Malware removal assistance needed

organictomato · January 16, 2015

Hi,

Second attempt at this post as "froze" on log paste window.... so now attached files...

Have tried to remove " reimage " on a number of occasions, but keeps coming back... also a extension on chrome, I suspect as a problem also returns after deleting/ removing...

as two particular pup files being quarantined repeatedly and removed.... with MBAM and another malware site actually listing itself on your exclusion website list ?

I await your response, thanks.

Jim

Australia Time zone.

FRST.txt Addition.txt

Naathim · January 16, 2015

Minion%20Welcome.jpg

My name's Naathim and I'm a GeekU Minion! Now that we are mates and will be working together to clean your machine out of any junkware, feel free to call me Naat

Before we start please note the following:

Analysis and research take some time, also sometimes real life gets in the way, please be patient.
Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
Paste the logs in your posts, attachments make my work harder and more complicated.
Stay with me to the end, the absence of symtoms doesn't mean that your machine is fully operational.
Note that we may live in totally different time zones, what may cause some delays between answers.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Let's start and enjoy the fight!

Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

51a46ae42d560-malwarebytes_anti_malware. Scan with Malwarebytes' Anti-Malware

Please download and install Malwarebytes Anti-Malware, or re-run it if you already have it installed.

First of all select update.
Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
Click the Scan tab, choose Threat Scan is checked and click Scan Now.
If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
Upon completion of the scan (or after the reboot), click the History tab.
Click Application Logs and double-click the Scan Log.
At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

IOBit software warning!

I see that you are running some IOBit software. Although legitimate one, IOBit as a vendor is considered a rogue one here due to stealing Malwarebytes' interllectual property. This is only an information and a polite request to refrain from using its software. Whether you decide to do it or not, it's your call, but Advanced System Care and other like this are never recommended by the true experts.

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.

In the main box please paste in the following script:

createsrpoint;autoclean;{33BB0A4E-99AF-4226-BDF6-49120163DE86};c{72EB4AE9-791A-826E-0765-1F291AD05049};c{A5B7E8EE-FE3E-4882-A6E1-A1CF431A0FC3};c{397AF45F-48C7-ADC4-21F2-0109E175AA3B};cgpailjkghfjdfeginpcebppcnhggbkin;chremptyclsid;AppleChargerSrv;sC:\Windows\System32\AppleChargerSrv.exe;fAppleCharger;sC:\Windows\System32\DRIVERS\AppleCharger.sys;f

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Please include its content in your next reply.

Don't forget to re-enable your switched-off protection software!

organictomato · January 16, 2015

Hi Naat,

Thanks for taking the time out to help.

files as requested...

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 17/01/2015

Scan Time: 9:24:41 AM

Logfile: scan log 1.txt

Administrator: Yes

Version: 0.00.0.0000

Malware Database: v2015.01.16.14

Rootkit Database: v2015.01.14.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Jim

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 371865

Time Elapsed: 9 min, 39 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

Zoek.exe v5.0.0.0 Updated 15-01-2015

Tool run by Jim on Sat 17/01/2015 at 9:52:58.96.

Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Jim\Downloads\zoek.exe [scan all users] [script inserted]

==== System Restore Info ======================

17/01/2015 9:55:26 AM Zoek.exe System Restore Point Created Succesfully.

==== Empty Folders Check ======================

C:\PROGRA~2\AGEIA Technologies deleted successfully

C:\PROGRA~2\MSXML 4.0 deleted successfully

C:\PROGRA~2\NewBlue deleted successfully

C:\PROGRA~3\934bcbfe-35c5-4039-88e2-8d1494de198e deleted successfully

C:\PROGRA~3\dcc1157c-0575-4f3a-b001-af9a2dcc0614 deleted successfully

C:\PROGRA~3\eSafe deleted successfully

C:\PROGRA~3\Oracle deleted successfully

C:\PROGRA~3\PopCapY deleted successfully

C:\PROGRA~3\Splashtop deleted successfully

C:\PROGRA~3\ZoomBrowser deleted successfully

C:\PROGRA~3\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A} deleted successfully

C:\Users\Jim\AppData\Roaming\1O1L1I1PtF1F1C1N deleted successfully

C:\Users\Jim\AppData\Roaming\Activeris deleted successfully

C:\Users\Jim\AppData\Roaming\Publish Providers deleted successfully

C:\Users\Jim\AppData\Roaming\Splashtop deleted successfully

C:\Users\Jim\AppData\Local\Sparta deleted successfully

C:\Users\Jim\AppData\Local\WorldofTanks deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} deleted successfully

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{72EB4AE9-791A-826E-0765-1F291AD05049} deleted successfully

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Internet Explorer\SearchScopes\{72EB4AE9-791A-826E-0765-1F291AD05049} deleted successfully

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A5B7E8EE-FE3E-4882-A6E1-A1CF431A0FC3} deleted successfully

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} deleted successfully

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Internet Explorer\SearchScopes\{EF43DDA6-15AF-4165-9257-B033520D64CD} deleted successfully

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{45D30484-7DED-43D9-957A-D2FD1F046511} deleted successfully

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6BF8123F-3009-498A-B607-1A0248967789} deleted successfully

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6BF8123F-3009-498A-B607-1A0248967789} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{45D30484-7DED-43D9-957A-D2FD1F046511} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{1D09C093-F71E-43C3-B948-19316CBD695E} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{6BF8123F-3009-498A-B607-1A0248967789} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{6BF8123F-3009-498A-B607-1A0248967789} deleted successfully

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppleChargerSrv deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\AppleChargerSrv deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppleCharger deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\AppleCharger deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ReimageRealTimeProtector deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ReimageRealTimeProtector deleted successfully

