 - 2013-10-11 19:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL2014-09-29 17:23 - 2013-10-11 19:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL2014-09-29 17:23 - 2013-10-11 19:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll2014-09-29 17:23 - 2013-10-11 19:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL2014-09-29 17:23 - 2013-08-27 18:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll2014-09-29 11:58 - 2014-05-14 09:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll2014-09-29 11:58 - 2014-05-14 09:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe2014-09-29 11:58 - 2014-05-14 09:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll2014-09-29 11:58 - 2014-05-14 09:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll2014-09-29 11:57 - 2014-05-14 09:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll2014-09-29 11:57 - 2014-05-14 09:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll2014-09-29 11:57 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll2014-09-29 11:57 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll2014-09-29 11:57 - 2014-05-14 09:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll2014-09-29 11:57 - 2014-05-14 09:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll2014-09-29 11:57 - 2014-05-14 09:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll2014-09-29 11:57 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe2014-09-29 11:57 - 2014-05-14 09:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll2014-09-29 11:57 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-24 13:19 - 2013-10-20 16:12 - 02037833 _____ () C:\Windows\WindowsUpdate.log2014-10-24 12:32 - 2013-10-20 14:19 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2014-10-24 12:22 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\rescache2014-10-24 10:42 - 2013-11-01 16:22 - 00000000 ____D () C:\Users\David Angeley\AppData\Local\CrashDumps2014-10-24 10:34 - 2013-11-11 18:36 - 00131072 ___SH () C:\CredSED.dat2014-10-24 08:46 - 2013-10-20 14:46 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery2014-10-24 08:46 - 2009-07-13 21:45 - 00031088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02014-10-24 08:46 - 2009-07-13 21:45 - 00031088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02014-10-24 08:43 - 2009-07-13 22:13 - 00783606 _____ () C:\Windows\system32\PerfStringBackup.INI2014-10-24 08:39 - 2010-11-20 20:47 - 01632740 _____ () C:\Windows\PFRO.log2014-10-24 08:39 - 2009-07-13 22:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-10-24 08:39 - 2009-07-13 21:51 - 00243463 _____ () C:\Windows\setupact.log2014-10-24 08:39 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\Registration2014-10-22 15:42 - 2014-09-01 18:53 - 00008192 _____ () C:\Windows\SysWOW64\WDPABKP.dat2014-10-22 15:27 - 2013-11-01 15:42 - 00000000 ____D () C:\Program Files\Microsoft Office 152014-10-22 15:10 - 2009-07-13 22:08 - 00032638 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2014-10-22 15:07 - 2013-10-20 14:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk2014-10-22 15:06 - 2013-10-20 14:51 - 00000000 ____D () C:\ProgramData\Adobe2014-10-22 15:06 - 2013-10-20 14:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2014-10-22 15:06 - 2013-10-20 14:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2014-10-22 15:06 - 2013-10-20 14:19 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2014-10-21 16:12 - 2009-07-13 22:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD2014-10-21 14:02 - 2013-10-20 14:24 - 00000000 ____D () C:\ProgramData\NVIDIA2014-10-21 14:00 - 2009-07-13 21:45 - 00327152 _____ () C:\Windows\system32\FNTCACHE.DAT2014-10-20 14:54 - 2013-10-20 14:46 - 00000000 ____D () C:\Temp2014-10-12 20:46 - 2013-11-11 11:47 - 00000000 ____D () C:\Users\David Angeley\Documents\Circuit Therapeutics2014-10-12 20:38 - 2014-05-05 20:32 - 00000000 ____D () C:\Users\David Angeley\Documents\Elisabeth2014-10-12 20:37 - 2014-06-17 11:54 - 00000000 ____D () C:\Users\David Angeley\Documents\RFI2014-10-12 07:03 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\Web2014-10-11 12:27 - 2013-10-20 14:32 - 00000000 ____D () C:\ProgramData\Dell2014-10-11 09:04 - 2009-07-13 20:20 - 00000000 __RHD () C:\Users\Public\Libraries2014-10-11 05:59 - 2014-01-25 14:14 - 00000000 ____D () C:\Users\David Angeley\Documents\Laser Safety2014-10-10 22:17 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\Resources2014-10-10 21:41 - 2013-11-19 10:07 - 00000000 ____D () C:\ProgramData\Trend Micro2014-10-10 21:41 - 2013-11-11 18:33 - 00000502 __RSH () C:\ProgramData\ntuser.pol2014-10-10 21:40 - 2013-11-19 10:09 - 00000000 ____D () C:\Users\David Angeley\AppData\Local\Trend Micro2014-10-10 15:53 - 2013-11-13 07:38 - 00000072 _____ () C:\Users\Public\LMDebug.log2014-10-10 14:01 - 2014-05-08 12:13 - 00231960 _____ () C:\Windows\RegBootClean64.exe2014-10-10 13:53 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\sysprep2014-10-06 18:52 - 2014-01-24 15:29 - 00000000 ____D () C:\ProgramData\Package Cache2014-10-06 18:48 - 2013-10-20 14:15 - 00060432 _____ () C:\Windows\DPINST.LOG2014-10-06 18:43 - 2014-01-24 15:30 - 00000000 ____D () C:\Program Files\Common Files\Western Digital2014-10-06 18:43 - 2014-01-24 15:29 - 00000000 ____D () C:\Program Files (x86)\Western Digital2014-10-06 18:43 - 2013-12-06 20:14 - 00000000 ____D () C:\ProgramData\Western Digital2014-10-06 18:10 - 2009-07-13 20:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories2014-10-06 18:07 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\PolicyDefinitions2014-10-06 18:02 - 2013-10-20 14:23 