==== Deleting Files \ Folders ======================

C:\PROGRA~3\934bcbfe-35c5-4039-88e2-8d1494de198e not found

C:\PROGRA~3\dcc1157c-0575-4f3a-b001-af9a2dcc0614 not found

C:\PROGRA~3\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A} not found

C:\PROGRA~3\gpailjkghfjdfeginpcebppcnhggbkin deleted

C:\PROGRA~3\12880955223089693821 deleted

C:\PROGRA~2\uniisaelles deleted

C:\PROGRA~2\Free Video Converter deleted

C:\PROGRA~2\Movdap deleted

C:\Program Files\Reimage deleted

C:\PROGRA~2\globalUpdate deleted

C:\Users\Jim\AppData\Roaming\WB.CFG deleted

C:\Users\Jim\AppData\Roaming\FreeVideoConverter deleted

C:\Users\Jim\AppData\Roaming\MAGIX deleted

C:\Users\Jim\AppData\Roaming\Movdap deleted

C:\Users\Jim\AppData\Roaming\Web Cake deleted

C:\Users\Jim\AppData\Roaming\DriverCure deleted

C:\Users\Jim\AppData\Roaming\YoudaGames deleted

C:\Users\Jim\AppData\Roaming\Systweak deleted

C:\PROGRA~3\Reimage Protector deleted

C:\PROGRA~3\ProductData deleted

C:\PROGRA~3\MAGIX deleted

C:\PROGRA~3\InstallMate deleted

C:\PROGRA~3\Tarma Installer deleted

C:\PROGRA~3\Package Cache deleted

C:\PROGRA~3\SummerSoft deleted

C:\Users\Jim\AppData\Local\FileTypeAssistant deleted

C:\Users\Jim\AppData\Local\globalUpdate deleted

C:\Windows\sysWoW64\config\systemprofile\AppData\Local\FileTypeAssistant deleted

C:\windows\SysNative\Tasks\LaunchApp deleted

C:\rei deleted

C:\Users\Jim\AppData\LocalLow\ADSRemoval deleted

C:\windows\SysNative\tasks\ReimageUpdater deleted

C:\windows\SysNative\Tasks\Reimage Reminder deleted

C:\END deleted

"C:\windows\SysNative\AppleChargerSrv.exe" deleted

"C:\windows\SysNative\DRIVERS\AppleCharger.sys" deleted

==== Chromium Look ======================

Google Chrome Version: 39.0.2171.95 (Possible outdated, latest Stable version: 39.0.2171.99)

Google Docs - Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake

Google Drive - Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf

Advanced SystemCare Surfing Protection - Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd

Google Voice Search Hotword (Beta) - Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn

YouTube - Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo

Google Search - Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf

AdBlock - Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom

Google Wallet - Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

Gmail - Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Chromium Startpages ======================

C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Preferences

"startup_urls": [ "https://www.google.com.au/" ],

==== Chromium Fix ======================

C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pckeeperapp.zeobit.com_0.localstorage deleted successfully

C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage deleted successfully

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="https://www.google.com.au/?gfe_rd=cr&ei=TcChVL7XEsiN8Qef9ICYDw&gws_rd=ssl"

"Use Search Asst"="yes"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]

"Default"="www.google.com"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]

"Default"="www.google.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]

"Default"="www.google.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="www.google.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="www.google.com"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="https://www.google.com.au/?gfe_rd=cr&ei=TcChVL7XEsiN8Qef9ICYDw&gws_rd=ssl"

"Use Search Asst"="no"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="res://ieframe.dll/tabswelcome.htm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="res://ieframe.dll/tabswelcome.htm"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"

{33BB0A4E-99AF-4226-BDF6-49120163DE86} qvo6 Url="http://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=HitachiXHDS721010CLA630_JPS930N11SHN1L1SHN1LX&ts=1380665699&type=default&q={searchTerms}"

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WsysControl deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Jim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Jim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully

C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=141 folders=77 46209942 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully

C:\Users\Default User\AppData\Local\Temp emptied successfully

C:\Users\Jim\AppData\Local\Temp will be emptied at reboot

C:\Users\UpdatusUser\AppData\Local\Temp emptied successfully

C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully

C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied

C:\Users\Jim\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on Sat 17/01/2015 at 10:15:44.75 ======================

I await your reply, thank you.

Jim

Naathim · January 16, 2015

Hello

Scan with ZOEK

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.

In the main box please paste in the following script:

createsrpoint;{33BB0A4E-99AF-4226-BDF6-49120163DE86};cprocesses;drivers-services-list;systemspecs;filesrcm;startupall;skipfix-iedefaults;firefoxlook;chromelook;installedprogs;

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Please include its content in your next reply.

Don't forget to re-enable your switched-off protection software!

organictomato · January 17, 2015

Hi Naat,

Next installment... file

also I note in the log report .....under - "installed programs" - Advertising center......... have no idea what this is or where it came from...

and I see "Reimage RealTime Protector" - mentioned in the startup registry disabled x64

...Log File:-

Zoek.exe v5.0.0.0 Updated 15-01-2015

Tool run by Jim on Sat 17/01/2015 at 14:25:28.23.

Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Jim\Downloads\zoek.exe [scan all users] [script inserted]

==== Older Logs ======================

C:\zoek-results2015-01-16-231544.log 13185 bytes

==== System Restore Info ======================

17/01/2015 2:26:37 PM Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Installed Programs ======================

@BIOS

Adobe Flash Player 16 ActiveX

Adobe Flash Player 16 NPAPI

Adobe Reader XI (11.0.10)

Advanced SystemCare 8

Advertising Center

ArcSoft PhotoStudio 5.5

AutoGreen B10.1021.1

AVG 2014

BlueStacks App Player

Bookworm Deluxe 1.13

Canon CanoScan Toolbox 5.0

Canon MOV Decoder

Canon Utilities CameraWindow

Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX

Canon Utilities Digital Photo Professional 3.5

Canon Utilities EOS Utility

Canon Utilities MyCamera

Canon Utilities PhotoStitch

Canon Utilities Picture Style Editor

Canon Utilities RemoteCapture Task for ZoomBrowser EX

Canon Utilities WFT-E1/E2/E3/E4 Utility

Canon Utilities ZoomBrowser EX

Canon ZoomBrowser EX Memory Card Utility

CanoScan LiDE 70

Cinescore Studio 1.0

D3DX10

Debut Video Capture Software

DES 2.0

Dolby Home Theater v4

Driver Booster 2.1

Easy Tune 6 B11.0823.1

EasyWeatherPlus

Endless Legend

Etron USB3.0 Host Controller

Express Burn

GIMP 2.8.6

Golden Dozen Solitaire

Google Chrome

Google Earth

Google Update Helper

Graboid Video 4.5

Humanized Enso

ImagXpress

Intel® Control Center

Intel® Management Engine Components

Intel® Processor Graphics

IObit Malware Fighter

IObit Uninstaller

Java 7 Update 72

Java Auto Updater

Junk Mail filter update

K-Lite Codec Pack 3.3.0 Full

MAGIX 3D Maker 6.0.0.12 (UK)

Malwarebytes Anti-Malware version 2.0.4.1028

Menu Templates - Starter Kit

Microsoft .NET Framework 4.5.1 RC

Microsoft Application Error Reporting

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610

Microsoft Windows Media Video 9 VCM

Movie Templates - Starter Kit

MSVCRT

MSVCRT_amd64

MSVCRT110

MSVCRT110_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero 9 Essentials

Nero BurnRights

Nero BurnRights Help

Nero ControlCenter

Nero CoverDesigner

Nero CoverDesigner Help

Nero Disc Copy Gadget

Nero Disc Copy Gadget Help

Nero DiscSpeed

Nero DiscSpeed Help

Nero DriveSpeed

Nero DriveSpeed Help

Nero Express Help

Nero InfoTool

Nero InfoTool Help

Nero Installer

Nero Online Upgrade

Nero Rescue Agent

Nero RescueAgent Help

Nero ShowTime

Nero StartSmart

Nero StartSmart Help

Nero Vision

Nero Vision Help

NeroExpress

neroxml

NVIDIA 3D Vision Controller Driver

NVIDIA 3D Vision Controller Driver 280.19

NVIDIA 3D Vision Driver 311.06

NVIDIA Control Panel 311.06

NVIDIA Graphics Driver 311.06

NVIDIA HD Audio Driver 1.2.23.3

NVIDIA Install Application

NVIDIA PhysX

NVIDIA Stereoscopic 3D Driver

NVIDIA Update 1.11.3

NVIDIA Update Components

ON_OFF Charge B11.0110.1

OpenOffice.org 2.3

Peggle Deluxe 1.01

Photo Common

Pinball FX2

Plants vs. Zombies

PlayMemories Home

Presto PageManager 7.15.14

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

Security Update for CAPICOM (KB931906)

Sid Meier's Ace Patrol: Pacific Skies

Sid Meier's Civilization V

Smart 6 B11.0824.1

Smart Defrag 3

Sony DVD Architect Studio 4.5

Sony Sound Forge Audio Studio 9.0

Space Empires IV Deluxe

Space Empires V

Steam

Surfing Protection

Sword of the Stars Complete Collection

Sword of the Stars II: Enhanced Edition

Total War: ROME II - Emperor Edition

TouchBIOS B11.0824.1

Vegas Movie Studio Platinum 9.0

VideoPad Video Editor

Visual Studio 2010 x64 Redistributables

Visual Studio 2012 x64 Redistributables

Visual Studio 2012 x86 Redistributables

VLC media player 2.0.8

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Mail

Windows Live MIME IFilter

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Zuma's Revenge

==== Services(whitelist) ======================

Powered by E Dev

R2 - [AdobeARMservice] - Adobe Acrobat Update Service - c:\program files (x86)\common files\adobe\arm\1.0\armsvc.exe

R2 - [avgfws] - AVG Firewall - c:\program files (x86)\avg\avg2014\avgfws.exe

R2 - [AVGIDSAgent] - AVGIDSAgent - c:\program files (x86)\avg\avg2014\avgidsagent.exe

R2 - [avgwd] - AVG WatchDog - c:\program files (x86)\avg\avg2014\avgwdsvc.exe

R2 - [bstHdLogRotatorSvc] - BlueStacks Log Rotator Service - c:\program files (x86)\bluestacks\hd-logrotatorservice.exe

R2 - [bstHdUpdaterSvc] - BlueStacks Updater Service - c:\program files (x86)\bluestacks\hd-updaterservice.exe

R2 - [iMFservice] - IMF Service - c:\program files (x86)\iobit\iobit malware fighter\imfsrv.exe

R2 - [Nero BackItUp Scheduler 4.0] - Nero BackItUp Scheduler 4.0 - c:\program files (x86)\common files\nero\nero backitup 4\nbservice.exe

R2 - [nvsvc] - NVIDIA Display Driver Service - c:\windows\system32\nvvsvc.exe

R2 - [PMBDeviceInfoProvider] - PMBDeviceInfoProvider - c:\program files (x86)\sony\playmemories home\pmbdeviceinfoprovider.exe

R2 - [stereo Service] - NVIDIA Stereoscopic 3D Driver Service - c:\program files (x86)\nvidia corporation\3d vision\nvscpapisvr.exe

R2 - [wlidsvc] - Windows Live ID Sign-in Assistant - c:\program files\common files\microsoft shared\windows live\wlidsvc.exe

R2 - [WMPNetworkSvc] - Windows Media Player Network Sharing Service - c:\program files\windows media player\wmpnetwk.exe

R2 - [WSearch] - Windows Search - c:\windows\system32\searchindexer.exe

R3 - [steam Client Service] - Steam Client Service - c:\program files (x86)\common files\steam\steamservice.exe

R3 - [VSS] - Volume Shadow Copy - c:\windows\system32\vssvc.exe

S2 - [bstHdAndroidSvc] - BlueStacks Android Service - c:\program files (x86)\bluestacks\hd-service.exe

S2 - [clr_optimization_v4.0.30319_32] - Microsoft .NET Framework NGEN v4.0.30319_X86 - c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe

S2 - [clr_optimization_v4.0.30319_64] - Microsoft .NET Framework NGEN v4.0.30319_X64 - c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe

S2 - [gupdate] - Google Update Service (gupdate) - c:\program files (x86)\google\update\googleupdate.exe

S2 - [LiveUpdateSvc] - LiveUpdate - c:\program files (x86)\iobit\liveupdate\liveupdate.exe

S2 - [nvUpdatusService] - NVIDIA Update Service Daemon - c:\program files (x86)\nvidia corporation\nvidia update core\daemonu.exe

S2 - [sppsvc] - Software Protection - c:\windows\system32\sppsvc.exe

S3 - [AdobeFlashPlayerUpdateSvc] - Adobe Flash Player Update Service - c:\windows\syswow64\macromed\flash\flashplayerupdateservice.exe