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation2014-10-06 11:03 - 2014-06-19 13:13 - 00000000 _____ () C:\Windows\DCEBOOT.LOG2014-10-06 09:53 - 2014-06-19 12:20 - 00021528 _____ () C:\Windows\DCEBoot64.exe2014-10-04 13:57 - 2013-11-01 16:23 - 00002212 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe FormsCentral.lnk2014-10-04 13:57 - 2013-11-01 16:23 - 00002051 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller XI.lnk2014-10-02 16:59 - 2014-02-16 17:09 - 00000000 ____D () C:\Users\David Angeley\Documents\Dave2014-10-02 15:53 - 2010-11-20 20:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe2014-09-30 04:43 - 2010-11-21 00:17 - 00000000 ____D () C:\Program Files\Windows Journal2014-09-30 04:43 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism2014-09-30 04:43 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\Dism2014-09-30 04:43 - 2009-07-13 20:20 - 00000000 ____D () C:\Program Files\Common Files\System2014-09-30 04:14 - 2011-02-10 07:33 - 00775852 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI2014-09-29 14:28 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\NDF2014-09-26 09:48 - 2013-11-11 15:03 - 00000000 ____D () C:\Users\David Angeley\AppData\Local\Microsoft Help2014-09-25 15:14 - 2014-01-14 21:49 - 00000000 ____D () C:\Users\David Angeley\dave Some content of TEMP:====================C:\Users\David Angeley\AppData\Local\Temp\HitmanPro.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-16 07:16 ==================== End Of Log ============================ Link to post Share on other sites More sharing options...
kevinf80 Posted October 24, 2014 ID:895741 Share Posted October 24, 2014 Can you post the second log "Addition.txt" need to see that before we can progress. Also Upload a File to VirustotalGo to http://www.virustotal.com/ Click the Choose file button Navigate to the file C:\Windows\system32\eekhj.dll Click the Scan it tab If you get a message saying File has already been analyzed: click Reanalyze file now Copy and paste the results back here please. Kevin... Link to post Share on other sites More sharing options...
MylesA Posted October 24, 2014 Author ID:895757 Share Posted October 24, 2014 Here is the addition.txt. I am proceeding with virustotal. Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-10-2014Ran by David Angeley at 2014-10-24 13:20:59Running from C:\Users\David Angeley\DesktopBoot Mode: Normal========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Webroot SecureAnywhere (Enabled - Up to date) {66A6FE14-08CB-F415-3742-517201416109}AS: Webroot SecureAnywhere (Enabled - Up to date) {DDC71FF0-2EF1-FB9B-0DF2-6A007AC62BB4}AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Acrobat XI Pro (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.09 - Adobe Systems)Adobe Flash Player 15 ActiveX (HKLM-x32\...\{047904BA-C065-40D5-969A-C7D91CA93D62}) (Version: 15.0.0.152 - Adobe Systems Incorporated)Adobe Reader XI MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)Adobe Reader XI (11.0.09) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)AuthenTec Fingerprint Driver (Version: 1.6.2.0350 - AuthenTec) HiddenAuthenTec WinBio FingerPrint Software 64-bit (Version: 3.4.2.1016 - AuthenTec, Inc.) HiddenBeam (HKLM-x32\...\Beam) (Version: stable-2.4 - Suitable Technologies)Canvas 14 (HKLM-x32\...\{3D6F5278-A4F3-4FFA-A10C-DC5785075072}) (Version: 14.1.1618 - ACD Systems of America Inc.)Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) HiddenCisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) HiddenCisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) HiddenCmgMasterPrerequisites (x32 Version: 1.1.0.335 - Credant Technologies Inc.) HiddenDell 1135n Laser MFP (HKLM-x32\...\Dell 1135n Laser MFP) (Version: - DELL Inc.)Dell Backup and Recovery - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 1.5.0.0 - Dell Inc.)Dell Backup and Recovery (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.5.0.0 - Dell Inc.)Dell Client System Update (HKLM-x32\...\{04566294-A6B6-4462-9721-031073EB3694}) (Version: 1.3.0 - Dell Inc.)Dell ControlVault Host Components Installer 64 bit (Version: 2.3.320.1682 - Broadcom Corporation) HiddenDell Data Protection | Client Security Framework (HKLM\...\{CF5E8D60-A1FD-4BF2-9EDD-EA8C05F784A9}) (Version: 8.1.0.1255 - Dell)Dell Data Protection | Security Tools (HKLM-x32\...\InstallShield_{AA2AFD30-F80C-401C-9B85-03A05A2F7EFD}) (Version: 1.1.0.335 - Dell)Dell Data Protection | Security Tools (x32 Version: 1.1.0.335 - Dell) HiddenDell Data Protection | Security Tools Authentication (HKLM\...\{A37033BB-8E6E-4E7B-9692-2F373FA2363A}) (Version: 1.1.0.337 - DigitalPersona, Inc.)Dell Data Vault (Version: 1.1.0.6 - Dell Inc.) HiddenDell Digital Delivery (HKLM-x32\...\{98CB551E-EDB1-4535-82A6-E3258597F64E}) (Version: 2.7.1000.0 - Dell Products, LP)Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)Dell Power Manager (HKLM\...\{E45D7941-F3F0-4E8E-AD55-DCE2FE0AE6D8}) (Version: 1.0.0 - Dell Inc.)Dell Precision Performance Optimizer (HKLM-x32\...\{D66A3355-FEA4-4F60-8BAF-D6CBEDB396D8}) (Version: 01.07.00 - Dell Inc.) <==== ATTENTIONDell Protected Workspace (HKLM-x32\...\{E2CAA395-66B3-4772-85E3-6134DBAB244E}) (Version: 2.3.15835 - Invincea, Inc.)Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1200.101.129 - ALPS ELECTRIC CO., LTD.)Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 1.40.54 - Creative Technology Ltd)DW WLAN Card Utility (HKLM\...\DW WLAN Card Utility) (Version: 6.30.223.75 - Dell Inc.)eDrawings 2014 x64 (HKLM\...\{411BC194-B48E-4EDD-B149-5F1A34D46825}) (Version: 14.0.5006 - Dassault Systèmes SolidWorks Corp)FileOpen Client (x64) B928 (HKLM\...