S3 - [ALG] - Application Layer Gateway Service - c:\windows\system32\alg.exe

S3 - [aspnet_state] - ASP.NET State Service - c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

S3 - [clr_optimization_v2.0.50727_32] - Microsoft .NET Framework NGEN v2.0.50727_X86 - c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe

S3 - [clr_optimization_v2.0.50727_64] - Microsoft .NET Framework NGEN v2.0.50727_X64 - c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe

S3 - [COMSysApp] - COM+ System Application - c:\windows\system32\dllhost.exe

S3 - [ehRecvr] - Windows Media Center Receiver Service - c:\windows\ehome\ehrecvr.exe

S3 - [ehSched] - Windows Media Center Scheduler Service - c:\windows\ehome\ehsched.exe

S3 - [Fax] - Fax - c:\windows\system32\fxssvc.exe

S3 - [FontCache3.0.0.0] - Windows Presentation Foundation Font Cache 3.0.0.0 - c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe

S3 - [gupdatem] - Google Update Service (gupdatem) - c:\program files (x86)\google\update\googleupdate.exe

S3 - [iEEtwCollectorService] - Internet Explorer ETW Collector Service - c:\windows\system32\ieetwcollector.exe

S3 - [MSDTC] - Distributed Transaction Coordinator - c:\windows\system32\msdtc.exe

S3 - [msiserver] - Windows Installer - c:\windows\system32\msiexec.exe

S3 - [PerfHost] - Performance Counter DLL Host - c:\windows\syswow64\perfhost.exe

S3 - [RpcLocator] - Remote Procedure Call (RPC) Locator - c:\windows\system32\locator.exe

S3 - [TrustedInstaller] - Windows Modules Installer - c:\windows\servicing\trustedinstaller.exe

S3 - [vds] - Virtual Disk - c:\windows\system32\vds.exe

S3 - [WatAdminSvc] - Windows Activation Technologies Service - c:\windows\system32\wat\watadminsvc.exe

S3 - [wbengine] - Block Level Backup Engine Service - c:\windows\system32\wbengine.exe

S3 - [wmiApSrv] - WMI Performance Adapter - c:\windows\system32\wbem\wmiapsrv.exe

S4 - [sNMPTRAP] - SNMP Trap - c:\windows\system32\snmptrap.exe

==== Drivers(whitelist) ======================

Powered by E Dev

R0 - [AVGIDSHA] - AVGIDSHA - C:\Windows\system32\Drivers\AVGIDSHA.sys

R0 - [Avgloga] - AVG Logging Driver - C:\Windows\system32\Drivers\Avgloga.sys

R0 - [Avgmfx64] - AVG Mini-Filter Resident Anti-Virus Shield - C:\Windows\system32\Drivers\Avgmfx64.sys

R0 - [Avgrkx64] - AVG Anti-Rootkit Driver - C:\Windows\system32\Drivers\Avgrkx64.sys

R0 - [FileInfo] - File Information FS MiniFilter - C:\Windows\system32\Drivers\FileInfo.sys

R0 - [FltMgr] - FltMgr - C:\Windows\system32\Drivers\FltMgr.sys

R0 - [MBAMSwissArmy] - MBAMSwissArmy - C:\Windows\system32\Drivers\MBAMSwissArmy.sys

R0 - [Mup] - Mup - C:\Windows\system32\Drivers\Mup.sys

R1 - [NetBIOS] - NetBIOS Interface - C:\Windows\system32\Drivers\NetBIOS.sys

R3 - [srv] - Server SMB 1.xxx Driver - C:\Windows\system32\Drivers\srv.sys

R3 - [srv2] - Server SMB 2.xxx Driver - C:\Windows\system32\Drivers\srv2.sys

R0 - [ACPI] - Microsoft ACPI Driver - C:\Windows\system32\Drivers\ACPI.sys

R0 - [amdxata] - amdxata - C:\Windows\system32\Drivers\amdxata.sys

R0 - [atapi] - IDE Channel - C:\Windows\system32\Drivers\atapi.sys

R0 - [CLFS] - Common Log (CLFS) - C:\Windows\system32\Drivers\CLFS.sys [x]

R0 - [CNG] - CNG - C:\Windows\system32\Drivers\CNG.sys

R0 - [Disk] - Disk Driver - C:\Windows\system32\Drivers\Disk.sys

R0 - [fvevol] - Bitlocker Drive Encryption Filter Driver - C:\Windows\system32\Drivers\fvevol.sys

R0 - [hwpolicy] - Hardware Policy Driver - C:\Windows\system32\Drivers\hwpolicy.sys

R0 - [KSecDD] - KSecDD - C:\Windows\system32\Drivers\KSecDD.sys

R0 - [KSecPkg] - KSecPkg - C:\Windows\system32\Drivers\KSecPkg.sys

R0 - [mountmgr] - Mount Point Manager - C:\Windows\system32\Drivers\mountmgr.sys

R0 - [msisadrv] - msisadrv - C:\Windows\system32\Drivers\msisadrv.sys

R0 - [NDIS] - NDIS System Driver - C:\Windows\system32\Drivers\NDIS.sys

R0 - [partmgr] - Partition Manager - C:\Windows\system32\Drivers\partmgr.sys

R0 - [pci] - PCI Bus Driver - C:\Windows\system32\Drivers\pci.sys

R0 - [pciide] - pciide - C:\Windows\system32\Drivers\pciide.sys

R0 - [pcw] - Performance Counters for Windows Driver - C:\Windows\system32\Drivers\pcw.sys

R0 - [rdyboost] - ReadyBoost - C:\Windows\system32\Drivers\rdyboost.sys

R0 - [smartDefragDriver] - SmartDefragDriver - C:\Windows\system32\Drivers\SmartDefragDriver.sys

R0 - [spldr] - Security Processor Loader Driver - C:\Windows\system32\Drivers\spldr.sys

R0 - [storflt] - Disk Virtual Machine Bus Acceleration Filter Driver - C:\Windows\system32\Drivers\storflt.sys [x]

R0 - [Tcpip] - TCP/IP Protocol Driver - C:\Windows\system32\Drivers\Tcpip.sys

R0 - [vdrvroot] - Microsoft Virtual Drive Enumerator Driver - C:\Windows\system32\Drivers\vdrvroot.sys