\{3ED9A79B-1419-4C5F-BA88-EFD6F180EBE5}) (Version: 3.0.95.928 - FileOpen Systems, Inc.)FRED 12.31.0 Optical Engineering Software (HKLM-x32\...\FRED 12.31.0) (Version: 12.31.0 - Photon Engineering, LLC)FRED 13.21.0 Optical Engineering Software (HKLM-x32\...\FRED 13.21.0) (Version: 13.21.0 - Photon Engineering, LLC)iDRS OCR Software by I.R.I.S (HKLM-x32\...\iDRS OCR Software by I.R.I.S) (Version: 1.00.13.00 - Samsung Electronics Co., Ltd.)Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.12.1397 - Intel Corporation)Intel® Network Connections 18.1.59.00 (HKLM\...\PROSetDX) (Version: 18.1.59.00 - Intel)Intel® Network Connections 18.1.59.00 (Version: 18.1.59.00 - Intel) HiddenIntel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.7.1.1000 - Intel Corporation)Intel® Rapid Storage Technology (Version: 12.7.1.1000 - Intel Corporation) HiddenIntel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.0.0.102 - Intel Corporation)Intel® Trusted Connect Service Client (Version: 1.28.487.1 - Intel Corporation) HiddenMalwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)Mendeley Desktop 1.10.3 (HKLM-x32\...\Mendeley Desktop) (Version: 1.10.3 - Mendeley Ltd.)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Office Home and Business 2013 - en-us (HKLM\...\HomeBusinessRetail - en-us) (Version: 15.0.4659.1001 - Microsoft Corporation)Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)Microsoft SQL Server Compact 4.0 x64 ENU (HKLM\...\{8424B163-D1E0-48B7-88A2-C7A61767B3D7}) (Version: 4.0.8482.1 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)Notepad++ (HKLM-x32\...\Notepad++) (Version: 5.9.8 - )NVIDIA Control Panel 327.62 (Version: 327.62 - NVIDIA Corporation) HiddenNVIDIA Install Application (Version: 2.1002.141.953 - NVIDIA Corporation) HiddenNVIDIA nView 140.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 140.62 - NVIDIA Corporation)NVIDIA Optimus 1.11.3 (Version: 1.11.3 - NVIDIA Corporation) HiddenNVIDIA PhysX (x32 Version: 9.12.1031 - NVIDIA Corporation) HiddenNVIDIA PhysX System Software 9.12.1031 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation)NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) HiddenO2Micro OZ776 SCR Driver (Version: 2.1.4.218GS - O2Micro) HiddenO2Micro OZ776 SCR Driver (x32 Version: 2.1.4.218GS - O2Micro) HiddenOffice 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4659.1001 - Microsoft Corporation) HiddenOffice 15 Click-to-Run Licensing Component (Version: 15.0.4659.1001 - Microsoft Corporation) HiddenOffice 15 Click-to-Run Localization Component (x32 Version: 15.0.4659.1001 - Microsoft Corporation) HiddenOSLO66 Premium (HKLM-x32\...\{4698114E-B6A8-4098-A5CF-BD4922200818}) (Version: 6.62.14086 - Lambda Research Corporation)Readiris Pro 10 (HKLM-x32\...\{14D08502-FEE4-40E5-90D3-8A967A1D8BA2}) (Version: - )Realtek Audio COM Components (HKLM-x32\...\{2355B503-9B11-4449-861D-1C1748B26320}) (Version: 1.0.2 - Realtek Semiconductor Corp.)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)Security Innovation TSS (Version: 2.1.42 - Security Innovation) HiddenSentinel Protection Installer 7.6.4 (HKLM-x32\...\{7444785E-886F-4989-A69E-6394E36F3982}) (Version: 7.6.4 - SafeNet, Inc.)SmarThru 4 (HKLM-x32\...\{90F1943D-EA4A-4460-B59F-30023F3BA69A}) (Version: - )SmarThru PC Fax (HKLM-x32\...\SmarThru PC Fax) (Version: - )SPBA (WBF) 5.9 (Version: 5.9.7.7232 - Authentec Inc.) HiddenST Microelectronics 3 Axis Digital Accelerometer Solution (HKLM-x32\...\{9C24F411-9CA7-4A8A-91F3-F08A4A38EB31}) (Version: 4.10.0041 - ST Microelectronics)StarLab 2.30 (HKLM-x32\...\{9DE6D7FD-7488-4C30-80E4-D051F2455C75}) (Version: 2.30.0000 - Ophir Optronics)Thorlabs DCx Cameras (HKLM-x32\...\{8EF50DBE-83AB-484E-979F-74746233CD32}) (Version: 4.20.0006 - Thorlabs GmbH)Thorlabs DCx Cameras 64 bit Components (HKLM\...\{60493C26-5778-4A2B-9693-3371FFFF3FC6}) (Version: 4.20.0006 - Thorlabs GmbH)Validity WBF DDK 495 (HKLM\...\{760E2264-841F-497F-8E2F-D392990C1974}) (Version: 4.5.208.0 - Validity Sensors, Inc.)VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) HiddenWD Quick View (HKLM-x32\...\{D0A3A97D-7918-4B0B-B91E-775E00C36122}) (Version: 2.4.2.26 - Western Digital Technologies, Inc.)WD SmartWare (HKLM\...\{6BB4E4E8-17B9-4534-8A8E-89E53F12769C}) (Version: 2.4.2.26 - Western Digital Technologies, Inc.)WD SmartWare Installer (HKLM-x32\...\{2d588de7-f4f6-4d6d-8719-32cbb9637e9e}) (Version: 2.4.2.26 - Western Digital Technologies, Inc.)Webroot SecureAnywhere (HKLM-x32\...\WRUNINST) (Version: 8.0.4.131 - Webroot)WIDCOMM Bluetooth Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.4600 - Broadcom Corporation)Windows Driver Package - Thorlabs GmbH (uc480_boot) USB (12/11/2012 4.20.6.1) (HKLM\...\F795A6BC60EA26FF26DEBB0A38D7811ADC34C2BB) (Version: 12/11/2012 4.20.6.1 - Thorlabs GmbH) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-815478023-2570439054-1862698040-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\David Angeley\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-815478023-2570439054-1862698040-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?CustomCLSID: HKU\S-1-5-21-815478023-2570439054-1862698040-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\David Angeley\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-815478023-2570439054-1862698040-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\David Angeley\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-815478023-2570439054-1862698040-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\David Angeley\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation) ==================== Restore Points ========================= 21-10-2014 20:02:37 Windows Update21-10-2014 21:28:51 Windows Update21-10-2014 23:04:16 Geek Squad22-10-2014 22:02:12 Windows Update24-10-2014 14:44:10 Removed Sophos Virus Removal Tool. ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-13 19:34 - 2009-06-10 14:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {095FB0C6-E9A9-41EA-A9BC-8D357866C016} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackupTask: {30B7665D-DF20-4490-8A43-5FD7DFFD1DD5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-22] (Adobe Systems Incorporated)Task: {B204A06C-19F0-4B94-BF34-2634B444021B} - \{C76FE38C-3A2B-EECF-50C7-AC7231E67D60} No Task File <==== ATTENTIONTask: {DC1E751A-1F48-41F6-8E96-191B4CDEF83E} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-09-25] (Microsoft Corporation)Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2013-10-08 16:49 - 2013-10-08 16:49 - 00051040 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\DellMgmtNP.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00299360 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\authproxy.dll2013-10-20 14:24 - 2013-10-28 16:38 - 00097568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll2013-11-01 16:20 - 2010-09-20 07:23 - 00025600 _____ () C:\Windows\System32\acdportmon.dll2010-01-20 08:49 - 2010-01-20 08:49 - 00027648 _____ () C:\Windows\System32\sdo2ml6.dll2013-01-24 13:07 - 2013-01-24 13:07 - 00824832 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\sdo2mdu.dll2014-03-21 08:34 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00026464 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Loader.exe2014-10-22 15:26 - 2014-09-09 07:59 - 08896160 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll2013-10-08 16:49 - 2013-10-08 16:49 - 02162016 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Resources.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00025440 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Interfaces.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00081760 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Objects.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00061280 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Agent.Plugins.AuthProxy.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00066912 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Agent.Plugins.PBA.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00034656 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Agent.Plugins.SED.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00130400 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\CredSEDProxy.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00635232 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\CredCommon.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00862048 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\CryptoProvider.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00700768 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\DBManager.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00360800 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\OPALProvider.dll2013-10-08 16:49 - 2013-10-08 16:49 - 01483104 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\ConnectionProvider.dll2013-10-08 16:49 - 2013-10-08 16:49 - 00352096 _____ () C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.UXLib.dll2013-10-20 14:46 - 2013-04-19 13:51 - 00023328 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe2013-10-20 14:46 - 2013-04-19 13:52 - 00049440 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\STCommonShellIntegration.dll2013-08-07 12:27 - 2013-08-07 12:27 - 00110088 _____ () c:\Program Files (x86)\Dell Digital Delivery\ServiceTagPlusPlus.dll2013-10-20 14:34 - 2013-06-18 11:24 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll2013-10-20 14:46 - 2013-05-02 14:01 - 01813792 _____ () C:\Program Files (x86)\Dell Backup and Recovery\OLCoreWrapper.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3204AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3252AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3353AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2 ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\85826033.sys => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\85826033.sys => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRkrn => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRSVC => ""="Service" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ========================= Accounts: ========================== Administrator (S-1-5-21-815478023-2570439054-1862698040-500 - Administrator - Disabled)David Angeley (S-1-5-21-815478023-2570439054-1862698040-1001 - Administrator - Enabled) => C:\Users\David AngeleyGuest (S-1-5-21-815478023-2570439054-1862698040-501 - Limited - Disabled)HomeGroupUser$ (S-1-5-21-815478023-2570439054-1862698040-1003 - Limited - Enabled)UpdatusUser (S-1-5-21-815478023-2570439054-1862698040-1000 - Limited - Enabled) => C:\Users\UpdatusUser ==================== Faulty Device Manager Devices ============= Name: Dell 1355 MFP ScannerDescription: Dell 1355 MFP ScannerClass Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}Manufacturer: Dell Inc.Service: usbscanProblem: : This device cannot start. (Code10)Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. ==================== Event log errors: ========================= Application errors:==================Error: (10/24/2014 09:48:35 AM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: iexplore.exe, version: 11.0.9600.17344, time stamp: 0x4a5bc6b7Faulting module name: KERNELBASE.dll, version: 