R0 - [volmgr] - Volume Manager Driver - C:\Windows\system32\Drivers\volmgr.sys

R0 - [volmgrx] - Dynamic Volume Manager - C:\Windows\system32\Drivers\volmgrx.sys

R0 - [volsnap] - Storage volumes - C:\Windows\system32\Drivers\volsnap.sys

R0 - [Wdf01000] - Kernel Mode Driver Frameworks service - C:\Windows\system32\Drivers\Wdf01000.sys

R1 - [AFD] - Ancillary Function Driver for Winsock - C:\Windows\system32\Drivers\AFD.sys

R1 - [beep] - Beep - C:\Windows\system32\Drivers\Beep.sys

R1 - [tdx] - NetIO Legacy TDI Support Driver - C:\Windows\system32\Drivers\tdx.sys

R2 - [tcpipreg] - TCP/IP Registry Compatibility - C:\Windows\system32\Drivers\tcpipreg.sys

==== System Specs ======================

Windows: Windows 7 Professional Edition (64-bit) Service Pack 1 (Build 7601)

Memory (RAM): 16302 MB

CPU Info: Intel® Core i7-2600K CPU @ 3.40GHz

CPU Speed: 3390.0 MHz

Sound Card: Speakers (Realtek High Definiti |

Realtek Digital Output(Optical) |

Realtek Digital Output (Realtek |

Monitors: 1x; SyncMaster 206BW(Digital) |

Screen Resolution: 1680 X 1050 - 32 bit

Network: Network Present

Network Adapters: Realtek PCIe GBE Family Controller

CD / DVD Drives: 1x (D: | ) D: Optiarc DVD RW AD-7280S

Ports: COM1 LPT Port NOT Present.

Mouse: 8 Button Wheel Mouse Present

Hard Disks: C: 931.4GB | K: 931.5GB | L: 931.5GB | N: 1397.3GB

Hard Disks - Free: C: 644.3GB | K: 22.1GB | L: 8.9GB | N: 1267.5GB

Manufacturer *: Award Software International, Inc.

BIOS Info: AT/AT COMPATIBLE | 10/11/11 | GBT - 42302e31

Time Zone: AUS Eastern Standard Time

Motherboard *: Gigabyte Technology Co., Ltd. Z68XP-UD3

Country: Australia

Language: ENA

==== System Specs (Software) ======================

Anti-Virus: AVG Internet Security 2014 On-access scanning disabled (Outdated)

Anti-Spyware: Windows Defender disabled (Outdated)

Anti-Spyware: IObit Malware Fighter disabled (Outdated)

Anti-Spyware: AVG Internet Security 2014 disabled (Outdated)

Firewall: AVG Internet Security 2014 disabled

Default Browser: Google Chrome 39.0.2171.99

Internet Explorer Version: 11.0.9600.17501

Google Chrome version: 39.0.2171.99

Adobe Reader version: 11.0.10.32

Sun Java version: 1.7.0_72 (32-bit)

Flash Player version: 16.0.0.257

==== Files Recently Created / Modified ======================

====== C:\Windows ====

====== C:\Users\Jim\AppData\Local\Temp ====

====== Java Cache =====

====== C:\Windows\SysWOW64 =====

2015-01-16 16:04:24 6BEA81D3173FC13402033ADC86C88E29 1050112 ----a-w- C:\Windows\SysWOW64\mstsc.exe

2015-01-16 16:04:24 471B09D4C3A4EFE36A18CC1F433FE299 4922368 ----a-w- C:\Windows\SysWOW64\mstscax.dll

2015-01-16 16:04:24 22FE6C9FB6C490F9D279F95E5996323D 37376 ----a-w- C:\Windows\SysWOW64\tsgqec.dll

2015-01-16 16:04:24 157E827DCEF60AB109537FD34885725A 269312 ----a-w- C:\Windows\SysWOW64\aaclient.dll

2015-01-14 20:51:49 8999F18D38D55E34D356796507FFD639 192000 ----a-w- C:\Windows\SysWOW64\rdpendp_winip.dll

2015-01-14 20:51:48 D3F64318307CEC05CBDE533D99976532 16896 ----a-w- C:\Windows\SysWOW64\wksprtPS.dll

2015-01-14 20:51:48 3F853160DEE5B71B9AD2F1BAF2B1E55B 46592 ----a-w- C:\Windows\SysWOW64\MsRdpWebAccess.dll

2015-01-13 21:06:30 FE48346938C1CDDDF4E4097DB9B99764 52224 ----a-w- C:\Windows\SysWOW64\nlaapi.dll

2015-01-13 21:06:30 92940397DFFB4D237EA5BB22FF912BDC 156672 ----a-w- C:\Windows\SysWOW64\ncsi.dll

2015-01-13 21:06:24 2AF481C03C0383ADE09FFEDA0C583140 3971512 ----a-w- C:\Windows\SysWOW64\ntkrnlpa.exe

2015-01-13 21:06:23 9606307F5E1EABA98ACB61206EFC2127 43008 ----a-w- C:\Windows\SysWOW64\srclient.dll

2015-01-13 21:06:23 8A289EF0AE709327D6AA9769E108B5A6 3916728 ----a-w- C:\Windows\SysWOW64\ntoskrnl.exe

====== C:\Windows\SysWOW64\drivers =====

2014-12-25 06:29:28 E5805896A55D4166C20F216249F40FA3 26528 ----a-w- C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS

====== C:\Windows\Sysnative =====

2015-01-16 16:04:24 FDC825DBD7B8FD5AEFE573E19342071B 5780480 ----a-w- C:\Windows\Sysnative\mstscax.dll

2015-01-16 16:04:24 E345E529C548F9A876DE0FCC9447F32C 1125888 ----a-w- C:\Windows\Sysnative\mstsc.exe

2015-01-16 16:04:24 C234A772C8A9198F302ECE50B05AC258 322560 ----a-w- C:\Windows\Sysnative\aaclient.dll

2015-01-16 16:04:24 760453BB975A6615D360651718CA3866 44032 ----a-w- C:\Windows\Sysnative\tsgqec.dll

2015-01-16 16:04:23 E9CB5F138943D383DB67F29AAB60453F 3179520 ----a-w- C:\Windows\Sysnative\rdpcorets.dll