6.1.7601.18409, time stamp: 0x53159a86Exception code: 0xc0000005Fault offset: 0x00035dc6Faulting process id: 0x18acFaulting application start time: 0xiexplore.exe0Faulting application path: iexplore.exe1Faulting module path: iexplore.exe2Report Id: iexplore.exe3 Error: (10/24/2014 08:39:52 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/24/2014 08:39:41 AM) (Source: PerfNet) (EventID: 2004) (User: )Description: Error: (10/23/2014 07:35:43 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: iexplore.exe, version: 11.0.9600.17344, time stamp: 0x4a5bc6b7Faulting module name: MSHTML.dll, version: 11.0.9600.17344, time stamp: 0x541b8a22Exception code: 0xc00000fdFault offset: 0x00094765Faulting process id: 0x20b0Faulting application start time: 0xiexplore.exe0Faulting application path: iexplore.exe1Faulting module path: iexplore.exe2Report Id: iexplore.exe3 Error: (10/23/2014 06:18:14 PM) (Source: DellPowerManager) (EventID: 0) (User: )Description: Error from DpmPowerPlanSetup.exe PP-ODC01Message: Error code: 0xE000020B Error: (10/23/2014 01:10:55 PM) (Source: DellPowerManager) (EventID: 0) (User: )Description: Error from DpmPowerPlanSetup.exe PP-ODC01Message: Error code: 0xE000020B Error: (10/23/2014 00:38:49 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (10/23/2014 00:29:48 PM) (Source: DellPowerManager) (EventID: 0) (User: )Description: Error from DpmPowerPlanSetup.exe PP-ODC01Message: Error code: 0xE000020B Error: (10/23/2014 11:20:33 AM) (Source: DellPowerManager) (EventID: 0) (User: )Description: Error from DpmPowerPlanSetup.exe PP-ODC01Message: Error code: 0xE000020B Error: (10/23/2014 10:26:15 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors:=============Error: (10/24/2014 08:40:09 AM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (10/24/2014 08:39:21 AM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Security Innovation TCS service depends on the TPM Base Services service which failed to start because of the following error: %%0 Error: (10/24/2014 08:25:31 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)Description: The following fatal alert was generated: 40. The internal error state is 252. Error: (10/24/2014 08:25:31 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)Description: The following fatal alert was generated: 40. The internal error state is 252. Error: (10/23/2014 00:39:38 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (10/23/2014 10:26:07 AM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Security Innovation TCS service depends on the TPM Base Services service which failed to start because of the following error: %%0 Error: (10/23/2014 09:01:22 AM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Security Innovation TCS service depends on the TPM Base Services service which failed to start because of the following error: %%0 Error: (10/22/2014 03:42:48 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (10/22/2014 03:42:09 PM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Security Innovation TCS service depends on the TPM Base Services service which failed to start because of the following error: %%0 Error: (10/22/2014 03:11:16 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Microsoft Office Sessions:=========================Error: (10/24/2014 09:48:35 AM) (Source: Application Error) (EventID: 1000) (User: )Description: iexplore.exe11.0.9600.173444a5bc6b7KERNELBASE.dll6.1.7601.1840953159a86c000000500035dc618ac01cfefa9ee055f7fC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\syswow64\KERNELBASE.dll97dff2d2-5b9d-11e4-b84f-24fd52447a7a Error: (10/24/2014 08:39:52 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/24/2014 08:39:41 AM) (Source: PerfNet) (EventID: 2004) (User: )Description: Error: (10/23/2014 07:35:43 PM) (Source: Application Error) (EventID: 1000) (User: )Description: iexplore.exe11.0.9600.173444a5bc6b7MSHTML.dll11.0.9600.17344541b8a22c00000fd0009476520b001cfef32cf563b93C:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\MSHTML.dll734e7805-5b26-11e4-9400-24fd52447a7a Error: (10/23/2014 06:18:14 PM) (Source: DellPowerManager) (EventID: 0) (User: )Description: Error from DpmPowerPlanSetup.exe PP-ODC01Message: Error code: 0xE000020B Error: (10/23/2014 01:10:55 PM) (Source: DellPowerManager) (EventID: 0) (User: )Description: Error from DpmPowerPlanSetup.exe PP-ODC01Message: Error code: 0xE000020B Error: (10/23/2014 00:38:49 PM) (Source: SideBySide) (EventID: 80) (User: )Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\David Angeley\Desktop\Desktop Items\esetsmartinstaller_enu.exe Error: (10/23/2014 00:29:48 PM) (Source: DellPowerManager) (EventID: 0) (User: )Description: Error from DpmPowerPlanSetup.exe PP-ODC01Message: Error code: 0xE000020B Error: (10/23/2014 11:20:33 AM) (Source: DellPowerManager) (EventID: 0) (User: )Description: Error from DpmPowerPlanSetup.exe PP-ODC01Message: Error code: 0xE000020B Error: (10/23/2014 10:26:15 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 ==================== Memory info =========================== Processor: Intel® Core i7-4800MQ CPU @ 2.70GHzPercentage of memory in use: 49%Total physical RAM: 8131.4 MBAvailable physical RAM: 4126.18 MBTotal Pagefile: 16260.98 MBAvailable Pagefile: 11715.56 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.81 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:452.11 GB) (Free:382.05 GB) NTFSDrive y: (RECOVERY) (Fixed) (Total:13.62 GB) (Free:6.21 GB) NTFS ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ==================== End Of Log ============================ Link to post Share on other sites More sharing options...