2015-01-15 21:15:25 DCD00561CBDE7FC42A49D84783F4C00B 62976 ----a-w- C:\Windows\Sysnative\TSWbPrxy.exe

2015-01-15 21:15:22 2147C5330F983D76A36B73F4A804F778 16384 ----a-w- C:\Windows\Sysnative\RdpGroupPolicyExtension.dll

2015-01-14 20:51:49 F059D17612BF074443C01FCCC8D5C905 54272 ----a-w- C:\Windows\Sysnative\MsRdpWebAccess.dll

2015-01-14 20:51:49 D346E07D62E3D4BEAB040939744EC31B 228864 ----a-w- C:\Windows\Sysnative\rdpendp_winip.dll

2015-01-14 20:51:49 AD4D0AEDB5993EDA31EB80A54EDBC344 243200 ----a-w- C:\Windows\Sysnative\rdpudd.dll

2015-01-14 20:51:48 9EB297848DAACF111C36B6048EFF5AEA 43520 ----a-w- C:\Windows\Sysnative\TsUsbGDCoInstaller.dll

2015-01-14 20:51:48 7B619C36F84720CB6AB77031B6F4FA60 13312 ----a-w- C:\Windows\Sysnative\TsUsbRedirectionGroupPolicyExtension.dll

2015-01-14 20:51:48 6846ECABF7034DD97EE1DE38F1DA16B4 384000 ----a-w- C:\Windows\Sysnative\wksprt.exe

2015-01-14 20:51:48 0E894692EB8579703FB1EC8AB6908571 13312 ----a-w- C:\Windows\Sysnative\TsUsbRedirectionGroupPolicyControl.exe

2015-01-14 20:51:48 09112DADA82F4700F833C2E40DFB59FC 18432 ----a-w- C:\Windows\Sysnative\wksprtPS.dll

2015-01-13 21:06:31 B6A58491307B4CADA572583D863DC602 210432 ----a-w- C:\Windows\Sysnative\profsvc.dll

2015-01-13 21:06:30 8B301D474B478E9A92823BAB50A7BC49 303616 ----a-w- C:\Windows\Sysnative\nlasvc.dll

2015-01-13 21:06:24 0A70B8D78AF95894E221DDAC6482DF6D 5553592 ----a-w- C:\Windows\Sysnative\ntoskrnl.exe

2015-01-13 21:06:23 F4846789B3795F14DCB7D92ED1DAF74F 503808 ----a-w- C:\Windows\Sysnative\srcore.dll

2015-01-13 21:06:23 DE595EACC79006E7B15B848BF0831E78 296960 ----a-w- C:\Windows\Sysnative\rstrui.exe

2015-01-13 21:06:23 BA6D609BAB615991E8791CA1DFFD034C 50176 ----a-w- C:\Windows\Sysnative\srclient.dll

2015-01-08 23:13:09 4D5D8058F17C873B4F0792678BAA6534 34080 ----a-w- C:\Windows\Sysnative\SmartDefragBootTime.exe

2015-01-08 23:10:53 84E8B979BBBDD23AD84E88FD12236306 128288 ----a-w- C:\Windows\Sysnative\IObitSmartDefragExtension.dll

====== C:\Windows\Sysnative\drivers =====

2015-01-14 20:51:49 313F68E1A3E6345A4F47A36B07062F34 19456 ----a-w- C:\Windows\Sysnative\drivers\rdpvideominiport.sys

2015-01-14 20:51:48 AD64450A4ABE076F5CB34CC08EEACB07 30208 ----a-w- C:\Windows\Sysnative\drivers\TsUsbGD.sys

2015-01-14 20:51:48 17C6B51CBCCDED95B3CC14E22791F85E 57856 ----a-w- C:\Windows\Sysnative\drivers\TsUsbFlt.sys

2015-01-13 21:06:27 AE3334958D8F631FF14A0AEB3D7EFB3A 141312 ----a-w- C:\Windows\Sysnative\drivers\mrxdav.sys

2015-01-08 23:10:52 E77CB3736A702D46A6FB15FB4A9894E3 21184 ----a-w- C:\Windows\Sysnative\drivers\SmartDefragDriver.sys

2015-01-03 01:20:27 26C43960C99EE861A5D0EDC4DCF3B1C3 129752 ----a-w- C:\Windows\Sysnative\drivers\MBAMSwissArmy.sys

2015-01-03 01:20:07 CA43F8904E24BBE49982E4C0B29E6579 25816 ----a-w- C:\Windows\Sysnative\drivers\mbam.sys

2015-01-03 01:20:07 A646C2DDB8C46E9B20A326FAF566646C 63704 ----a-w- C:\Windows\Sysnative\drivers\mwac.sys

2015-01-03 01:20:07 478CC94C937D235CB0A96AB8F2359D81 93400 ----a-w- C:\Windows\Sysnative\drivers\mbamchameleon.sys

2014-12-26 20:02:15 059F00DEF82BF41E433B7ED465847726 155584 ----a-w- C:\Windows\Sysnative\drivers\ataport.sys

2014-12-26 20:02:10 B3222734D80013D2C73841B0C549FA63 27584 ----a-w- C:\Windows\Sysnative\drivers\Diskdump.sys

2014-12-26 20:02:10 A3F0BC5897F9D3786A3CB695B163633A 190912 ----a-w- C:\Windows\Sysnative\drivers\storport.sys

2014-12-26 20:02:10 96BB922A0981BC7432C8CF52B5410FE6 274880 ----a-w- C:\Windows\Sysnative\drivers\msiscsi.sys

2014-12-26 20:01:42 70988118145F5F10EF24720B97F35F65 119296 ----a-w- C:\Windows\Sysnative\drivers\tdx.sys

2014-12-26 20:01:10 1A29A59A4C5BA6F8C85062A613B7E2B2 1684928 ----a-w- C:\Windows\Sysnative\drivers\ntfs.sys

2014-12-25 09:20:24 7B486E26DCA97766F3617A395690E76A 941784 ----a-w- C:\Windows\Sysnative\drivers\Rt64win7.sys

2014-12-25 09:17:47 03CBDC540473AA54D43DF4C7AC5205C4 65152 ----a-w- C:\Windows\Sysnative\drivers\EtronHub3.sys