MylesA Posted October 24, 2014 Author ID:895767 Share Posted October 24, 2014 I can't find the file C:\Windows\system32\eekhj.dll.I did a search on all of C:\windows, still did not find it. Link to post Share on other sites More sharing options...
MylesA Posted October 24, 2014 Author ID:895775 Share Posted October 24, 2014 Even more information,I have my webroot security SW still on and it came up with 8 threats in the last 1 hour (i.e between when I did the Farbar scan and virustotal attempt. Should I shut off webroot? Link to post Share on other sites More sharing options...
kevinf80 Posted October 24, 2014 ID:895779 Share Posted October 24, 2014 Leave Webroot alone for now, you have Poweliks infection so your system will be erratic until we make progress.... I`m just looking through the logs, back shortly... Link to post Share on other sites More sharing options...
kevinf80 Posted October 24, 2014 ID:895780 Share Posted October 24, 2014 Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... linkWhen the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware. Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected. In most cases, a restart will be required. Wait for the prompt to restart the computer to appear, then click on Yes. Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply. Next, Download AdwCleaner by Xplode onto your Desktop. Double click on Adwcleaner.exe to run the tool. Click on Scan Once the scan is done, click on the Clean button. You will get a prompt asking to close all programs. Click OK. Click OK again to reboot your computer. A text file will open after the restart. Please post the content of that logfile in your reply. You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number Next, Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid potential conflicts. (re-enable when done)Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".The tool will open and start scanning your system.Please be patient as this can take a while to complete depending on your system's specifications.On completion, a log (JRT.txt) is saved to your desktop and will automatically open.Post the contents of JRT.txt into your next message. Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktopEnsure to get the correct version for your system.... 32 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en64 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en Right click on the Tool, select “Run as Administrator” the tool will expand to the options WindowIn the "Scan Type" window, select Quick ScanPerform a scan and Click Finish when the scan is done.Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\mrt.log Post those logs to next reply, also let me know if there is any improvement,,, Kevin Fixlist.txt Link to post Share on other sites More sharing options...
MylesA Posted October 25, 2014 Author ID:895829 Share Posted October 25, 2014 Ok the Fixlist is still running - it has been running for over an hour. It's all on my desktop and there is a window that says: Farbar Recovery Scan Tool Fixing is in progress. Please wait ... That is alternating with another window (that keeps overwriting) that says: Farbar Recovery Scan Tool (Not Responding) Fixing is in progress. Note the (Not responding) part and the Please wait. So I am not sure it is done But it did write a fixlog.txt file and this is what it says:Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-10-2014Ran by David Angeley at 2014-10-24 16:32:21 Run:1Running from C:\Users\David Angeley\DesktopLoaded Profiles: UpdatusUser & David Angeley (Available profiles: UpdatusUser & David Angeley)Boot Mode: Normal============================================== Content of fixlist:*****************StartHKU\S-1-5-21-815478023-2570439054-1862698040-1001\...\MountPoints2: {a7ff626e-52d2-11e3-bdbb-24fd52447a7a} - "E:\WD Drive Unlock.exe" autoplay=trueHKU\S-1-5-21-815478023-2570439054-1862698040-1001\...\MountPoints2: {daaaa67a-39dc-11e3-aabd-806e6f6e6963} - D:\mri.exeHKU\S-1-5-21-815478023-2570439054-1862698040-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!CustomCLSID: HKU\S-1-5-21-815478023-2570439054-1862698040-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?Task: {B204A06C-19F0-4B94-BF34-2634B444021B} - \{C76FE38C-3A2B-EECF-50C7-AC7231E67D60} No Task File <==== ATTENTIONAlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3204AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3252AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3353AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2C:\Windows\system32\eekhj.dllEmptyTemp:End ***************** "HKU\S-1-5-21-815478023-2570439054-1862698040-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7ff626e-52d2-11e3-bdbb-24fd52447a7a}" => Key deleted successfully."HKCR\CLSID\{a7ff626e-52d2-11e3-bdbb-24fd52447a7a}" => Key not found."HKU\S-1-5-21-815478023-2570439054-1862698040-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{daaaa67a-39dc-11e3-aabd-806e6f6e6963}" => Key deleted successfully."HKCR\CLSID\{daaaa67a-39dc-11e3-aabd-806e6f6e6963}" => Key not found."HKU\S-1-5-21-815478023-2570439054-1862698040-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32" => Key deleted successfully."HKU\S-1-5-21-815478023-2570439054-1862698040-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key deleted successfully."HKU\S-1-5-21-815478023-2570439054-1862698040-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key not found."HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B204A06C-19F0-4B94-BF34-2634B444021B}" => Key deleted successfully."HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B204A06C-19F0-4B94-BF34-2634B444021B}" => Key deleted successfully."HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C76FE38C-3A2B-EECF-50C7-AC7231E67D60}" => Key deleted successfully.C:\Windows\SysWOW64\MSIHANDLE => ":3204" ADS removed successfully.C:\Windows\SysWOW64\MSIHANDLE => ":3252" ADS removed successfully.C:\Windows\SysWOW64\MSIHANDLE => ":3353" ADS removed successfully.C:\ProgramData\TEMP => ":DFC5A2B2" ADS removed successfully.C:\Windows\system32\eekhj.dll => Moved successfully. I still have fixlist still running and have not gone to the other steps yet Link to post Share on other sites More sharing options...