2014-12-20 01:05:06 D41D8CD98F00B204E9800998ECF8427E 0 ---ha-w- C:\Windows\Sysnative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf

====== C:\Windows\Tasks ======

2015-01-08 23:13:09 F31941F0F6D0E10E52A1124BC75F6688 3170 ----a-w- C:\Windows\Sysnative\Tasks\SmartDefrag3_Update

2014-12-25 09:10:19 0A672DC8600ED68B222AC857379249E2 2850 ----a-w- C:\Windows\Sysnative\Tasks\ASC8_SkipUac_Jim

2014-12-25 06:30:20 143E7B0F153FEEA55D0E4D603BAC8DFE 2860 ----a-w- C:\Windows\Sysnative\Tasks\Driver Booster SkipUAC (SYSTEM)

2014-12-25 06:29:53 F00A7FA85CAD9EB1B61EBC565A8EDA3F 2892 ----a-w- C:\Windows\Sysnative\Tasks\Uninstaller_SkipUac_Jim

2014-12-25 06:29:33 DA2463FD4CDB3D33A2B564BF69C1D6D9 2850 ----a-w- C:\Windows\Sysnative\Tasks\Driver Booster SkipUAC (Jim)

2014-12-25 06:29:32 8E6ADD3902392A90CC0194007FB5E4E6 3220 ----a-w- C:\Windows\Sysnative\Tasks\Driver Booster Scan

2014-12-25 06:29:27 BEC6D895A16CA4BDE4083196A7D56068 3164 ----a-w- C:\Windows\Sysnative\Tasks\Driver Booster Update

====== C:\Windows\Temp ======

======= C:\Program Files =====

======= C:\PROGRA~2 =====

2014-12-27 06:04:02 -------- d-----w- C:\PROGRA~2\CCTV View

2014-12-25 09:21:41 -------- d-----w- C:\PROGRA~2\COMMON~1\Java

2014-12-25 09:21:24 -------- d-----w- C:\PROGRA~2\Java

2014-12-25 06:29:44 -------- d-----w- C:\PROGRA~2\COMMON~1\IObit

======= C: =====

====== C:\Users\Jim\AppData\Roaming ======

2015-01-16 23:08:51 -------- d-----w- C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp

2015-01-16 23:08:51 -------- d-----w- C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp

2015-01-16 23:08:51 -------- d-----w- C:\Users\UpdatusUser\AppData\Local\Temp

2015-01-16 23:08:51 -------- d-----w- C:\Users\Jim\AppData\Local\Temp

2015-01-16 23:08:51 -------- d-----w- C:\Users\Default\AppData\Local\Temp

2015-01-16 23:08:51 -------- d-----w- C:\Users\Default User\AppData\Local\Temp

2015-01-11 04:52:24 -------- d-----w- C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2014-12-30 03:13:38 -------- d-sh--w- C:\Users\Jim\AppData\Locallow\EmieBrowserModeList

2014-12-30 03:13:38 -------- d-sh--w- C:\Users\Jim\AppData\Local\EmieBrowserModeList

====== C:\Users\Jim ======

2015-01-16 23:16:29 -------- d-----w- C:\ProgramData\ProductData

2015-01-15 22:57:25 D23EC5AF103C75F3496C19A5885CF2A2 2125312 ----a-w- C:\Users\Jim\Downloads\FRST64.exe

2015-01-08 23:10:50 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Defrag 3

2015-01-07 02:57:46 -------- d-----r- C:\Users\Jim\Favorites

2014-12-29 21:00:00 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Malware Fighter

2014-12-25 09:21:27 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-12-25 06:29:51 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller

2014-12-25 06:29:42 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 8

2014-12-25 06:29:26 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 2

====== C: exe-files ==

2015-01-16 23:16:41 BA7DC0C9141BE7292CA7E744B6F19F26 897104 ----a-w- C:\Program Files (x86)\Google\Update\Install\{A1202809-D14C-4DD2-B341-E55D21D79236}\39.0.2171.99_39.0.2171.95_chrome_updater.exe

2015-01-16 23:16:41 BA7DC0C9141BE7292CA7E744B6F19F26 897104 ----a-w- C:\Program Files (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\39.0.2171.99\39.0.2171.99_39.0.2171.95_chrome_updater.exe

2015-01-16 16:04:24 E345E529C548F9A876DE0FCC9447F32C 1125888 ----a-w- C:\Windows\System32\mstsc.exe

2015-01-16 16:04:24 6BEA81D3173FC13402033ADC86C88E29 1050112 ----a-w- C:\Windows\SysWOW64\mstsc.exe

2015-01-15 22:57:25 D23EC5AF103C75F3496C19A5885CF2A2 2125312 ----a-w- C:\Users\Jim\Downloads\FRST64.exe

2015-01-15 21:15:25 DCD00561CBDE7FC42A49D84783F4C00B 62976 ----a-w- C:\Windows\System32\TSWbPrxy.exe

2015-01-14 20:51:48 6846ECABF7034DD97EE1DE38F1DA16B4 384000 ----a-w- C:\Windows\System32\wksprt.exe

2015-01-14 20:51:48 0E894692EB8579703FB1EC8AB6908571 13312 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe

2015-01-13 21:06:24 2AF481C03C0383ADE09FFEDA0C583140 3971512 ----a-w- C:\Windows\SysWOW64\ntkrnlpa.exe

2015-01-13 21:06:24 0A70B8D78AF95894E221DDAC6482DF6D 5553592 ----a-w- C:\Windows\System32\ntoskrnl.exe

2015-01-13 21:06:23 DE595EACC79006E7B15B848BF0831E78 296960 ----a-w- C:\Windows\System32\rstrui.exe

2015-01-13 21:06:23 8A289EF0AE709327D6AA9769E108B5A6 3916728 ----a-w- C:\Windows\SysWOW64\ntoskrnl.exe

=== C: other files ==

2015-01-14 20:51:49 313F68E1A3E6345A4F47A36B07062F34 19456 ----a-w- C:\Windows\System32\drivers\rdpvideominiport.sys

2015-01-14 20:51:48 AD64450A4ABE076F5CB34CC08EEACB07 30208 ----a-w- C:\Windows\System32\drivers\TsUsbGD.sys