MylesA Posted October 25, 2014 Author ID:895871 Share Posted October 25, 2014 Things are working much better. No Malicious Website popups are appearing and my system is running quiet and efficiently. Here is what I did: After 2 hours, I stop the fixlist.txt. I had to stop it thru the task manager. But it looked like it did something and I have posted the Fixlog.txt below. then I did the MBAM scan - no threats were detected and therefore no history file then I did adwcleaner - the txt file is pasted below then JRT - txt file pasted below then the MS tool - mrt.log pasted below - Fixlog.txtFix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-10-2014Ran by David Angeley at 2014-10-24 16:32:21 Run:1Running from C:\Users\David Angeley\DesktopLoaded Profiles: UpdatusUser & David Angeley (Available profiles: UpdatusUser & David Angeley)Boot Mode: Normal============================================== Content of fixlist:*****************StartHKU\S-1-5-21-815478023-2570439054-1862698040-1001\...\MountPoints2: {a7ff626e-52d2-11e3-bdbb-24fd52447a7a} - "E:\WD Drive Unlock.exe" autoplay=trueHKU\S-1-5-21-815478023-2570439054-1862698040-1001\...\MountPoints2: {daaaa67a-39dc-11e3-aabd-806e6f6e6963} - D:\mri.exeHKU\S-1-5-21-815478023-2570439054-1862698040-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!CustomCLSID: HKU\S-1-5-21-815478023-2570439054-1862698040-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?Task: {B204A06C-19F0-4B94-BF34-2634B444021B} - \{C76FE38C-3A2B-EECF-50C7-AC7231E67D60} No Task File <==== ATTENTIONAlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3204AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3252AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3353AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2C:\Windows\system32\eekhj.dllEmptyTemp:End ***************** "HKU\S-1-5-21-815478023-2570439054-1862698040-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7ff626e-52d2-11e3-bdbb-24fd52447a7a}" => Key deleted successfully."HKCR\CLSID\{a7ff626e-52d2-11e3-bdbb-24fd52447a7a}" => Key not found."HKU\S-1-5-21-815478023-2570439054-1862698040-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{daaaa67a-39dc-11e3-aabd-806e6f6e6963}" => Key deleted successfully."HKCR\CLSID\{daaaa67a-39dc-11e3-aabd-806e6f6e6963}" => Key not found."HKU\S-1-5-21-815478023-2570439054-1862698040-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32" => Key deleted successfully."HKU\S-1-5-21-815478023-2570439054-1862698040-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key deleted successfully."HKU\S-1-5-21-815478023-2570439054-1862698040-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key not found."HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B204A06C-19F0-4B94-BF34-2634B444021B}" => Key deleted successfully."HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B204A06C-19F0-4B94-BF34-2634B444021B}" => Key deleted successfully."HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C76FE38C-3A2B-EECF-50C7-AC7231E67D60}" => Key deleted successfully.C:\Windows\SysWOW64\MSIHANDLE => ":3204" ADS removed successfully.C:\Windows\SysWOW64\MSIHANDLE => ":3252" ADS removed successfully.C:\Windows\SysWOW64\MSIHANDLE => ":3353" ADS removed successfully.C:\ProgramData\TEMP => ":DFC5A2B2" ADS removed successfully.C:\Windows\system32\eekhj.dll => Moved successfully. adwCleaner.txtadw# AdwCleaner v4.001 - Report created 24/10/2014 at 18:52:54# DB v2014-10-23.2# Updated 20/10/2014 by Xplode# Operating System : Windows 7 Professional Service Pack 1 (64 bits)# Username : David Angeley - GIGANTOR# Running from : C:\Users\David Angeley\Desktop\AdwCleaner.exe# Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** ***** [ Scheduled Tasks ] ***** ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536 ***** [ Browsers ] ***** -\\ Internet Explorer v11.0.9600.17344 ************************* AdwCleaner[R0].txt - [941 octets] - [10/10/2014 23:03:20]AdwCleaner[R1].txt - [814 octets] - [11/10/2014 07:12:23]AdwCleaner[R2].txt - [1230 octets] - [24/10/2014 18:51:07]AdwCleaner[s0].txt - [1009 octets] - [10/10/2014 23:04:20]AdwCleaner[s1].txt - [874 octets] - [11/10/2014 07:13:14]AdwCleaner[s2].txt - [1141 octets] - [24/10/2014 18:52:54] ########## EOF - C:\AdwCleaner\AdwCleaner[s2].txt - [1201 octets] ########## JRT.txt~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by ThisisuVersion: 6.3.3 (10.21.2014:1)OS: Windows 7 Professional x64Ran by David Angeley on Fri 10/24/2014 at 19:08:44.29~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Scan was completed on Fri 10/24/2014 at 19:09:56.78End of JRT log~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mrt.log--------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.16, September 2014 (build 5.16.10602.0)Started On Sat Oct 04 12:47:42 2014 Engine: 1.1.10904.0Signatures: 1.183.882.0 Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Sat Oct 04 13:02:38 2014 Return code: 0 (0x0) ---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.17, October 2014 (build 5.17.10700.0)Started On Tue Oct 21 13:03:43 2014 Engine: 1.1.11005.0Signatures: 1.185.2035.0 Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Tue Oct 21 13:09:12 2014 Return code: 0 (0x0) ---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.17, October 2014 (build 5.17.10700.0)Started On Fri Oct 24 19:15:05 2014 Engine: 1.1.11005.0Signatures: 1.185.2035.0 Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Fri Oct 24 19:17:31 2014 Return code: 0 (0x0) Link to post Share on other sites More sharing options...