2015-01-14 20:51:48 17C6B51CBCCDED95B3CC14E22791F85E 57856 ----a-w- C:\Windows\System32\drivers\TsUsbFlt.sys

2015-01-14 05:56:36 1C127C52F2B06562FECF67A5E07D148B 188446 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\AutoSave 1429.zip

2015-01-14 05:53:37 AA0BA6AD71A8B48DD0CFB6BB376F414F 186637 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\AutoSave 1428.zip

2015-01-14 05:40:47 DC6E9B250DCDD15E276BBE953186B8FB 186266 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\AutoSave 1427.zip

2015-01-14 05:37:57 CBD97E2C7323C9906007121F16F27363 185859 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\AutoSave 1426.zip

2015-01-14 02:19:05 1C18357D8D7933BE4EFB776AC46F900E 11161583 ----a-w- C:\Users\Jim\Documents\Endless Legend\Temporary Files\e0073ab0-9a62-4ff1-947f-2fad510e3618\Default_V1.zip

2015-01-14 01:54:04 44F095A2411D8151B349511DD4AAA393 185734 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\Wild Walkers - Attack Capital.zip

2015-01-14 01:52:37 B24A037DC367B67F71A0D52850BFD645 254553 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\Wild Walkers - Sieze Holding 3.zip

2015-01-14 01:42:03 F60282B36992BE4C0CF020FAE905B54D 177022 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\Wild Walkers - Sieze Holding 2.zip

2015-01-13 21:06:27 AE3334958D8F631FF14A0AEB3D7EFB3A 141312 ----a-w- C:\Windows\System32\drivers\mrxdav.sys

2015-01-12 20:17:33 EE203D8A37A1020CD1719809D9CB2B66 16577481 ----a-w- C:\Users\Jim\Documents\Endless Legend\Temporary Files\0f11d98e-0910-4bb3-b59c-ce76a51dfd99\Default_V1.zip

2015-01-12 04:09:21 F5857135DF54661F453A1103628017CF 177715 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\Wild Walkers - All at WAR.zip

2015-01-11 20:57:33 04B928F2C65750B864E63DA2C9D8E1D3 14887732 ----a-w- C:\Users\Jim\Documents\Endless Legend\Temporary Files\b07bb10a-0f58-4ade-a007-0203e4bc7f77\Default_V1.zip

2015-01-11 03:09:04 63A9D65BFC70BA5C9BAE9FF213CBAEA4 245109 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\Wild Walkers - It's You & I now.zip

2015-01-10 05:55:28 FC30991CC15B7E056132D93F8E0F3E67 245228 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\Wild Walkers - City Defence 1.zip

2015-01-10 05:44:19 15AF521517BA597E6ACE122819E4A751 177135 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\Wild Walkers - Sieze Attack start.zip

2015-01-10 05:37:35 5FD5E577E16445E779BBE78C469504AB 246873 ----atw- C:\Users\Jim\Documents\Endless Legend\Save Files\Wild Walkers - Attack 1.zip

==== Startup Registry Enabled ======================

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Advanced SystemCare 8"="C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCTray.exe /Auto"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-4070555886-3179266670-2468568908-1000\Software\Microsoft\Windows\CurrentVersion\Run]

"ISUSPM Startup"="C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup"

"Steam"="C:\Program Files (x86)\Steam\Steam.exe -silent"

"HumanizedEnso"="C:\Users\Jim\AppData\Local\HumanizedEnso\Enso.exe --disable-monologue-boxes"

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]

"Advanced SystemCare 8"="C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCTray.exe /Auto"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Dolby Home Theater v4"="C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe -autostart"

"ISUSScheduler"="C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe -start"

"AVG_UI"="C:\Program Files (x86)\AVG\AVG2014\avgui.exe /TRAYONLY"

"PMBVolumeWatcher"="C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe"

"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"BlueStacks Agent"="C:\Program Files (x86)\BlueStacks\HD-Agent.exe"

"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"ISUSPM Startup"="C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup"

"Steam"="C:\Program Files (x86)\Steam\Steam.exe -silent"

"HumanizedEnso"="C:\Users\Jim\AppData\Local\HumanizedEnso\Enso.exe --disable-monologue-boxes"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"="C:\\Windows\\SysWOW64\\nvinit.dll"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="C:\Windows\system32\igfxtray.exe"

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe"

"Persistence"="C:\Windows\system32\igfxpers.exe"

"RTHDVCPL"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s"

"RtHDVBg_Dolby"="C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 "

"WrtMon.exe"="C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"RPMKickstart"="C:\Program Files\GIGABYTE\SMART6\Recovery\RPMKickstart.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"="C:\\Windows\\system32\\nvinitx.dll"

==== Startup Registry Disabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\ReimageRealTimeProtector]

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ [undetermined Task]

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [25/07/2013 04:50 PM]

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [25/07/2013 04:50 PM]

==== Other Scheduled Tasks ======================

"C:\Windows\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe]

"C:\Windows\SysNative\tasks\ASC8_SkipUac_Jim" ["C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASC.exe" /SkipUac]

"C:\Windows\SysNative\tasks\Driver Booster Scan" [C:\Program Files (x86)\IObit\Driver Booster\Scheduler.exe]

"C:\Windows\SysNative\tasks\Driver Booster SkipUAC (Jim)" [C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe]

"C:\Windows\SysNative\tasks\Driver Booster SkipUAC (SYSTEM)" [C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe]

"C:\Windows\SysNative\tasks\Driver Booster Update" [C:\Program Files (x86)\IObit\Driver Booster\AutoUpdate.exe]

"C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]

"C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]

"C:\Windows\SysNative\tasks\SidebarExecute" [C:\Program Files\Windows Sidebar\sidebar.exe]

"C:\Windows\SysNative\tasks\SmartDefrag3_Update" [C:\Program Files (x86)\IObit\Smart Defrag 3\AutoUpdate.exe]

"C:\Windows\SysNative\tasks\Uninstaller_SkipUac_Administrator" [C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe]

"C:\Windows\SysNative\tasks\Uninstaller_SkipUac_Jim" [C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe]

==== Chromium Look ======================

Google Chrome Version: 39.0.2171.99 (Up to date, latest Stable version: 39.0.2171.99)