kevinf80 Posted October 25, 2014 ID:895976 Share Posted October 25, 2014 Thanks for the logs and update, one final scan to ensure your system is clean: We still need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete: Run Eset Online Scanner **Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin. (To run ESET Online Scanner in a browser other than Internet Explorer, you'll need to download ESET SMART Installer during the process) Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET. Turn off the real time scanner of any existing antivirus program while performing the online scan click on the Run ESET Online Scanner button Tick the box next to YES, I accept the Terms of Use.Click Start When asked, allow the add/on to be installedClick Start Make sure that the option "Remove found threats" is UNticked Click on Advanced Settings, ensure the following options are checked: Scan for potentially unsafe applicationsEnable Anti-Stealth Technology Click Scan wait for the virus definitions to be downloaded Wait for the scan to finish When the scan is complete If no threats were found put a checkmark in "Uninstall application on close" close program report to me that nothing was found If threats were found click on "list of threats found" click on "export to text file" and save it as ESET SCAN and save to the desktop Click on back put a checkmark in "Uninstall application on close" click on finish close program Copy and paste the report in next reply. Thank you, Kevin... Link to post Share on other sites More sharing options...
MylesA Posted October 25, 2014 Author ID:896237 Share Posted October 25, 2014 Kevin I did the ESET - It took about 30 minutes to scan.No threats were found. Computer seems to be working very nicely. Am I clean? Myles Link to post Share on other sites More sharing options...
kevinf80 Posted October 25, 2014 ID:896241 Share Posted October 25, 2014 Yep if ESET is clean you should be good to go, run the following to clean up... Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Activate UAC Remove disinfection tools Create registry backup Purge System Restore Reset system settings Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Part of the routine will be to create a registry back up with ERUNT, the back up will be created here: C:\Windows\ERUNT When all is known to be well with your system you can delete that back up folder if you consider it as not needed... Any remnant files/logs from tools we have used can be deleted… Next, Read the following link to fully understand PC security and best practices, you may find it useful.... http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629 Let me know if we are ok to close out... Thanks, Kevin... Link to post Share on other sites More sharing options...
MylesA Posted October 25, 2014 Author ID:896343 Share Posted October 25, 2014 Kevin I followed your last instructions and cleaned up. Everything is working well. I am not getting any Malicious Website warning, the hard drive is quiet, and my home network is stable. I have restarted the computer and nothing bad returns. I hesitate a little to speak too soon but it appears I am clean. Thank You Very much for your help! I have been struggling with this for a few weeks. I tried DIY following several other threads and although I made some progress in identifying the problem and temporarily deleting trojans, I found I could not achieve a lasting fix. I was even desperate enough to use the local GeekSquad, thinking they had offline techniques that could be more effective. They had my computer for 4 days and thought they solved the problem but when I got the computer home and ran Mbam, the malicious websites appeared within a few hours of operation. Not that Mbam actually detected the root cause threat, but it did detect that something was wrong. And I could tell something was wrong too because my computer was slow and the network was overtaxed. I was on the verge of reformating the hard drive (someone actually recommended that I should 'replace' the hard drive) but figured I would give this forum a chance. I think that was a good decision. It looks like I needed to be walked through it with steps aimed at my specific system - a broad brush solution was not going to work. And you provided that guidance - quite excellently. A bit of a ramble but bottom line - Thanks Myles Link to post Share on other sites More sharing options...
kevinf80 Posted October 25, 2014 ID:896348 Share Posted October 25, 2014 Your system was infected with Poweliks, this is a nasty infection that cannot be found by traditional methods or security programs. Malwarebytes does indicate there are definite problems that need action. Read the following links regarding Poweliks: http://www.ibtimes.co.uk/new-poweliks-stealth-fileless-malware-prowl-hides-within-your-systems-registry-undetected-1459738 https://blog.gdatasoftware.com/blog/article/poweliks-the-persistent-malware-without-a-file.html We are fortunate enough to have access to the excellent tool FRST by developer Farbar, that tool does find and kill Poweliks as was done on your system.I`m sure the usual security firms will catch up and normal system protection programs will identify and block Poweliks eventually. Take care and surf safe, Kevin.... Link to post Share on other sites More sharing options...
MylesA Posted October 28, 2014 Author ID:897838 Share Posted October 28, 2014 Kevin Still looking good.If you have not already, I think you can close this out. Thanks Link to post Share on other sites More sharing options...
kevinf80 Posted October 28, 2014 ID:897972 Share Posted October 28, 2014 Thanks for the update, will close out shortly,,, Kevin.... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 1, 2014 Root Admin ID:900557 Share Posted November 1, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts